AIGO — AI Governance Operating Framework

AI Management Review Template

Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-TPL-013 Document Type: AI Management Review Template Template Purpose: Controlled Review of AI Governance Performance, Risk, Controls, Decisions, and Continual Improvement

1. Template Purpose

This template provides the controlled structure for conducting and documenting management review of the organization’s AI governance arrangements under the AIGO AI Governance Operating Framework. Management review provides a structured mechanism for appropriate leadership or governance authority to evaluate whether AI governance remains:

suitable;
adequate;
effective;
risk-appropriate;
properly resourced;
responsive to changes;
capable of achieving intended governance outcomes.

Management review should consider information from across the AIGO governance lifecycle, including:

AI portfolio;
organizational context;
governance performance;
AI classification;
risk;
controls;
monitoring;
incidents;
changes;
assurance;
accepted residual risk;
stakeholder feedback;
regulatory developments;
third-party dependencies;
continual improvement.

This template does not replace the organization’s approved AIGO Management Review or Governance Procedure.

2. Management Review Instructions

Complete all applicable sections. Where information is unavailable, record: Pending — [reason] Where a section does not apply, record: Not Applicable — [reason] Management review decisions should be supported by controlled evidence. Use stable identifiers wherever possible. Recommended identifiers include:

Governance Record ID;
Management Review ID;
AI System ID;
Risk ID;
Control ID;
Incident ID;
Change ID;
Assurance ID;
Approval ID;
Improvement ID;
Evidence ID;
Decision ID.

3. Management Review Record

3.1 Identification

Management Review ID: Review Version: Review Title: Review Type:

Periodic
Triggered
Post-Incident
Post-Assurance
Post-Material Change
Strategic
Annual
Other

Review Status:

Draft
Scheduled
In Progress
Awaiting Inputs
Under Governance Review
Decision Pending
Approved
Closed
Follow-Up Required

Review Owner: Review Chair: Review Secretary / Coordinator: Review Authority: Date Scheduled: Review Date: Next Review Date:

4. Review Authority and Governance

4.1 Review Authority

Management / Governance Body: Authority Basis:

4.2 Participants

Participant	Role	Responsibility in Review	Decision Authority

4.3 Required Functions

Consider representation from:

executive management;
AI governance;
risk;
business ownership;
technical ownership;
privacy;
security;
legal / compliance;
assurance;
data governance;
other relevant functions.

Applicable Participants:

4.4 Quorum

Quorum Requirement: Quorum Achieved: Rationale if Not Achieved:

5. Review Scope and Period

5.1 Review Period

From: To:

5.2 Organizational Scope

Business Units / Functions Covered:

5.3 AI Portfolio Scope

AI Systems / Portfolio Covered:

5.4 Geographic Scope

Jurisdictions / Locations Covered:

5.5 Lifecycle Scope

Management review may consider all applicable AIGO lifecycle stages:

Govern
Identify
Classify
Assess
Treat
Approve
Deploy
Operate
Monitor
Assure
Improve
Change
Continue
Retire

Applicable Stages:

5.6 Review Exclusions

Excluded Areas: Exclusion Rationale:

6. Review Objectives

6.1 Primary Objectives

The review should determine whether:

AI governance remains suitable;
AI governance remains adequate;
AI governance is operating effectively;
risks remain within approved tolerance;
controls remain effective;
monitoring is effective;
incidents and changes are appropriately governed;
assurance findings are addressed;
governance objectives are being achieved;
improvement actions are appropriate.

Applicable Objectives:

6.2 Review Questions

Key Questions for Management:

7. Review Inputs

7.1 Governance Inputs

Management review may consider:

governance structure;
governance decisions;
governance metrics;
governance exceptions;
changes in accountability;
committee activity.

Governance Inputs:

7.2 AI Portfolio Inputs

AI Inventory Summary: Number of AI Systems: Number of New Systems: Number of Retired Systems: Number of Restricted / Suspended Systems:

8. AI Portfolio Status

8.1 Portfolio Summary

Category	Count	Change from Previous Review	Key Observation
Registered AI Systems
Under Assessment
Approved
Operational
Restricted
Suspended
Retiring
Retired

8.2 Classification Distribution

Classification	Number of Systems	Trend	Key Observation
Class 1
Class 2
Class 3
Class 4

8.3 Portfolio Risk Profile

Portfolio Risk Summary:

9. Organizational Context and Changes

9.1 Context Changes

Consider changes to:

organizational structure;
strategy;
business objectives;
technology;
market conditions;
risk environment;
stakeholders;
legal entities;
jurisdictions;
third parties.

Changes Since Previous Review:

9.2 AI Governance Implications

Implications for AI Governance:

9.3 Governance Response

Required Response:

10. Strategic AI Governance Alignment

10.1 Strategic Objectives

Relevant Organizational Strategic Objectives:

10.2 AI Governance Alignment

How AI governance supports strategic objectives:

10.3 Strategic Gaps

Identified Gaps:

10.4 Strategic Decisions Required

Decisions:

11. Governance Performance

11.1 Governance Objectives

Objective	Target	Actual	Status	Owner

11.2 Governance Metrics

Metric	Definition	Target	Actual	Trend	Status

11.3 Governance Performance Conclusion

Conclusion:

12. Risk Performance

12.1 Overall Risk Position

Overall AI Risk Position:

12.2 Risk Distribution

Risk Level	Number of Risks	Trend	Key Observation
Low
Medium
High
Critical

12.3 Highest Risks

Risk ID	AI System	Risk	Level	Owner	Treatment Status

12.4 Risk Above Tolerance

Risks Above Approved Tolerance:

12.5 Emerging Risks

Emerging AI Risks:

12.6 Risk Governance Conclusion

Conclusion:

13. Risk Acceptance Review

13.1 Accepted Residual Risks

Risk Acceptance ID	Risk ID	Residual Risk	Acceptance Authority	Expiry / Review	Status

13.2 Acceptance Conditions

Open Acceptance Conditions:

13.3 Expiring Acceptance

Risk Acceptances Requiring Renewal / Reassessment:

13.4 Management Decision

Decision:

Continue Acceptance
Modify Conditions
Reduce Risk
Escalate
Suspend Acceptance
Revoke Acceptance
Other

Rationale:

14. Control Performance

14.1 Control Environment

Overall Control Environment:

Effective
Generally Effective
Partially Effective
Ineffective
Unable to Conclude

Rationale:

14.2 Control Rating Distribution

Rating	Number of Controls	Trend
Effective
Partially Effective
Ineffective
Not Implemented
Not Tested

14.3 Critical Control Status

Critical Controls Requiring Attention:

14.4 Control Findings

Finding ID	Control ID	Finding	Severity	Owner	Status

14.5 Control Performance Conclusion

Conclusion:

15. Monitoring Performance

15.1 Monitoring Status

Overall Monitoring Status:

Normal
Acceptable with Observations
Warning
Escalated
Critical

Rationale:

15.2 Key Monitoring Indicators

Indicator	Target / Threshold	Actual	Trend	Status	Action

15.3 Significant Monitoring Deviations

Deviations:

15.4 Enhanced Monitoring

AI Systems Under Enhanced Monitoring:

15.5 Monitoring Governance Conclusion

Conclusion:

16. Incident Performance

16.1 Incident Summary

Severity	Number	Open	Closed	Trend
Informational
Low
Medium
High
Critical

16.2 Significant Incidents

Incident ID	AI System	Severity	Description	Status	Residual Risk

16.3 Incident Trends

Observed Trends:

16.4 Incident Lessons

Key Lessons:

16.5 Incident Governance Conclusion

Conclusion:

17. Change Performance

17.1 Change Summary

Change Status	Number	Trend
Submitted
Approved
Deployed
Deferred
Rejected
Rolled Back
Closed

17.2 Material Changes

Change ID	AI System	Description	Risk Impact	Approval	Status

Incidents Related to Changes:

