AIGO — Management Review Schema Documentation

1. Document Purpose

This document describes the machine-readable AIGO Management Review Schema. The schema provides the structured representation of management reviews of AI governance arrangements under the AIGO AI Governance Operating Framework. It is intended to support:

management review planning;
review scope and objectives;
review participants and authority;
review inputs;
AI portfolio review;
governance performance;
risk performance;
control performance;
monitoring performance;
incident trends;
change activity;
classification performance;
approval performance;
human oversight;
security and privacy;
fairness and impact;
assurance results;
third-party performance;
regulatory developments;
governance exceptions;
resources and competence;
documentation and evidence;
stakeholder feedback;
governance maturity;
continual improvement;
management decisions;
governance changes;
action plans;
follow-up;
conclusions;
approval;
closure; and
review scheduling.

The JSON schema defines structural requirements. This documentation explains the intended meaning, governance context, validation expectations, and traceability model for management review records.

2. Schema Information

Field	Value
Schema	AIGO Management Review Schema
Schema Identifier	`https://aigo.example/schema/management-review/v0.1`
Schema Version	`0.1`
JSON Schema Dialect	JSON Schema Draft 2020-12
Object Type	`MANAGEMENT_REVIEW`
File	`11-AIGO-Management-Review-Schema-v0.1.json`
Status	Draft
Framework	AIGO — AI Governance Operating Framework

3. Scope

The Management Review Schema applies to formal reviews of the suitability, adequacy, effectiveness, performance, and continuing improvement of AI governance arrangements. A management review may cover:

the organization’s AI portfolio;
governance arrangements;
strategic alignment;
risk profile;
control performance;
monitoring;
incidents;
changes;
assurance;
approvals;
human oversight;
security;
privacy;
fairness;
suppliers;
regulatory developments;
resources;
competence;
evidence;
governance maturity; and
continual improvement.

The review may occur periodically or in response to a significant trigger.

4. Object Model

The primary object represented by this schema is:

MANAGEMENT_REVIEW

A Management Review record represents a formal management-level evaluation of AIGO governance performance and resulting decisions. The Management Review record should remain distinct from:

individual risk records;
control assessments;
monitoring records;
incident records;
assurance engagements;
improvement records;
approval records; and
operational governance records.

The management review aggregates and evaluates information from those records rather than replacing them.

5. Core Identity

A Management Review record should contain stable identity information. Key fields include:

id;
objectType;
objectVersion;
schemaVersion;
review type;
review scope;
review objectives;
review inputs;
review owner;
review authority; and
status.

Example:

{
  "id": "MGMTREV-001",
  "objectType": "MANAGEMENT_REVIEW",
  "objectVersion": "1.0",
  "schemaVersion": "0.1"
}

The review identifier should remain stable throughout the review lifecycle. A materially separate management review should normally have a distinct identifier.

6. Purpose of Management Review

Management review exists to provide management with a structured opportunity to evaluate whether AI governance remains:

suitable;
adequate;
effective;
aligned with organizational objectives;
proportionate to AI risks; and
capable of continual improvement.

The review should convert governance information into management-level decisions.

7. Review Types

A management review may be:

PERIODIC
TRIGGERED
POST_INCIDENT
POST_ASSURANCE
POST_MATERIAL_CHANGE
STRATEGIC
ANNUAL
OTHER

The exact enumeration defined in the JSON schema is authoritative. A triggered review may be initiated by:

serious incident;
material change;
regulatory development;
significant assurance finding;
major change in AI portfolio;
risk exceeding tolerance;
governance failure; or
another defined governance trigger.

8. Review Owner

The review should have an accountable owner responsible for coordinating:

scope;
agenda;
participants;
inputs;
analysis;
decisions;
actions;
records;
follow-up; and
closure.

The review owner may be different from the chair or approving authority.

9. Review Chair

The chair should have sufficient authority to:

conduct the review;
challenge information;
request clarification;
facilitate decisions;
identify escalation;
confirm conclusions; and
ensure actions are assigned.

The chair’s authority should be defined through the governance structure.

10. Review Authority

The review authority identifies the governance body or management authority responsible for the review. It may include:

executive management;
AI governance committee;
risk committee;
board committee;
business-unit leadership;
delegated governance authority; or
another authorized body.

The authority should have decision rights appropriate to the review scope.

11. Review Scope

The review scope should identify:

organizational units;
business functions;
jurisdictions;
AI systems;
lifecycle stages;
environments;
governance domains;
review period; and
exclusions.

The scope should be sufficiently precise to establish what the management review covers.

12. Review Objectives

Review objectives may include:

assess governance effectiveness;
evaluate AI risk profile;
review control performance;
review incidents;
review monitoring;
review assurance findings;
confirm strategic alignment;
evaluate resource adequacy;
assess regulatory readiness;
review governance maturity;
identify improvement opportunities; and
make governance decisions.

Objectives should be defined before the review where practical.

13. Review Participants

Participants may include:

AI governance owner;
executive management;
AI system owners;
risk owners;
control owners;
security;
privacy;
legal;
compliance;
technical leadership;
business representatives;
assurance representatives; and
other subject-matter experts.

Participation should reflect the scope and significance of the review.

14. Quorum

Where the governing body requires a quorum, the management review record should capture:

quorum requirement;
minimum participants;
actual participants;
whether quorum was achieved; and
rationale for exceptions.

A review performed without required quorum should be identified as such and handled under the applicable governance procedure.

15. Review Period

The record should identify the period being reviewed. For example:

Start: 2026-01-01
End:   2026-06-30

Different inputs may cover different periods. Where relevant, the review should identify the source period for each major metric.

16. Review Inputs

Management review should be evidence-based. Inputs may include:

governance performance;
AI inventory;
risk profile;
control assessments;
monitoring;
incidents;
changes;
assurance;
stakeholder feedback;
regulatory developments;
accepted risks;
exceptions;
resources;
competence;
maturity assessments;
improvement activity; and
previous management review actions.

The Review Inputs structure should preserve references to source records and evidence.

17. AI Portfolio Review

Management review may evaluate the AI portfolio as a whole. Portfolio information may include:

total AI systems;
new systems;
retired systems;
restricted systems;
suspended systems;
classification distribution;
risk distribution;
system trends; and
significant portfolio changes.

Portfolio-level review can identify concentration or systemic issues.

18. Strategic Alignment

Management should assess whether AI governance remains aligned with organizational strategy. Strategic alignment may consider:

organizational objectives;
AI strategy;
business priorities;
risk appetite;
stakeholder expectations;
technology strategy;
regulatory strategy; and
sustainability objectives where applicable.

Misalignment may require governance changes or strategic decisions.

19. Organizational Context

Management review should consider significant changes in organizational context. Examples include:

organizational restructuring;
new business activities;
new jurisdictions;
acquisitions;
divestments;
changes in AI strategy;
technology changes;
supplier changes;
stakeholder changes;
risk-environment changes; and
regulatory developments.

The review should determine whether such changes affect AI governance.

20. Governance Performance

Management review should consider whether governance objectives are being achieved. Performance information may include:

governance metrics;
decision timeliness;
governance coverage;
approval performance;
control effectiveness;
risk treatment;
incident trends;
assurance findings; and
improvement completion.

Performance should be assessed against defined objectives or targets where available.

21. Risk Performance

Management review should evaluate the current AI risk profile. This may include:

overall risk level;
distribution by risk category;
highest risks;
risks above tolerance;
emerging risks;
systemic risks;
accepted risks;
overdue treatments; and
changes since the previous review.

The review should determine whether risk appetite and tolerance remain appropriate.

22. Risk Acceptance Review

Management may review accepted risks. The review may identify:

current accepted risks;
expiring risk acceptances;
changed residual risk;
conditions;
acceptance authority;
monitoring requirements; and
whether acceptance should continue.

An existing risk acceptance record remains authoritative for the formal acceptance decision. Management review may recommend continuation, modification, escalation, or revocation.

23. Control Performance

Management review should consider whether key controls are:

designed appropriately;
implemented;
operating effectively;
supported by evidence;
monitored;
independently assessed; and
appropriately remediated when deficient.

Critical control failures should receive management attention.

24. Monitoring Performance

Management should review monitoring results. This may include:

indicator performance;
threshold breaches;
monitoring coverage;
significant deviations;
enhanced monitoring;
monitoring gaps;
false alerts;
monitoring failures; and
monitoring effectiveness.

The review should determine whether monitoring remains fit for purpose.

25. Incident Performance

Management review should examine incident activity. Information may include:

incidents by severity;
open and closed incidents;
significant incidents;
incident trends;
repeat incidents;
root causes;
control failures;
lessons learned; and
outstanding remediation.

Systemic incident patterns should result in appropriate risk, control, assurance, or improvement decisions.

26. Change Performance

The review should consider AI-related change activity. This may include:

number of changes;
material changes;
emergency changes;
failed changes;
rolled-back changes;
change-related incidents;
overdue changes; and
post-change issues.

Repeated change failures may indicate a governance or capability weakness.

27. Classification Performance

Management may review whether AI system classifications remain appropriate. Indicators may include:

number of reclassifications;
classification disputes;
classification-related findings;
changes in risk or intended purpose; and
regulatory developments.

Significant classification changes may require governance or resource decisions.

28. Approval Performance

Management review may consider:

approvals completed;
approval delays;
conditional approvals;
rejected decisions;
deferred decisions;
overdue approval conditions;
emergency approvals; and
revoked or expired approvals.

Repeated conditional or emergency approvals may indicate weaknesses in planning or governance.

29. Human Oversight Performance

Management should consider whether human oversight remains effective. Review may include:

oversight indicators;
review completion;
intervention rates;
override rates;
escalation;
competence;
workload;
automation bias; and
oversight-related findings or incidents.

Where human oversight is inadequate, management may require changes to controls, staffing, system design, or operating procedures.

30. Security and Privacy Performance

Management review should consider significant:

security events;
privacy events;
vulnerability trends;
unauthorized access;
data incidents;
privacy findings;
control weaknesses; and
outstanding remediation.

Material security or privacy concerns may require escalation to specialized governance bodies.

31. Fairness and Impact Performance

Where fairness or impact is relevant, management may review:

fairness indicators;
impact assessments;
affected-person feedback;
complaints;
differential outcomes;
mitigation effectiveness; and
unresolved fairness findings.

Management should consider whether observed impacts are consistent with organizational values and applicable requirements.

32. Assurance Performance

Management review should consider assurance activity and findings. This may include:

assurance completed;
outstanding findings;
repeat findings;
high-severity findings;
overdue remediation;
assurance coverage;
independence; and
conclusion trends.

Management may commission additional assurance where confidence is insufficient.

33. Third-Party Performance

Where AI systems depend on external providers, management may review:

supplier risk;
assurance status;
incidents;
changes;
service performance;
contractual issues;
regulatory issues;
concentration risk; and
termination readiness.

Significant supplier concerns may require changes to contracts, controls, monitoring, or sourcing.

34. Regulatory Performance

Management review should consider changes in:

laws;
regulations;
standards;
contractual obligations;
regulatory guidance;
enforcement trends; and
external commitments.

The review should identify governance implications and required actions. External mapping repositories may provide detailed requirement traceability.

35. Governance Exceptions

Management should review open governance exceptions. The review may consider:

exception age;
risk;
compensating controls;
expiry;
repeated exceptions;
exception trends; and
whether the underlying requirement should change.

Expired or inappropriate exceptions should be escalated.

36. Resources and Capability

Management review should assess whether governance has sufficient:

personnel;
competence;
technology;
funding;
specialist expertise;
external support; and
operational capacity.

Resource constraints that materially affect governance effectiveness should be explicitly documented.

37. Competence and Training

Management may review:

required competencies;
training completion;
specialist skills;
role readiness;
competence gaps;
emerging capability requirements; and
training effectiveness.

Material competence gaps may require improvement actions or resource allocation.

38. Documentation and Evidence

Management review should determine whether governance documentation and evidence remain adequate. This may include:

documentation completeness;
evidence quality;
evidence gaps;
record retention;
traceability;
document control; and
access controls.

Material evidence weaknesses may reduce governance assurance and should be addressed.

39. Stakeholder Feedback

Management should consider relevant stakeholder feedback. Potential sources include:

users;
affected persons;
customers;
employees;
suppliers;
regulators;
assurance providers;
complaints;
surveys; and
governance forums.

Feedback should be considered alongside quantitative governance information.

40. Governance Maturity

Management review may consider current governance maturity. The review may identify:

maturity level;
strengths;
weaknesses;
gaps;
target maturity;
capability priorities; and
improvement needs.

Maturity should be treated as a capability indicator rather than a substitute for effective governance.

41. Continual Improvement

Management review is a major source of continual-improvement opportunities. Sources may include:

incidents;
monitoring;
assurance;
audits;
assessments;
stakeholder feedback;
technology change;
regulatory developments;
repeat findings; and
maturity assessments.

Improvement records should be managed separately under the Improvement Schema.

42. Management Analysis

Management should analyze the information rather than merely compile it. Analysis may identify:

strengths;
weaknesses;
emerging issues;
emerging opportunities;
material changes;
systemic patterns;
recurring failures;
governance bottlenecks; and
strategic implications.

The analysis should explain what the information means for the governance system.

43. Management Decisions

The Management Review record may capture decisions such as:

CONTINUE
CONTINUE_WITH_CONDITIONS
IMPROVE
CHANGE
INCREASE_MONITORING
STRENGTHEN_CONTROLS
REASSESS_RISK
RECLASSIFY
RESTRICT
SUSPEND
RETIRE
ALLOCATE_RESOURCES
CHANGE_GOVERNANCE
COMMISSION_ASSURANCE
OTHER

The exact enumeration in the JSON schema is authoritative. Each material decision should identify:

decision;
rationale;
owner;
due date;
evidence; and
status where applicable.

44. Overall Management Decision

The review may produce an overall management conclusion. Possible outcomes include:

CONTINUE
CONTINUE_WITH_CONDITIONS
IMPROVE
CHANGE
RESTRICT
SUSPEND
RETIRE
ESCALATE
OTHER

The overall decision should reflect the totality of the review evidence.

45. Management Review Conclusion

The review may evaluate:

Suitability

Whether the governance arrangement remains appropriate for its intended purpose.

Adequacy

Whether sufficient structures, resources, controls, and processes exist.

Effectiveness

Whether governance is achieving intended outcomes. The conclusion should identify the rationale for each conclusion where practical.

46. Governance Changes

Management review may result in governance changes. Examples include:

policy change;
role change;
authority change;
committee change;
process change;
control change;
risk methodology change;
monitoring change;
assurance change;
lifecycle change;
documentation change; or
resource change.

Governance changes may require separate Change records where applicable.

47. Action Plan

Management review actions should identify:

action;
owner;
priority;
target date;
source;
status;
dependencies; and
completion evidence.

Actions may include:

corrective action;
improvement;
risk treatment;
governance change;
resource allocation;
assurance;
monitoring enhancement; or
policy revision.

48. Action Status

Action statuses may include:

OPEN
IN_PROGRESS
BLOCKED
COMPLETE
OVERDUE
VERIFIED
CLOSED
DEFERRED
CANCELLED

The exact enumeration defined in the schema is authoritative. Actions should not be marked complete without adequate evidence where evidence is required.

49. Follow-Up

Management review should define follow-up where decisions or actions remain open. Follow-up should identify:

owner;
review date;
action references;
verification evidence;
closure criteria; and
status.

Material unresolved actions should be escalated in subsequent management reviews.

50. Management Review Approval

Where the review requires formal approval, the record should identify:

approval requirement;
approving authority;
decision;
date;
conditions; and
supporting evidence.

Approval of a management review does not automatically approve every action contained within it unless the authority explicitly has that decision scope.

51. Management Review Closure

The review may be closed when:

the review was completed;
conclusions were documented;
decisions were issued;
actions were assigned;
required approvals were obtained; and
records were retained.

A review may be closed with follow-up where actions remain open.

52. Reopening a Management Review

A completed review may need to be reopened where:

material new information emerges;
a major decision changes;
significant governance failure occurs;
the original review omitted material information;
assurance identifies a material deficiency; or
an external requirement requires reconsideration.

Reopening should preserve the historical review record.

53. Review Inputs and Evidence

Material management decisions should be traceable to:

source records;
evidence;
metrics;
assessments;
assurance;
incidents;
monitoring;
stakeholder feedback; and
other relevant information.

The review should distinguish source information from management interpretation.

54. Management Review and Risk

Management review should connect governance decisions to risk. For example:

Risk Trend
    ↓
Management Analysis
    ↓
Management Decision
    ↓
Risk Treatment / Acceptance / Escalation

Management review may not directly change a Risk record unless the appropriate procedure is followed.

55. Management Review and Controls

Management may determine that controls should:

continue;
be strengthened;
be redesigned;
be monitored more closely;
undergo assurance;
be replaced; or
be retired.

Such decisions should be implemented through the appropriate control and change processes.

56. Management Review and Monitoring

Management may decide to:

increase monitoring;
change indicators;
revise thresholds;
establish enhanced monitoring;
retire ineffective monitoring; or
establish new monitoring for emerging risks.

Monitoring changes should be recorded under the Monitoring and Change processes where applicable.

57. Management Review and Assurance

Management may commission assurance when:

confidence is insufficient;
repeated findings occur;
governance effectiveness is uncertain;
a high-risk decision is required;
major change is planned; or
a significant incident has occurred.

The resulting assurance activity should be maintained separately under the Assurance Schema.

58. Management Review and Improvement

Management review is a principal source of improvement priorities. The relationship may be:

Review Input
    ↓
Management Analysis
    ↓
Improvement Opportunity
    ↓
Improvement Record
    ↓
Action
    ↓
Verification

The Improvement Schema remains authoritative for improvement execution.

59. Management Review and Retirement

Management review may determine that an AI system should be:

continued;
restricted;
suspended;
replaced; or
retired.

Where retirement is decided, the Retirement Schema and relevant retirement procedure should govern execution.

60. Management Review Reporting

Management review records may support executive and governance reporting. Useful metrics include:

Metric	Purpose
Reviews completed	Governance cadence
Reviews overdue	Management governance
Actions open	Follow-up exposure
Actions overdue	Accountability
Decisions by category	Governance direction
Repeat decisions	Systemic issues
Improvement actions created	Improvement activity
Governance changes	Framework evolution
Resource decisions	Capability investment
Assurance commissioned	Confidence response

61. Review Frequency

Management review frequency should be defined by the governance arrangement. Possible schedules include:

monthly;
quarterly;
semi-annual;
annual; or
event-triggered.

Frequency should consider:

AI portfolio complexity;
risk;
regulatory expectations;
incident history;
governance maturity; and
rate of change.

62. Triggered Reviews

A triggered management review may be required after:

serious incident;
significant regulatory change;
material governance failure;
major AI system change;
substantial portfolio expansion;
material risk exceeding tolerance;
major assurance finding;
significant supplier failure; or
other governance-defined conditions.

Triggered review criteria should be documented.

63. Previous Review Follow-Up

Each management review should consider the status of actions from previous reviews. The review should identify:

completed actions;
overdue actions;
blocked actions;
repeated actions;
ineffective actions; and
actions requiring escalation.

A pattern of repeated overdue actions may indicate a systemic management weakness.

64. Management Review Validation Requirements

A valid Management Review record should satisfy:

Structural Validation

The JSON document must validate against: 11-AIGO-Management-Review-Schema-v0.1.json

Scope Validation

The review scope should be defined.

Objective Validation

Review objectives should be documented.

Input Validation

Material review inputs should be identified.

Authority Validation

The review should be conducted by an authorized management body.

Participant Validation

Required participants or quorum should be addressed.

Evidence Validation

Material conclusions should be supported by relevant evidence and source records.

Decision Validation

Material decisions should identify authority, rationale, owner, and action where required.

Action Validation

Actions should have accountable owners and target dates.

Follow-Up Validation

Required follow-up should be assigned and tracked.

Closure Validation

Closure should satisfy governance requirements.

Traceability Validation

The review should remain traceable to the underlying AI systems, risks, controls, assessments, approvals, monitoring, incidents, changes, assurance, evidence, improvements, and retirement records as applicable.

65. Schema Limitations

JSON Schema cannot independently determine:

whether management considered all relevant information;
whether management conclusions are reasonable;
whether participants have sufficient authority;
whether evidence is sufficient;
whether strategic alignment is adequate;
whether resources are sufficient;
whether governance is effective; or
whether management decisions are appropriate.

These matters require organizational governance, judgment, evidence, and accountability.

66. Relationship to Templates

The Management Review Schema corresponds primarily to: guidance/03-templates/13-AIGO-AI-Management-Review-Template-v0.1.md It may also use information generated by:

AI system templates;
risk assessment;
control assessment;
approval;
monitoring;
incident;
change management;
assurance;
evidence;
improvement; and
retirement records.

The Markdown template provides the human-readable review record. The JSON schema provides the machine-readable structure.

67. Relationship to Procedures

The schema should be used with the AIGO management-review process and applicable governance procedures. The management-review process should define:

review frequency;
inputs;
participants;
authority;
decision rights;
outputs;
action management;
follow-up; and
closure.

Where a dedicated management-review procedure is established, the schema should be used as its machine-readable record structure.

68. Framework Traceability

AIGO Component	Relationship
Governance Domains	Provides the areas reviewed
Governance Roles	Defines review ownership and authority
AI Governance Lifecycle	Provides lifecycle performance context
AI Risk Management	Provides risk profile and trends
AI Governance Controls	Provides control performance
AI Governance Maturity	Provides capability and maturity information
AI System Profiles	Provides AI portfolio information
Implementation Guidance	Defines management-review implementation expectations
Operational Procedures	Provides source processes and records
Templates	Provides human-readable management review
External Mappings	Provides regulatory and standards context

69. Management Review Traceability Model

The recommended traceability chain is:

Governance Inputs
      ↓
Performance / Risk Information
      ↓
Management Analysis
      ↓
Management Conclusion
      ↓
Management Decision
      ↓
Action
      ↓
Implementation
      ↓
Verification
      ↓
Follow-Up
      ↓
Next Management Review

The review should preserve traceability to the underlying records that support material decisions.

70. Example Record

A conceptual Management Review record may look like:

{
  "id": "MGMTREV-001",
  "objectType": "MANAGEMENT_REVIEW",
  "objectVersion": "1.0",
  "schemaVersion": "0.1",
  "status": "CLOSED_WITH_FOLLOW_UP",
  "reviewType": "PERIODIC",
  "reviewTitle": "AI Governance Management Review — H1 2026",
  "reviewOwner": {
    "role": "AI Governance Owner"
  },
  "reviewScope": {
    "description": "Enterprise AI governance arrangements and in-scope AI systems for the first half of 2026."
  },
  "reviewObjectives": [
    "Assess governance effectiveness.",
    "Review the AI risk profile.",
    "Evaluate significant assurance and incident findings.",
    "Determine improvement priorities."
  ],
  "reviewInputs": {
    "riskInputs": [],
    "controlInputs": [],
    "monitoringInputs": [],
    "incidentInputs": [],
    "assuranceInputs": []
  },
  "overallDecision": {
    "decision": "CONTINUE_WITH_CONDITIONS",
    "rationale": "Governance remains suitable and effective subject to completion of identified improvement actions."
  },
  "actionPlan": [
    {
      "actionId": "ACTION-001",
      "action": "Strengthen monitoring for high-risk AI systems.",
      "status": "OPEN"
    }
  ]
}

The actual record must conform to the authoritative JSON schema.

71. Schema Registry Relationship

This schema is registered in: schemas/00-AIGO-Schema-Registry-v0.1.json The registry should maintain:

schema identifier;
object type;
version;
controlled path;
status;
dependencies;
referenced schemas;
owner;
documentation path; and
traceability metadata.

72. Change and Version Management

Changes to the Management Review Schema should be managed through AIGO change management. Potential impacts should be assessed against:

management review processes;
governance committees;
review templates;
risk reporting;
control reporting;
monitoring;
incident reporting;
assurance reporting;
improvement management;
evidence;
executive reporting;
external mappings; and
validation tooling.

Breaking changes should include migration guidance where necessary.

73. Future Extensions

Future versions may support:

board-level review profiles;
automated governance dashboards;
portfolio trend structures;
management decision workflows;
quorum enforcement;
voting or committee decision structures;
integrated KPI and KRI models;
automated follow-up;
governance maturity analytics;
cross-framework management reporting; and
machine-readable strategic objectives.

Extensions should preserve management accountability and source-record traceability.

74. Document Control

Field	Value
Document	AIGO Management Review Schema Documentation
Version	0.1
Status	Draft
Document Identifier	`AIGO-SCHEMA-DOC-011`
Document Type	Schema Documentation
Schema	`11-AIGO-Management-Review-Schema-v0.1.json`
Owner
Technical Reviewer
Governance Reviewer
Approved By
Effective Date
Next Review Date

75. Document Status

Document: AIGO — Management Review Schema Documentation Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-SCHEMA-DOC-011 Document Type: Schema Documentation This document provides the human-readable interpretation, governance context, validation expectations, and traceability guidance for the AIGO Management Review Schema. End of Document

​AIGO — Management Review Schema Documentation

​1. Document Purpose

​2. Schema Information

​3. Scope

​4. Object Model

​5. Core Identity

​6. Purpose of Management Review

​7. Review Types

​8. Review Owner

​9. Review Chair

​10. Review Authority

​11. Review Scope

​12. Review Objectives

​13. Review Participants

​14. Quorum

​15. Review Period

​16. Review Inputs

​17. AI Portfolio Review

​18. Strategic Alignment

​19. Organizational Context

​20. Governance Performance

​21. Risk Performance

​22. Risk Acceptance Review

​23. Control Performance

​24. Monitoring Performance

​25. Incident Performance

​26. Change Performance

​27. Classification Performance

​28. Approval Performance

​29. Human Oversight Performance

​30. Security and Privacy Performance

​31. Fairness and Impact Performance

​32. Assurance Performance

​33. Third-Party Performance

​34. Regulatory Performance

​35. Governance Exceptions

​36. Resources and Capability

​37. Competence and Training

​38. Documentation and Evidence

​39. Stakeholder Feedback

​40. Governance Maturity

​41. Continual Improvement

​42. Management Analysis

​43. Management Decisions

​44. Overall Management Decision

​45. Management Review Conclusion

​Suitability

​Adequacy

​Effectiveness

​46. Governance Changes

​47. Action Plan

​48. Action Status

​49. Follow-Up

​50. