AIGO — Control Assessment Example
AIGO — AI Governance Operating Framework
Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier:AIGO-EXAMPLE-005
Document Type: Implementation Example
Example Type: AI Control Assessment
1. Purpose
This document provides an illustrative example of how an organization can assess the design, implementation, operation, effectiveness, and evidence of AI governance controls using the AIGO AI Governance Operating Framework. The example demonstrates how an organization can:- identify applicable controls;
- determine control objectives;
- identify control owners;
- assess control design;
- verify implementation;
- evaluate operating effectiveness;
- review supporting evidence;
- identify control deficiencies;
- determine residual risk;
- define corrective actions;
- verify corrective-action effectiveness;
- maintain control traceability;
- support management and assurance activities.
2. Example Organization
For this example, the organization is ExampleCorp, a fictional organization implementing AIGO. ExampleCorp operates the AI-enabled Candidate Assessment Assistant described in the previous examples.3. AI System Under Assessment
System Name: Candidate Assessment Assistant AI System ID:AI-HR-001
Business Function: Human Resources
AIGO Classification: Class 3 — Enhanced Governance
Assessment Type: Control Assessment
Assessment Stage: Pre-deployment / Operational Readiness
4. Assessment Objective
The objective is to determine whether the controls assigned to the AI system are:- appropriately designed;
- implemented;
- operating as intended;
- supported by sufficient evidence;
- effective in reducing identified risks.
5. Control Assessment Principles
AIGO applies the following principles:- controls must have a defined objective;
- controls must address identified risks or governance requirements;
- control ownership must be explicit;
- control implementation must be verifiable;
- control operation must be evidenced;
- effectiveness must be assessed;
- deficiencies must be tracked;
- corrective actions must be monitored;
- material control failures must be escalated.
6. Control Assessment Lifecycle
7. Control Assessment Scope
The assessment covers controls relating to:- governance;
- AI system registration;
- classification;
- risk management;
- human oversight;
- data quality;
- fairness;
- privacy;
- security;
- transparency;
- explainability;
- monitoring;
- incident management;
- change management;
- approval;
- assurance;
- continual improvement.
8. Control Universe
The example uses the following illustrative controls.9. Control Objective
Each control must have a clearly defined objective. For example: Control ID:AIGO-C-005
Control: Human Oversight
Objective: Ensure that AI-generated recommendations are subject to meaningful human review and that authorized personnel can challenge or override AI outputs.
10. Control Owner
Each control must have an accountable owner. For this example:11. Control Design Assessment
Control design answers:If implemented and operated as specified, would this control adequately address the intended risk or requirement?Design assessment considers:
- control objective;
- risk alignment;
- control activity;
- frequency;
- responsibility;
- authority;
- segregation of duties;
- escalation;
- evidence requirements.
12. Control Implementation Assessment
Implementation assessment answers:Has the designed control actually been implemented?Evidence may include:
- approved procedures;
- system configurations;
- records;
- training;
- access settings;
- workflow configuration;
- monitoring dashboards;
- completed assessments.
13. Operating Effectiveness Assessment
Operating effectiveness answers:Has the control operated as intended over the required period?This requires evidence of actual operation. A control may be:
- well designed but not implemented;
- implemented but not operating;
- operating but ineffective;
- effective and sustainable.
14. Evidence Assessment
Control evidence should demonstrate:- what was performed;
- who performed it;
- when it was performed;
- what result was obtained;
- whether exceptions occurred;
- how exceptions were handled.
15. Control Assessment Model
16. Control Rating Scale
ExampleCorp uses the following rating scale.17. Assessment Rating Dimensions
The assessment evaluates four dimensions.18. Control AIGO-C-001 — AI Governance Accountability
18.1 Control Objective
Ensure that accountability for AI governance is clearly established.18.2 Control Activity
ExampleCorp maintains:- an AI governance authority;
- defined AI governance roles;
- assigned system owners;
- assigned risk owners;
- escalation responsibilities.
18.3 Assessment
Overall Rating: Effective
19. Control AIGO-C-002 — AI System Registration
19.1 Control Objective
Ensure that AI systems are formally identified and registered before deployment.19.2 Evidence
- AI system register;
- system identifier;
- system owner;
- intended purpose;
- lifecycle status;
- classification.
19.3 Assessment
Overall Rating: Effective
20. Control AIGO-C-003 — AI System Classification
20.1 Control Objective
Ensure that AI systems receive an appropriate governance classification.20.2 Evidence
- classification assessment;
- classification rationale;
- approval record;
- review date.
20.3 Assessment
Overall Rating: Effective
21. Control AIGO-C-004 — AI Risk Assessment
21.1 Control Objective
Ensure that AI-related risks are identified, analyzed, evaluated, treated, and monitored.21.2 Evidence
- risk assessment;
- risk register;
- treatment plan;
- residual-risk evaluation;
- risk acceptance.
21.3 Assessment
Overall Rating: Partially Effective
22. Control Deficiency — Risk Assessment
The risk assessment process is implemented, but quarterly reassessment has not yet been completed for the current operating period.Finding
Finding ID:CA-001
Severity: Medium
Control: AIGO-C-004
Issue: Required periodic reassessment has not yet been completed.
Risk: Changes in system context may not be reflected in the current risk assessment.
23. Corrective Action — CA-001
Action: Complete the outstanding quarterly risk reassessment. Owner: Enterprise Risk Manager Due Date: To be assigned Priority: High Evidence Required: Approved updated risk assessment.24. Control AIGO-C-005 — Human Oversight
24.1 Control Objective
Ensure meaningful human oversight over AI-supported recruitment decisions.24.2 Control Activity
Recruitment personnel must:- review recommendations;
- challenge outputs where appropriate;
- override outputs where necessary;
- make final decisions;
- document material exceptions.
24.3 Assessment
Overall Rating: Effective
25. Control AIGO-C-006 — Data Quality
25.1 Control Objective
Ensure that data used by the AI system is sufficiently accurate, relevant, complete, and appropriate for its intended purpose.25.2 Assessment
Overall Rating: Partially Effective
26. Control Deficiency — Data Quality
Finding ID:CA-002
Issue: A subset of historical candidate records has incomplete education information.
Potential Impact: Model recommendations may be affected for candidates with incomplete records.
Severity: Medium
27. Corrective Action — CA-002
Actions:- identify incomplete records;
- determine whether they influence model output;
- establish data-quality thresholds;
- exclude unsuitable records;
- document remediation.
28. Control AIGO-C-007 — Fairness Assessment
28.1 Control Objective
Identify and monitor potential unfair or discriminatory outcomes.28.2 Control Activity
ExampleCorp performs:- pre-deployment fairness testing;
- subgroup analysis;
- outcome monitoring;
- periodic reassessment;
- escalation of material findings.
28.3 Assessment
Overall Rating: Partially Effective
29. Control Deficiency — Fairness Monitoring
Finding ID:CA-003
The fairness assessment exists, but the defined quarterly monitoring process has not yet completed its first full operating cycle.
Severity: High
Risk: Material changes in outcome disparity may not be detected promptly.
30. Corrective Action — CA-003
Actions:- complete the first monitoring cycle;
- validate monitoring thresholds;
- establish escalation criteria;
- report material findings to AI Governance Committee.
31. Control AIGO-C-008 — Privacy Protection
31.1 Control Objective
Ensure candidate information is processed appropriately and protected against unauthorized use or disclosure.31.2 Controls
- data minimization;
- access restriction;
- retention management;
- privacy assessment;
- secure processing;
- incident management.
31.3 Assessment
Overall Rating: Effective
32. Control AIGO-C-009 — Access Control
32.1 Control Objective
Prevent unauthorized access to AI systems and associated candidate information.32.2 Evidence
- access-control configuration;
- user-role records;
- privileged access review;
- audit logs;
- access review records.
32.3 Assessment
Overall Rating: Effective
33. Control AIGO-C-010 — Transparency
33.1 Control Objective
Ensure that relevant users and stakeholders receive appropriate information about the AI system and its role.33.2 Assessment
Overall Rating: Effective
34. Control AIGO-C-011 — AI Monitoring
34.1 Control Objective
Detect material changes in AI system performance, risk, control effectiveness, and operating conditions.34.2 Monitoring Activities
ExampleCorp monitors:- performance;
- error rates;
- fairness indicators;
- override rates;
- incidents;
- model drift;
- complaints;
- control failures.
34.3 Assessment
Overall Rating: Partially Effective
35. Control Deficiency — Monitoring
Finding ID:CA-004
The monitoring framework has been implemented, but some indicators do not yet have approved escalation thresholds.
Severity: Medium
36. Corrective Action — CA-004
Actions:- define thresholds;
- approve thresholds;
- document escalation rules;
- test alert mechanisms.
37. Control AIGO-C-012 — AI Incident Management
37.1 Control Objective
Ensure AI-related incidents are identified, reported, assessed, escalated, investigated, and resolved.37.2 Assessment
Overall Rating: Not Tested
38. Control Deficiency — Incident Testing
No material AI incident has occurred during the assessment period. The absence of incidents does not demonstrate that the incident-management control is effective. A tabletop exercise is therefore required.39. Corrective Action — CA-005
Action: Conduct an AI incident-management tabletop exercise. Owner: AI Incident Manager Evidence: Exercise record and lessons-learned report. Priority: Medium40. Control AIGO-C-013 — Change Management
40.1 Control Objective
Ensure material changes to the AI system are identified, assessed, approved, tested, and documented before implementation.40.2 Assessment
Overall Rating: Effective
41. Control AIGO-C-014 — AI System Approval
41.1 Control Objective
Ensure AI systems receive required governance approval before deployment or material changes.41.2 Evidence
- approval record;
- risk assessment;
- classification;
- control assessment;
- readiness review.
41.3 Assessment
Overall Rating: Effective
42. Control AIGO-C-015 — AI Assurance
42.1 Control Objective
Provide independent or appropriately objective evaluation of AI governance controls and system operation.42.2 Assessment
Overall Rating: Partially Effective
43. Control Assessment Summary
44. Overall Control Assessment
The overall control environment is assessed as: Partially Effective The majority of controls are appropriately designed and implemented. However, several controls require additional operating evidence and corrective action before the system can be considered fully controlled.45. Control Effectiveness Distribution
46. Deficiency Classification
Control deficiencies are classified according to their potential effect.47. Findings Register
48. Corrective Action Lifecycle
49. Root Cause Analysis
Corrective action should address the underlying cause rather than merely correcting the visible symptom. Example: Symptom: Fairness monitoring was not completed. Possible root cause: Monitoring responsibility and recurring execution workflow were not sufficiently operationalized. Corrective action: Establish automated scheduling, accountable ownership, escalation rules, and completion tracking.50. Corrective Action Prioritization
51. Corrective Action Tracking
52. Evidence Quality
Control evidence is assessed for:- authenticity;
- completeness;
- relevance;
- accuracy;
- timeliness;
- traceability;
- integrity.
53. Evidence Quality Scale
54. Evidence Assessment Example
ForAIGO-C-007:
Control: Fairness Assessment
Evidence: Fairness test report.
Assessment:
- authentic: Yes;
- relevant: Yes;
- complete: Partial;
- current: Yes;
- traceable: Yes.
55. Control Evidence Chain
56. Control-to-Risk Relationship
Controls must be connected to risks.57. Control-to-Lifecycle Relationship
58. Control Assessment and Residual Risk
Control effectiveness directly informs residual risk.59. Example Residual Risk Update
Before control assessment: R-001 Biased Candidate Ranking Inherent Risk: 20 — Critical After initial controls: Residual Risk: 10 — High Following the discovery that fairness monitoring is incomplete, the organization determines that the residual risk remains High until corrective action is completed.60. Control Assessment Decision
The assessment determines: Control Environment: Partially Effective Deployment Status: Conditional Conditions:- close high-severity fairness finding;
- complete outstanding risk reassessment;
- resolve data-quality issue;
- define monitoring thresholds;
- complete incident-management testing;
- establish assurance evidence.
61. Conditional Approval
The AI system may proceed only if the AI Governance Committee accepts the identified residual risk and formally records the conditions. No control deficiency may be silently ignored.62. Management Escalation
The following conditions require escalation:- critical control failure;
- high residual risk caused by control failure;
- repeated overdue corrective actions;
- evidence of material harm;
- inability to operate required human oversight;
- failure of mandatory controls;
- significant unapproved system change.
63. Control Assessment Reporting
The assessment report should communicate:- controls assessed;
- assessment methodology;
- effectiveness ratings;
- findings;
- risk implications;
- corrective actions;
- overdue actions;
- residual risk;
- management decisions.
64. Example Management Report
Assessment: AI Governance Control Assessment System:AI-HR-001
Overall Rating: Partially Effective
High Finding: Fairness monitoring incomplete.
Medium Findings: Four.
Critical Findings: None.
Residual Risk: High for selected risk categories.
Recommendation: Conditional continuation subject to corrective action.
65. Retesting
Corrective actions must be retested where necessary. Retesting verifies:- action was implemented;
- root cause was addressed;
- control now operates;
- evidence is available;
- risk has been reduced.
66. Corrective Action Effectiveness
A corrective action is not considered complete merely because an activity has been performed. Example: Action: Conduct fairness monitoring. The assessor must determine whether:- monitoring was actually performed;
- results were reviewed;
- thresholds operated;
- exceptions were identified;
- escalation occurred where required;
- the underlying control deficiency was resolved.
67. Finding Closure Criteria
A finding may be closed when:- corrective action is implemented;
- required evidence exists;
- effectiveness is demonstrated;
- residual risk is acceptable;
- responsible authority approves closure.
68. Example Finding Closure
Finding:CA-003
Original Issue: Fairness monitoring incomplete.
Corrective Action: Implement recurring fairness monitoring and escalation.
Evidence: Three completed monitoring cycles.
Result: No material unexplained disparity identified.
Control Rating: Effective.
Finding Status: Closed.
69. Control Assessment Reassessment
Controls must be reassessed when:- risks change;
- system functionality changes;
- controls change;
- incidents occur;
- monitoring indicates deterioration;
- regulatory requirements change;
- suppliers change;
- assurance identifies weaknesses.
70. Control Assessment Frequency
ExampleCorp performs:- pre-deployment assessment;
- annual formal control assessment;
- quarterly monitoring;
- event-triggered reassessment;
- post-incident reassessment;
- material-change reassessment.
71. Independence
Where practical, control assessment should provide sufficient independence from the person performing the control. For example:- control owner performs self-assessment;
- second-line risk function reviews;
- assurance function independently tests selected controls.
72. Three-Level Assurance Model
73. Control Assessment Traceability
Every assessment should be traceable to:- AI system;
- risk;
- control;
- control owner;
- assessment criteria;
- evidence;
- finding;
- corrective action;
- retest;
- final decision.
74. Example Traceability Record
75. Control Assessment Data Model
76. Minimum Control Assessment Record
AIGO implementations should maintain, at minimum:- control ID;
- control name;
- control objective;
- risk relationship;
- lifecycle relationship;
- control owner;
- assessment date;
- assessor;
- design assessment;
- implementation assessment;
- operating assessment;
- evidence assessment;
- overall rating;
- findings;
- corrective actions;
- due dates;
- retest;
- closure decision.
77. Control Assessment Checklist
- Applicable control identified
- Control objective documented
- Control owner assigned
- Risk relationship documented
- Control design assessed
- Implementation verified
- Operation assessed
- Evidence reviewed
- Effectiveness rating assigned
- Findings documented
- Corrective actions assigned
- Residual risk evaluated
- Retesting completed where required
- Closure approved
78. Relationship to AIGO Procedures
This example should be implemented through the applicable AIGO procedures, particularly:- AI Governance Procedure;
- AI Control Assessment Procedure;
- AI Risk Assessment Procedure;
- AI Approval Procedure;
- AI Monitoring Procedure;
- AI Assurance Procedure;
- AI Incident Management Procedure;
- AI Change Management Procedure;
- Continuous Improvement Procedure.
79. Relationship to AIGO Framework Controls
The assessment demonstrates how AIGO controls can be:- assigned;
- implemented;
- tested;
- evidenced;
- rated;
- remediated;
- reassessed.
80. Relationship to ISO/IEC 42001
Control assessment can support an AI management system aligned with ISO/IEC 42001 by providing evidence that relevant governance and operational controls are implemented and evaluated. The organization should separately determine applicable requirements and conformity obligations.81. Relationship to NIST AI RMF
The assessment also supports activities associated with NIST AI RMF:82. Example Final Assessment
AI System: Candidate Assessment Assistant AI System ID:AI-HR-001
Classification: Class 3 — Enhanced Governance
Assessment: Control Assessment
Overall Control Rating: Partially Effective
High Findings: 1
Medium Findings: 4
Critical Findings: 0
Deployment Decision: Conditional
Primary Condition: Complete fairness monitoring corrective action.
83. Key Lessons
83.1 A Control Is Not Effective Simply Because It Exists
Documentation alone does not demonstrate operating effectiveness.83.2 Evidence Is Essential
Control conclusions must be supported by reliable evidence.83.3 Control Weaknesses Affect Risk
A weak control can increase residual risk.83.4 Corrective Action Must Address Root Cause
Closing a task does not necessarily close the underlying deficiency.83.5 Retesting Matters
Corrective actions should be tested to confirm that the control actually improved.83.6 Control Assessment Is Continuous
Controls should be reassessed when risks, systems, processes, or operating environments change.84. AIGO Control Assessment Model
The complete model can be summarized as:85. Document Status
Document: AIGO — Control Assessment Example Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier:AIGO-EXAMPLE-005
Document Type: Implementation Example
Example Type: AI Control Assessment
This document provides an illustrative example of how AI governance controls can be assessed, evidenced, remediated, retested, and reported within the AIGO AI Governance Operating Framework.
86. End of Example Document
AIGO — Control Assessment Example Document ID:AIGO-EXAMPLE-005
Version: 0.1
Status: Draft
End of Document