> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aigoframework.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 05 AIGO Control Assessment Example v0.1

# AIGO — Control Assessment Example

## AIGO — AI Governance Operating Framework

**Version:** 0.1
**Status:** Draft
**Working Name:** AIGO
**Full Name:** AI Governance Operating Framework
**Document Identifier:** `AIGO-EXAMPLE-005`
**Document Type:** Implementation Example
**Example Type:** AI Control Assessment

***

## 1. Purpose

This document provides an illustrative example of how an organization can assess the design, implementation, operation, effectiveness, and evidence of AI governance controls using the AIGO AI Governance Operating Framework.

The example demonstrates how an organization can:

* identify applicable controls;
* determine control objectives;
* identify control owners;
* assess control design;
* verify implementation;
* evaluate operating effectiveness;
* review supporting evidence;
* identify control deficiencies;
* determine residual risk;
* define corrective actions;
* verify corrective-action effectiveness;
* maintain control traceability;
* support management and assurance activities.

This document is an example and does not constitute legal, regulatory, audit, or certification advice.

***

# 2. Example Organization

For this example, the organization is **ExampleCorp**, a fictional organization implementing AIGO.

ExampleCorp operates the AI-enabled Candidate Assessment Assistant described in the previous examples.

***

# 3. AI System Under Assessment

**System Name:** Candidate Assessment Assistant

**AI System ID:** `AI-HR-001`

**Business Function:** Human Resources

**AIGO Classification:** Class 3 — Enhanced Governance

**Assessment Type:** Control Assessment

**Assessment Stage:** Pre-deployment / Operational Readiness

***

# 4. Assessment Objective

The objective is to determine whether the controls assigned to the AI system are:

1. appropriately designed;
2. implemented;
3. operating as intended;
4. supported by sufficient evidence;
5. effective in reducing identified risks.

The assessment also determines whether deficiencies require remediation, risk acceptance, escalation, or additional controls.

***

# 5. Control Assessment Principles

AIGO applies the following principles:

* controls must have a defined objective;
* controls must address identified risks or governance requirements;
* control ownership must be explicit;
* control implementation must be verifiable;
* control operation must be evidenced;
* effectiveness must be assessed;
* deficiencies must be tracked;
* corrective actions must be monitored;
* material control failures must be escalated.

***

# 6. Control Assessment Lifecycle

```text id="nq7f0u" theme={null}
Identify Applicable Control
          ↓
Define Control Objective
          ↓
Assign Control Owner
          ↓
Assess Control Design
          ↓
Verify Implementation
          ↓
Assess Operating Effectiveness
          ↓
Review Evidence
          ↓
Determine Control Rating
          ↓
Identify Deficiency
          ↓
Corrective Action
          ↓
Retest
          ↓
Close / Escalate
```

***

# 7. Control Assessment Scope

The assessment covers controls relating to:

* governance;
* AI system registration;
* classification;
* risk management;
* human oversight;
* data quality;
* fairness;
* privacy;
* security;
* transparency;
* explainability;
* monitoring;
* incident management;
* change management;
* approval;
* assurance;
* continual improvement.

***

# 8. Control Universe

The example uses the following illustrative controls.

| Control ID | Control Area    | Control                      |
| ---------- | --------------- | ---------------------------- |
| AIGO-C-001 | Governance      | AI governance accountability |
| AIGO-C-002 | Registration    | AI system registration       |
| AIGO-C-003 | Classification  | AI system classification     |
| AIGO-C-004 | Risk            | AI risk assessment           |
| AIGO-C-005 | Human Oversight | Human oversight              |
| AIGO-C-006 | Data            | Data quality                 |
| AIGO-C-007 | Fairness        | Fairness assessment          |
| AIGO-C-008 | Privacy         | Privacy protection           |
| AIGO-C-009 | Security        | Access control               |
| AIGO-C-010 | Transparency    | AI system transparency       |
| AIGO-C-011 | Monitoring      | AI system monitoring         |
| AIGO-C-012 | Incident        | AI incident management       |
| AIGO-C-013 | Change          | AI change management         |
| AIGO-C-014 | Approval        | AI system approval           |
| AIGO-C-015 | Assurance       | AI assurance                 |

***

# 9. Control Objective

Each control must have a clearly defined objective.