17.4 Change Governance Conclusion

Conclusion:

18. Classification Performance

18.1 Classification Changes

Number of Reclassifications:

18.2 Classification Accuracy / Appropriateness

Assessment:

18.3 Classification Issues

Issues:

18.4 Reclassification Decisions

Required Decisions:

19. Approval Performance

19.1 Approval Status

Approval Status	Number	Trend
Approved
Approved with Conditions
Deferred
Rejected
Suspended
Revoked

19.2 Overdue Conditions

Open / Overdue Approval Conditions:

19.3 Approval Governance Conclusion

Conclusion:

20. Human Oversight Performance

20.1 Oversight Indicators

Indicator	Target	Actual	Trend	Status

20.2 Human Oversight Findings

Findings:

20.3 Automation Bias / Human Reliance

Observed Issues:

20.4 Human Oversight Conclusion

Conclusion:

21. Security and Privacy Performance

21.1 Security Summary

Security Governance Status: Significant Security Events:

21.2 Privacy Summary

Privacy Governance Status: Significant Privacy Events:

21.3 Security / Privacy Decisions

Required Decisions:

22. Fairness, Impact, and Responsible AI Performance

22.1 Fairness Status

Overall Fairness Status:

22.2 Significant Findings

Findings:

22.3 Affected-Person Impact

Observed / Potential Impact:

22.4 Corrective Actions

Actions:

22.5 Governance Decision

Decision:

23. Assurance Performance

23.1 Assurance Summary

Assurance Type	Number	Completed	Open	Trend
Governance
Control
Technical
Independent
Other

23.2 Assurance Findings

Finding ID	Area	Severity	Owner	Due Date	Status

23.3 Repeat Findings

Repeat / Recurring Findings:

23.4 Assurance Conclusion

Conclusion:

24. Third-Party Governance Performance

24.1 Supplier Summary

Supplier / Provider	Systems / Services	Risk	Assurance Status	Incidents	Changes

24.2 Supplier Issues

Issues:

24.3 Supplier Decisions

Required Decisions:

25. Regulatory and External Requirements

25.1 Regulatory Changes

Changes in Laws / Regulations / Standards:

25.2 Compliance Impact

Governance Impact:

25.3 Required Actions

Actions:

25.4 Regulatory Risk

Regulatory Risk Status:

26. Governance Exceptions

26.1 Open Exceptions

Exception ID	Requirement	Reason	Risk	Owner	Expiry	Status

26.2 Expiring Exceptions

Exceptions Requiring Decision:

26.3 Exception Decision

Decision:

27. Resource and Capability Review

27.1 Staffing

Adequacy of Governance Staffing:

27.2 Competence

Competence / Training Adequacy:

27.3 Technology

Technology / Tooling Adequacy:

27.4 Financial Resources

Resource / Budget Adequacy:

27.5 External Capability

Third-Party / External Support Adequacy:

27.6 Resource Decisions

Required Resource Decisions:

28. Documentation and Evidence Quality

28.1 Documentation Status

Documentation Adequacy:

Adequate
Partially Adequate
Inadequate

Rationale:

28.2 Evidence Quality

Overall Evidence Quality:

Strong
Adequate
Moderate
Weak
Insufficient

Rationale:

28.3 Evidence Gaps

Material Evidence Gaps:

28.4 Document-Control Issues

Issues:

29. Stakeholder Feedback

29.1 Feedback Sources

Potential sources include:

users;
affected persons;
customers;
employees;
management;
regulators;
suppliers;
assurance;
incident management.

Feedback Sources:

29.2 Significant Feedback

Key Feedback:

29.3 Governance Implications

Implications:

30. Governance Maturity

30.1 Current Maturity

Current AIGO Governance Maturity Level: Maturity Assessment Reference:

30.2 Maturity Strengths

30.3 Maturity Gaps

30.4 Maturity Improvement Priorities

31. Continual Improvement

31.1 Improvement Sources

Improvement opportunities may originate from:

risk assessments;
control assessments;
incidents;
monitoring;
assurance;
management review;
stakeholder feedback;
regulatory developments;
technology developments;
lessons learned.

Sources Considered:

31.2 Improvement Register

Improvement ID	Source	Description	Owner	Priority	Target Date	Status

31.3 Priority Improvements

Priority Improvements:

32. Opportunities for Improvement

32.1 Governance Opportunities

Opportunities:

32.2 Risk Opportunities

Opportunities:

32.3 Control Opportunities

Opportunities:

32.4 Technology Opportunities

Opportunities:

32.5 Capability Opportunities

Opportunities:

33. Management Review Analysis

33.1 What Is Working Well?

Strengths:

33.2 What Requires Attention?

Areas Requiring Attention:

33.3 What Has Changed?

Material Changes:

33.4 What Is Emerging?

Emerging Risks / Issues / Opportunities:

34. Management Decisions

34.1 Decision Register

Decision ID	Decision	Rationale	Owner	Due Date	Evidence	Status

34.2 Possible Decisions

Management may decide to:

continue;
improve;
change;
increase monitoring;
strengthen controls;
reassess risk;
reclassify;
restrict;
suspend;
retire;
allocate resources;
change governance requirements;
commission additional assurance.

Selected Decisions:

35. Governance Changes

35.1 Governance Changes Required

Changes to governance structure, roles, authority, policies, procedures, controls, or requirements:

35.2 Governance Change Actions

Change ID	Governance Change	Owner	Priority	Target Date	Status

36. Risk and Control Decisions

36.1 Risk Decisions

Required Risk Decisions:

36.2 Control Decisions

Required Control Decisions:

36.3 Monitoring Decisions

Required Monitoring Decisions:

36.4 Assurance Decisions

Required Assurance Decisions:

37. Management Review Decision

37.1 Overall Governance Decision

Decision:

Continue
Continue with Conditions
Improve
Change
Restrict
Suspend
Retire
Escalate
Other

37.2 Decision Rationale

Rationale:

37.3 Conditions

Condition ID	Condition	Owner	Due Date	Verification	Status

38. Management Review Conclusion

38.1 Suitability

Is the AI governance arrangement suitable for the organization?

Yes
Partially
No

Rationale:

38.2 Adequacy

Is the governance arrangement adequate for the current AI portfolio and risk environment?

Yes
Partially
No

Rationale:

38.3 Effectiveness

Is the governance arrangement operating effectively?

Yes
Partially
No
Unable to Conclude

Rationale:

38.4 Overall Conclusion

Overall Management Review Conclusion:

39. Action Plan

Action ID	Decision / Action	Source	Owner	Priority	Target Date	Evidence	Status

39.1 Action Prioritization

Priority Actions:

40. Follow-Up

40.1 Follow-Up Requirements

Follow-Up Required:

40.2 Follow-Up Owner

Owner:

40.3 Follow-Up Date

Date:

40.4 Follow-Up Evidence

Evidence IDs:

40.5 Action Closure

Closure Criteria:

41. Evidence Profile

41.1 Evidence Repository

Management Review Evidence Repository: Evidence Owner:

41.2 Evidence Register

Evidence ID	Evidence Type	Description	Owner	Date	Location	Status

41.3 Evidence Completeness

Evidence Status:

Complete
Substantially Complete
Partially Complete
Incomplete

Evidence Gaps:

42. Review Traceability

The management review should maintain traceability to relevant AIGO records.

AIGO Record	Identifier
Governance Record
AI System Registration
AI System Profile
Classification Records
Risk Assessments
Risk Acceptance Records
Control Assessments
Monitoring Records
Incident Records
Change Records
Approval Records
Assurance Records
Improvement Records
Retirement Records
Evidence Records

43. Management Review Traceability Model

Organizational Context
        ↓
AI Portfolio
        ↓
Governance Objectives
        ↓
Risk
        ↓
Controls
        ↓
Monitoring
        ↓
Incidents
        ↓
Changes
        ↓
Assurance
        ↓
Stakeholder Feedback
        ↓
Management Review
        ↓
Decision
        ↓
Action
        ↓
Verification
        ↓
Continual Improvement

44. Review Approval

44.1 Prepared By

Name: Role: Date:

44.2 Reviewed By

Name: Role: Date:

44.3 Approved By

Name: Role: Date:

44.4 Approval Decision

Decision:

Approved
Approved with Conditions
Returned for Additional Review
Deferred
Rejected

Conditions:

45. Review Schedule

45.1 Periodic Review

Review Frequency: Next Review Date: Review Owner:

45.2 Triggered Review

A management review may be triggered by:

significant incidents;
material AI-system changes;
significant risk changes;
critical control failures;
major assurance findings;
regulatory developments;
strategic changes;
significant stakeholder concerns;
major technology changes;
material governance deficiencies.

Additional Triggers:

46. Review Change History

Version	Date	Change	Changed By	Reviewer	Approval
0.1		Initial management review

47. Management Review Completion Checklist

48. Template Usage Instructions

This template should be completed according to the organization’s approved AIGO governance and management-review requirements. Management review should be based on current and reliable information. The review should consider whether the AI governance arrangement remains:

suitable for organizational objectives;
adequate for the current AI portfolio;
proportionate to AI risk;
effective in practice;
appropriately resourced;
responsive to incidents, changes, and emerging risks.

Management review should not be treated as a purely administrative meeting. Where material weaknesses are identified, the review should result in documented decisions and actions. Decisions should have:

an accountable owner;
a due date;
appropriate priority;
verification requirements;
supporting evidence.

Management review should feed directly into continual improvement.

49. Template Governance

49.1 Template Owner

Template Owner:

49.2 Template Review

Review Frequency: Next Review Date:

49.3 Template Change Control

Changes to this template should be managed through the applicable AIGO document and change-management process. Material changes should consider their effect on:

AI Governance Procedure;
Management Review requirements;
AI Risk Assessment;
AI Control Assessment;
Monitoring;
Incident Management;
Change Management;
Assurance;
Risk Acceptance;
Continuous Improvement;
schemas;
mappings;
tools.

50. Document Control

Field	Value
Document	AIGO — AI Management Review Template
Version	0.1
Status	Draft
Document Identifier	`AIGO-TPL-013`
Document Type	AI Management Review Template
Template Owner
Approved By
Approval Date
Effective Date
Next Review Date

51. Template Status

Document: AIGO — AI Management Review Template Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-TPL-013 Document Type: AI Management Review Template This template provides the controlled structure for reviewing the suitability, adequacy, effectiveness, risk position, control environment, operational performance, governance capability, and continual-improvement requirements of the AIGO AI Governance Operating Framework.

52. End of Template

AIGO — AI Management Review Template Document ID: AIGO-TPL-013 Version: 0.1 Status: Draft End of Template

​AIGO — AI Governance Operating Framework

​AI Management Review Template

​1. Template Purpose

​2. Management Review Instructions

​3. Management Review Record

​3.1 Identification

​4. Review Authority and Governance

​4.1 Review Authority

​4.2 Participants

​4.3 Required Functions

​4.4 Quorum

​5. Review Scope and Period

​5.1 Review Period

​5.2 Organizational Scope

​5.3 AI Portfolio Scope

​5.4 Geographic Scope

​5.5 Lifecycle Scope

​5.6 Review Exclusions

​6. Review Objectives

​6.1 Primary Objectives

​6.2 Review Questions

​7. Review Inputs

​7.1 Governance Inputs

​7.2 AI Portfolio Inputs

​8. AI Portfolio Status

​8.1 Portfolio Summary

​8.2 Classification Distribution

​8.3 Portfolio Risk Profile

​9. Organizational Context and Changes

​9.1 Context Changes

​9.2 AI Governance Implications

​9.3 Governance Response

​10. Strategic AI Governance Alignment

​10.1 Strategic Objectives

​10.2 AI Governance Alignment

​10.3 Strategic Gaps

​10.4 Strategic Decisions Required

​11. Governance Performance

​11.1 Governance Objectives

​11.2 Governance Metrics

​11.3 Governance Performance Conclusion

​12. Risk Performance

​12.1 Overall Risk Position

​12.2 Risk Distribution

​12.3 Highest Risks

​12.4 Risk Above Tolerance

​12.5 Emerging Risks

​12.6 Risk Governance Conclusion

​13. Risk Acceptance Review

​13.1 Accepted Residual Risks

​13.2 Acceptance Conditions

​13.3 Expiring Acceptance

​13.4 Management Decision

​14. Control Performance

​14.1 Control Environment

​14.2 Control Rating Distribution

​14.3 Critical Control Status

​14.4 Control Findings

​14.5 Control Performance Conclusion

​15. Monitoring Performance

​15.1 Monitoring Status

​15.2 Key Monitoring Indicators

​15.3 Significant Monitoring Deviations

​15.4 Enhanced Monitoring

​15.5 Monitoring Governance Conclusion

​16. Incident Performance

​16.1 Incident Summary

​16.2 Significant Incidents

​16.3 Incident Trends

​16.4 Incident Lessons

​16.5 Incident Governance Conclusion

​17. Change Performance

​17.1 Change Summary

​17.2 Material Changes

​17.3 Change-Related Incidents

​17.4 Change Governance Conclusion

​18. Classification Performance

​18.1 Classification Changes

​18.2 Classification Accuracy / Appropriateness

​18.3 Classification Issues

AIGO — AI Governance Operating Framework

AI Management Review Template

1. Template Purpose

2. Management Review Instructions

3. Management Review Record

3.1 Identification

4. Review Authority and Governance

4.1 Review Authority

4.2 Participants

4.3 Required Functions

4.4 Quorum

5. Review Scope and Period

5.1 Review Period

5.2 Organizational Scope

5.3 AI Portfolio Scope

5.4 Geographic Scope

5.5 Lifecycle Scope

5.6 Review Exclusions

6. Review Objectives

6.1 Primary Objectives

6.2 Review Questions

7. Review Inputs

7.1 Governance Inputs

7.2 AI Portfolio Inputs

8. AI Portfolio Status

8.1 Portfolio Summary

8.2 Classification Distribution

8.3 Portfolio Risk Profile

9. Organizational Context and Changes

9.1 Context Changes

9.2 AI Governance Implications

9.3 Governance Response

10. Strategic AI Governance Alignment

10.1 Strategic Objectives

10.2 AI Governance Alignment

10.3 Strategic Gaps

10.4 Strategic Decisions Required

11. Governance Performance

11.1 Governance Objectives

11.2 Governance Metrics

11.3 Governance Performance Conclusion

12. Risk Performance

12.1 Overall Risk Position

12.2 Risk Distribution

12.3 Highest Risks

12.4 Risk Above Tolerance

12.5 Emerging Risks

12.6 Risk Governance Conclusion

13. Risk Acceptance Review

13.1 Accepted Residual Risks

13.2 Acceptance Conditions

13.3 Expiring Acceptance

13.4 Management Decision

14. Control Performance

14.1 Control Environment

14.2 Control Rating Distribution

14.3 Critical Control Status

14.4 Control Findings

14.5 Control Performance Conclusion

15. Monitoring Performance

15.1 Monitoring Status

15.2 Key Monitoring Indicators

15.3 Significant Monitoring Deviations

15.4 Enhanced Monitoring

15.5 Monitoring Governance Conclusion

16. Incident Performance

16.1 Incident Summary

16.2 Significant Incidents

16.3 Incident Trends

16.4 Incident Lessons

16.5 Incident Governance Conclusion

17. Change Performance

17.1 Change Summary

17.2 Material Changes

17.3 Change-Related Incidents

17.4 Change Governance Conclusion

18. Classification Performance

18.1 Classification Changes

18.2 Classification Accuracy / Appropriateness

18.3 Classification Issues