For example:

**Control ID:** `AIGO-C-005`

**Control:** Human Oversight

**Objective:** Ensure that AI-generated recommendations are subject to meaningful human review and that authorized personnel can challenge or override AI outputs.

***

# 10. Control Owner

Each control must have an accountable owner.

For this example:

| Control Area    | Owner                       |
| --------------- | --------------------------- |
| Governance      | AI Governance Lead          |
| Registration    | AI System Owner             |
| Classification  | AI Risk Manager             |
| Risk            | Enterprise Risk Manager     |
| Human Oversight | HR Process Owner            |
| Data            | Data Owner                  |
| Fairness        | Model Owner                 |
| Privacy         | Privacy Officer             |
| Security        | CISO / Security Owner       |
| Monitoring      | Model Owner                 |
| Incident        | AI Incident Manager         |
| Change          | AI System Owner             |
| Assurance       | Internal Assurance Function |

***

# 11. Control Design Assessment

Control design answers:

> If implemented and operated as specified, would this control adequately address the intended risk or requirement?

Design assessment considers:

* control objective;
* risk alignment;
* control activity;
* frequency;
* responsibility;
* authority;
* segregation of duties;
* escalation;
* evidence requirements.

***

# 12. Control Implementation Assessment

Implementation assessment answers:

> Has the designed control actually been implemented?

Evidence may include:

* approved procedures;
* system configurations;
* records;
* training;
* access settings;
* workflow configuration;
* monitoring dashboards;
* completed assessments.

***

# 13. Operating Effectiveness Assessment

Operating effectiveness answers:

> Has the control operated as intended over the required period?

This requires evidence of actual operation.

A control may be:

* well designed but not implemented;
* implemented but not operating;
* operating but ineffective;
* effective and sustainable.

***

# 14. Evidence Assessment

Control evidence should demonstrate:

1. what was performed;
2. who performed it;
3. when it was performed;
4. what result was obtained;
5. whether exceptions occurred;
6. how exceptions were handled.

***

# 15. Control Assessment Model

```text id="f9xjvq" theme={null}
Control Objective
       ↓
Control Design
       ↓
Implementation
       ↓
Operation
       ↓
Evidence
       ↓
Effectiveness
       ↓
Risk Reduction
```

***

# 16. Control Rating Scale

ExampleCorp uses the following rating scale.

| Rating              | Meaning                                                               |
| ------------------- | --------------------------------------------------------------------- |
| Effective           | Control is adequately designed, implemented, operating, and evidenced |
| Partially Effective | Control works but has material limitations                            |
| Ineffective         | Control does not adequately address the objective                     |
| Not Implemented     | Control has not been implemented                                      |
| Not Tested          | Insufficient evidence exists to determine effectiveness               |

***

# 17. Assessment Rating Dimensions

The assessment evaluates four dimensions.

| Dimension      | Question                               |
| -------------- | -------------------------------------- |
| Design         | Is the control appropriately designed? |
| Implementation | Has the control been implemented?      |
| Operation      | Does the control operate as intended?  |
| Evidence       | Is sufficient evidence available?      |

***

# 18. Control AIGO-C-001 — AI Governance Accountability

## 18.1 Control Objective

Ensure that accountability for AI governance is clearly established.

## 18.2 Control Activity

ExampleCorp maintains:

* an AI governance authority;
* defined AI governance roles;
* assigned system owners;
* assigned risk owners;
* escalation responsibilities.

## 18.3 Assessment

| Dimension      | Result    |
| -------------- | --------- |
| Design         | Effective |
| Implementation | Effective |
| Operation      | Effective |
| Evidence       | Strong    |

**Overall Rating:** Effective

***

# 19. Control AIGO-C-002 — AI System Registration

## 19.1 Control Objective

Ensure that AI systems are formally identified and registered before deployment.

## 19.2 Evidence

* AI system register;
* system identifier;
* system owner;
* intended purpose;
* lifecycle status;
* classification.

## 19.3 Assessment

| Dimension      | Result    |
| -------------- | --------- |
| Design         | Effective |
| Implementation | Effective |
| Operation      | Effective |
| Evidence       | Strong    |

**Overall Rating:** Effective

***

# 20. Control AIGO-C-003 — AI System Classification

## 20.1 Control Objective

Ensure that AI systems receive an appropriate governance classification.

## 20.2 Evidence

* classification assessment;
* classification rationale;
* approval record;
* review date.

## 20.3 Assessment

| Dimension      | Result    |
| -------------- | --------- |
| Design         | Effective |
| Implementation | Effective |
| Operation      | Effective |
| Evidence       | Strong    |

**Overall Rating:** Effective

***

# 21. Control AIGO-C-004 — AI Risk Assessment

## 21.1 Control Objective

Ensure that AI-related risks are identified, analyzed, evaluated, treated, and monitored.

## 21.2 Evidence

* risk assessment;
* risk register;
* treatment plan;
* residual-risk evaluation;
* risk acceptance.

## 21.3 Assessment

| Dimension      | Result    |
| -------------- | --------- |
| Design         | Effective |
| Implementation | Effective |
| Operation      | Partial   |
| Evidence       | Moderate  |

**Overall Rating:** Partially Effective

***

# 22. Control Deficiency — Risk Assessment

The risk assessment process is implemented, but quarterly reassessment has not yet been completed for the current operating period.

### Finding

**Finding ID:** `CA-001`

**Severity:** Medium

**Control:** `AIGO-C-004`

**Issue:** Required periodic reassessment has not yet been completed.

**Risk:** Changes in system context may not be reflected in the current risk assessment.

***

# 23. Corrective Action — CA-001

**Action:** Complete the outstanding quarterly risk reassessment.

**Owner:** Enterprise Risk Manager

**Due Date:** To be assigned

**Priority:** High

**Evidence Required:** Approved updated risk assessment.

***

# 24. Control AIGO-C-005 — Human Oversight

## 24.1 Control Objective

Ensure meaningful human oversight over AI-supported recruitment decisions.

## 24.2 Control Activity

Recruitment personnel must:

* review recommendations;
* challenge outputs where appropriate;
* override outputs where necessary;
* make final decisions;
* document material exceptions.

## 24.3 Assessment

| Dimension      | Result    |
| -------------- | --------- |
| Design         | Effective |
| Implementation | Effective |
| Operation      | Effective |
| Evidence       | Strong    |

**Overall Rating:** Effective

***

# 25. Control AIGO-C-006 — Data Quality

## 25.1 Control Objective

Ensure that data used by the AI system is sufficiently accurate, relevant, complete, and appropriate for its intended purpose.

## 25.2 Assessment

| Dimension      | Result    |
| -------------- | --------- |
| Design         | Effective |
| Implementation | Effective |
| Operation      | Partial   |
| Evidence       | Moderate  |

**Overall Rating:** Partially Effective

***

# 26. Control Deficiency — Data Quality

**Finding ID:** `CA-002`

**Issue:** A subset of historical candidate records has incomplete education information.

**Potential Impact:** Model recommendations may be affected for candidates with incomplete records.

**Severity:** Medium

***

# 27. Corrective Action — CA-002

Actions:

* identify incomplete records;
* determine whether they influence model output;
* establish data-quality thresholds;
* exclude unsuitable records;
* document remediation.

**Owner:** Data Owner

***

# 28. Control AIGO-C-007 — Fairness Assessment

## 28.1 Control Objective

Identify and monitor potential unfair or discriminatory outcomes.

## 28.2 Control Activity

ExampleCorp performs:

* pre-deployment fairness testing;
* subgroup analysis;
* outcome monitoring;
* periodic reassessment;
* escalation of material findings.

## 28.3 Assessment

| Dimension      | Result    |
| -------------- | --------- |
| Design         | Effective |
| Implementation | Effective |
| Operation      | Partial   |
| Evidence       | Moderate  |

**Overall Rating:** Partially Effective

***

# 29. Control Deficiency — Fairness Monitoring

**Finding ID:** `CA-003`

The fairness assessment exists, but the defined quarterly monitoring process has not yet completed its first full operating cycle.

**Severity:** High

**Risk:** Material changes in outcome disparity may not be detected promptly.

***

# 30. Corrective Action — CA-003

Actions:

* complete the first monitoring cycle;
* validate monitoring thresholds;
* establish escalation criteria;
* report material findings to AI Governance Committee.

**Owner:** Model Owner

**Priority:** Critical

***

# 31. Control AIGO-C-008 — Privacy Protection

## 31.1 Control Objective

Ensure candidate information is processed appropriately and protected against unauthorized use or disclosure.

## 31.2 Controls

* data minimization;
* access restriction;
* retention management;
* privacy assessment;
* secure processing;
* incident management.

## 31.3 Assessment

| Dimension      | Result    |
| -------------- | --------- |
| Design         | Effective |
| Implementation | Effective |
| Operation      | Effective |
| Evidence       | Strong    |

**Overall Rating:** Effective

***

# 32. Control AIGO-C-009 — Access Control

## 32.1 Control Objective

Prevent unauthorized access to AI systems and associated candidate information.

## 32.2 Evidence

* access-control configuration;
* user-role records;
* privileged access review;
* audit logs;
* access review records.

## 32.3 Assessment

| Dimension      | Result    |
| -------------- | --------- |
| Design         | Effective |
| Implementation | Effective |
| Operation      | Effective |
| Evidence       | Strong    |

**Overall Rating:** Effective

***

# 33. Control AIGO-C-010 — Transparency

## 33.1 Control Objective

Ensure that relevant users and stakeholders receive appropriate information about the AI system and its role.

## 33.2 Assessment

| Dimension      | Result    |
| -------------- | --------- |
| Design         | Effective |
| Implementation | Effective |
| Operation      | Effective |
| Evidence       | Strong    |

**Overall Rating:** Effective

***

# 34. Control AIGO-C-011 — AI Monitoring

## 34.1 Control Objective

Detect material changes in AI system performance, risk, control effectiveness, and operating conditions.

## 34.2 Monitoring Activities

ExampleCorp monitors:

* performance;
* error rates;
* fairness indicators;
* override rates;
* incidents;
* model drift;
* complaints;
* control failures.

## 34.3 Assessment

| Dimension      | Result    |
| -------------- | --------- |
| Design         | Effective |
| Implementation | Effective |
| Operation      | Partial   |
| Evidence       | Moderate  |

**Overall Rating:** Partially Effective

***

# 35. Control Deficiency — Monitoring

**Finding ID:** `CA-004`

The monitoring framework has been implemented, but some indicators do not yet have approved escalation thresholds.

**Severity:** Medium

***

# 36. Corrective Action — CA-004

Actions:

* define thresholds;
* approve thresholds;
* document escalation rules;
* test alert mechanisms.

**Owner:** Model Owner

***

# 37. Control AIGO-C-012 — AI Incident Management

## 37.1 Control Objective

Ensure AI-related incidents are identified, reported, assessed, escalated, investigated, and resolved.

## 37.2 Assessment

| Dimension      | Result     |
| -------------- | ---------- |
| Design         | Effective  |
| Implementation | Effective  |
| Operation      | Not Tested |
| Evidence       | Limited    |

**Overall Rating:** Not Tested

***

# 38. Control Deficiency — Incident Testing

No material AI incident has occurred during the assessment period.

The absence of incidents does not demonstrate that the incident-management control is effective.

A tabletop exercise is therefore required.

***

# 39. Corrective Action — CA-005

**Action:** Conduct an AI incident-management tabletop exercise.

**Owner:** AI Incident Manager

**Evidence:** Exercise record and lessons-learned report.

**Priority:** Medium

***

# 40. Control AIGO-C-013 — Change Management

## 40.1 Control Objective

Ensure material changes to the AI system are identified, assessed, approved, tested, and documented before implementation.

## 40.2 Assessment

| Dimension      | Result    |
| -------------- | --------- |
| Design         | Effective |
| Implementation | Effective |
| Operation      | Effective |
| Evidence       | Strong    |

**Overall Rating:** Effective

***

# 41. Control AIGO-C-014 — AI System Approval

## 41.1 Control Objective

Ensure AI systems receive required governance approval before deployment or material changes.

## 41.2 Evidence

* approval record;
* risk assessment;
* classification;
* control assessment;
* readiness review.

## 41.3 Assessment

| Dimension      | Result    |
| -------------- | --------- |
| Design         | Effective |
| Implementation | Effective |
| Operation      | Effective |
| Evidence       | Strong    |

**Overall Rating:** Effective

***

# 42. Control AIGO-C-015 — AI Assurance

## 42.1 Control Objective

Provide independent or appropriately objective evaluation of AI governance controls and system operation.

## 42.2 Assessment

| Dimension      | Result     |
| -------------- | ---------- |
| Design         | Effective  |
| Implementation | Partial    |
| Operation      | Not Tested |
| Evidence       | Limited    |

**Overall Rating:** Partially Effective

***

# 43. Control Assessment Summary

| Control               | Rating              | Finding   |
| --------------------- | ------------------- | --------- |
| C-001 Governance      | Effective           | None      |
| C-002 Registration    | Effective           | None      |
| C-003 Classification  | Effective           | None      |
| C-004 Risk Assessment | Partially Effective | CA-001    |
| C-005 Human Oversight | Effective           | None      |
| C-006 Data Quality    | Partially Effective | CA-002    |
| C-007 Fairness        | Partially Effective | CA-003    |
| C-008 Privacy         | Effective           | None      |
| C-009 Security        | Effective           | None      |
| C-010 Transparency    | Effective           | None      |
| C-011 Monitoring      | Partially Effective | CA-004    |
| C-012 Incident        | Not Tested          | CA-005    |
| C-013 Change          | Effective           | None      |
| C-014 Approval        | Effective           | None      |
| C-015 Assurance       | Partially Effective | Follow-up |

***

# 44. Overall Control Assessment

The overall control environment is assessed as:

**Partially Effective**

The majority of controls are appropriately designed and implemented.

However, several controls require additional operating evidence and corrective action before the system can be considered fully controlled.

***

# 45. Control Effectiveness Distribution

| Rating              | Number of Controls |
| ------------------- | -----------------: |
| Effective           |                  9 |
| Partially Effective |                  5 |
| Ineffective         |                  0 |
| Not Implemented     |                  0 |
| Not Tested          |                  1 |

***

# 46. Deficiency Classification

Control deficiencies are classified according to their potential effect.

| Severity | Description                                                  |
| -------- | ------------------------------------------------------------ |
| Low      | Limited control weakness                                     |
| Medium   | Material weakness requiring corrective action                |
| High     | Significant weakness requiring enhanced management attention |
| Critical | Control failure that may require immediate escalation        |

***

# 47. Findings Register

| ID     | Control | Severity | Issue                            | Status |
| ------ | ------- | -------- | -------------------------------- | ------ |
| CA-001 | C-004   | Medium   | Risk reassessment overdue        | Open   |
| CA-002 | C-006   | Medium   | Data-quality issue               | Open   |
| CA-003 | C-007   | High     | Fairness monitoring incomplete   | Open   |
| CA-004 | C-011   | Medium   | Monitoring thresholds incomplete | Open   |
| CA-005 | C-012   | Medium   | Incident control not tested      | Open   |

***

# 48. Corrective Action Lifecycle

```text id="q4x5tc" theme={null}
Finding
   ↓
Root Cause
   ↓
Corrective Action
   ↓
Action Owner
   ↓
Due Date
   ↓
Implementation
   ↓
Evidence
   ↓
Effectiveness Review
   ↓
Retest
   ↓
Close / Escalate
```

***

# 49. Root Cause Analysis

Corrective action should address the underlying cause rather than merely correcting the visible symptom.

Example:

**Symptom:** Fairness monitoring was not completed.

**Possible root cause:** Monitoring responsibility and recurring execution workflow were not sufficiently operationalized.

**Corrective action:** Establish automated scheduling, accountable ownership, escalation rules, and completion tracking.

***

# 50. Corrective Action Prioritization

| Finding | Severity | Priority |
| ------- | -------- | -------- |
| CA-003  | High     | Critical |
| CA-001  | Medium   | High     |
| CA-002  | Medium   | High     |
| CA-004  | Medium   | High     |
| CA-005  | Medium   | Medium   |

***

# 51. Corrective Action Tracking

| ID     | Owner            | Due | Evidence                   | Status |
| ------ | ---------------- | --- | -------------------------- | ------ |
| CA-001 | Risk Manager     | TBD | Updated risk assessment    | Open   |
| CA-002 | Data Owner       | TBD | Data remediation report    | Open   |
| CA-003 | Model Owner      | TBD | Fairness monitoring report | Open   |
| CA-004 | Model Owner      | TBD | Approved thresholds        | Open   |
| CA-005 | Incident Manager | TBD | Exercise report            | Open   |

***

# 52. Evidence Quality

Control evidence is assessed for:

* authenticity;
* completeness;
* relevance;
* accuracy;
* timeliness;
* traceability;
* integrity.

***

# 53. Evidence Quality Scale

| Rating   | Description                              |
| -------- | ---------------------------------------- |
| Strong   | Complete, reliable, timely and traceable |
| Adequate | Sufficient for assessment                |
| Moderate | Some limitations exist                   |
| Weak     | Significant limitations                  |
| Missing  | Evidence unavailable                     |

***

# 54. Evidence Assessment Example

For `AIGO-C-007`:

**Control:** Fairness Assessment

**Evidence:** Fairness test report.

Assessment:

* authentic: Yes;
* relevant: Yes;
* complete: Partial;
* current: Yes;
* traceable: Yes.

**Evidence Rating:** Moderate.

The moderate rating contributes to the overall partially effective control assessment.

***

# 55. Control Evidence Chain

```text id="6l9z1f" theme={null}
Control
   ↓
Control Activity
   ↓
Execution
   ↓
Record
   ↓
Evidence
   ↓
Evidence Review
   ↓
Effectiveness Conclusion
```

***

# 56. Control-to-Risk Relationship

Controls must be connected to risks.

| Risk                      | Primary Controls    |
| ------------------------- | ------------------- |
| Biased ranking            | C-006, C-007, C-011 |
| Discrimination            | C-005, C-007, C-011 |
| Privacy violation         | C-008, C-009        |
| Unauthorized access       | C-009               |
| Automation bias           | C-005, C-010        |
| Model drift               | C-011, C-013        |
| Supplier change           | C-013               |
| Inaccurate recommendation | C-006, C-011        |

***

# 57. Control-to-Lifecycle Relationship

```text id="5f7i8m" theme={null}
Govern
   ↓
Identify
   ↓
Classify
   ↓
Assess
   ↓
Treat
   ↓
Approve
   ↓
Deploy
   ↓
Operate
   ↓
Monitor
   ↓
Assure
   ↓
Improve
   ↓
Change / Continue / Suspend / Retire
```

Controls must remain applicable throughout the relevant lifecycle stages.

***

# 58. Control Assessment and Residual Risk

Control effectiveness directly informs residual risk.

```text id="y9k0a1" theme={null}
Inherent Risk
      ↓
Controls
      ↓
Control Effectiveness
      ↓
Residual Risk
      ↓
Risk Treatment
```

Weak controls may result in higher residual risk.

***

# 59. Example Residual Risk Update

Before control assessment:

**R-001 Biased Candidate Ranking**

Inherent Risk: 20 — Critical

After initial controls:

Residual Risk: 10 — High

Following the discovery that fairness monitoring is incomplete, the organization determines that the residual risk remains **High** until corrective action is completed.

***

# 60. Control Assessment Decision

The assessment determines:

**Control Environment:** Partially Effective

**Deployment Status:** Conditional

**Conditions:**

* close high-severity fairness finding;
* complete outstanding risk reassessment;
* resolve data-quality issue;
* define monitoring thresholds;
* complete incident-management testing;
* establish assurance evidence.

***

# 61. Conditional Approval

The AI system may proceed only if the AI Governance Committee accepts the identified residual risk and formally records the conditions.

No control deficiency may be silently ignored.

***

# 62. Management Escalation

The following conditions require escalation:

* critical control failure;
* high residual risk caused by control failure;
* repeated overdue corrective actions;
* evidence of material harm;
* inability to operate required human oversight;
* failure of mandatory controls;
* significant unapproved system change.

***

# 63. Control Assessment Reporting

The assessment report should communicate:

* controls assessed;
* assessment methodology;
* effectiveness ratings;
* findings;
* risk implications;
* corrective actions;
* overdue actions;
* residual risk;
* management decisions.

***

# 64. Example Management Report

**Assessment:** AI Governance Control Assessment

**System:** `AI-HR-001`

**Overall Rating:** Partially Effective

**High Finding:** Fairness monitoring incomplete.

**Medium Findings:** Four.

**Critical Findings:** None.

**Residual Risk:** High for selected risk categories.

**Recommendation:** Conditional continuation subject to corrective action.

***

# 65. Retesting

Corrective actions must be retested where necessary.

Retesting verifies:

* action was implemented;
* root cause was addressed;
* control now operates;
* evidence is available;
* risk has been reduced.

***

# 66. Corrective Action Effectiveness

A corrective action is not considered complete merely because an activity has been performed.

Example:

**Action:** Conduct fairness monitoring.

The assessor must determine whether:

* monitoring was actually performed;
* results were reviewed;
* thresholds operated;
* exceptions were identified;
* escalation occurred where required;
* the underlying control deficiency was resolved.

***

# 67. Finding Closure Criteria

A finding may be closed when:

1. corrective action is implemented;
2. required evidence exists;
3. effectiveness is demonstrated;
4. residual risk is acceptable;
5. responsible authority approves closure.

***

# 68. Example Finding Closure

**Finding:** `CA-003`

**Original Issue:** Fairness monitoring incomplete.

**Corrective Action:** Implement recurring fairness monitoring and escalation.

**Evidence:** Three completed monitoring cycles.

**Result:** No material unexplained disparity identified.

**Control Rating:** Effective.

**Finding Status:** Closed.

***

# 69. Control Assessment Reassessment

Controls must be reassessed when:

* risks change;
* system functionality changes;
* controls change;
* incidents occur;
* monitoring indicates deterioration;
* regulatory requirements change;
* suppliers change;
* assurance identifies weaknesses.

***

# 70. Control Assessment Frequency

ExampleCorp performs:

* pre-deployment assessment;
* annual formal control assessment;
* quarterly monitoring;
* event-triggered reassessment;
* post-incident reassessment;
* material-change reassessment.

Higher-risk controls may require more frequent testing.

***

# 71. Independence

Where practical, control assessment should provide sufficient independence from the person performing the control.

For example:

* control owner performs self-assessment;
* second-line risk function reviews;
* assurance function independently tests selected controls.

***

# 72. Three-Level Assurance Model

```text id="1v2h8c" theme={null}
First Line
Control Owner
     ↓
Second Line
Risk / Compliance
     ↓
Third Line
Independent Assurance
```

Each level provides a different degree of oversight.

***

# 73. Control Assessment Traceability

Every assessment should be traceable to:

* AI system;
* risk;
* control;
* control owner;
* assessment criteria;
* evidence;
* finding;
* corrective action;
* retest;
* final decision.

***

# 74. Example Traceability Record

| Element           | Value               |
| ----------------- | ------------------- |
| AI System         | `AI-HR-001`         |
| Risk              | R-001               |
| Control           | AIGO-C-007          |
| Owner             | Model Owner         |
| Evidence          | Fairness Assessment |
| Finding           | CA-003              |
| Corrective Action | Enhanced monitoring |
| Retest            | Required            |
| Final Rating      | Pending             |

***

# 75. Control Assessment Data Model

```text id="p3f8wz" theme={null}
AI System
    ↓
Risk
    ↓
Control
    ↓
Control Objective
    ↓
Control Owner
    ↓
Assessment
    ↓
Evidence
    ↓
Finding
    ↓
Corrective Action
    ↓
Retest
    ↓
Effectiveness
    ↓
Residual Risk
```

***

# 76. Minimum Control Assessment Record

AIGO implementations should maintain, at minimum:

* control ID;
* control name;
* control objective;
* risk relationship;
* lifecycle relationship;
* control owner;
* assessment date;
* assessor;
* design assessment;
* implementation assessment;
* operating assessment;
* evidence assessment;
* overall rating;
* findings;
* corrective actions;
* due dates;
* retest;
* closure decision.

***

# 77. Control Assessment Checklist

* [ ] Applicable control identified
* [ ] Control objective documented
* [ ] Control owner assigned
* [ ] Risk relationship documented
* [ ] Control design assessed
* [ ] Implementation verified
* [ ] Operation assessed
* [ ] Evidence reviewed
* [ ] Effectiveness rating assigned
* [ ] Findings documented
* [ ] Corrective actions assigned
* [ ] Residual risk evaluated
* [ ] Retesting completed where required
* [ ] Closure approved

***

# 78. Relationship to AIGO Procedures

This example should be implemented through the applicable AIGO procedures, particularly:

* AI Governance Procedure;
* AI Control Assessment Procedure;
* AI Risk Assessment Procedure;
* AI Approval Procedure;
* AI Monitoring Procedure;
* AI Assurance Procedure;
* AI Incident Management Procedure;
* AI Change Management Procedure;
* Continuous Improvement Procedure.

***

# 79. Relationship to AIGO Framework Controls

The assessment demonstrates how AIGO controls can be:

* assigned;
* implemented;
* tested;
* evidenced;
* rated;
* remediated;
* reassessed.

The control assessment therefore forms the operational bridge between the AIGO control framework and actual AI system governance.

***

# 80. Relationship to ISO/IEC 42001

Control assessment can support an AI management system aligned with ISO/IEC 42001 by providing evidence that relevant governance and operational controls are implemented and evaluated.

The organization should separately determine applicable requirements and conformity obligations.

***

# 81. Relationship to NIST AI RMF

The assessment also supports activities associated with NIST AI RMF:

| Function | Control Assessment Activity            |
| -------- | -------------------------------------- |
| GOVERN   | Accountability and governance controls |
| MAP      | Context and risk relationships         |
| MEASURE  | Testing, evidence and effectiveness    |
| MANAGE   | Corrective action and risk treatment   |

***

# 82. Example Final Assessment

**AI System:** Candidate Assessment Assistant

**AI System ID:** `AI-HR-001`

**Classification:** Class 3 — Enhanced Governance

**Assessment:** Control Assessment

**Overall Control Rating:** Partially Effective

**High Findings:** 1

**Medium Findings:** 4

**Critical Findings:** 0

**Deployment Decision:** Conditional

**Primary Condition:** Complete fairness monitoring corrective action.

***

# 83. Key Lessons

### 83.1 A Control Is Not Effective Simply Because It Exists

Documentation alone does not demonstrate operating effectiveness.

### 83.2 Evidence Is Essential

Control conclusions must be supported by reliable evidence.

### 83.3 Control Weaknesses Affect Risk

A weak control can increase residual risk.

### 83.4 Corrective Action Must Address Root Cause

Closing a task does not necessarily close the underlying deficiency.

### 83.5 Retesting Matters

Corrective actions should be tested to confirm that the control actually improved.

### 83.6 Control Assessment Is Continuous

Controls should be reassessed when risks, systems, processes, or operating environments change.

***

# 84. AIGO Control Assessment Model

The complete model can be summarized as:

```text id="k3h7nq" theme={null}
Risk
  ↓
Control Objective
  ↓
Control
  ↓
Owner
  ↓
Design
  ↓
Implementation
  ↓
Operation
  ↓
Evidence
  ↓
Effectiveness
  ↓
Finding
  ↓
Corrective Action
  ↓
Retest
  ↓
Closure / Escalation
  ↓
Residual Risk
```

***

# 85. Document Status

**Document:** AIGO — Control Assessment Example

**Version:** 0.1

**Status:** Draft

**Working Name:** AIGO

**Full Name:** AI Governance Operating Framework

**Document Identifier:** `AIGO-EXAMPLE-005`

**Document Type:** Implementation Example

**Example Type:** AI Control Assessment

This document provides an illustrative example of how AI governance controls can be assessed, evidenced, remediated, retested, and reported within the AIGO AI Governance Operating Framework.

***

# 86. End of Example Document

**AIGO — Control Assessment Example**

**Document ID:** `AIGO-EXAMPLE-005`

**Version:** 0.1

**Status:** Draft

**End of Document**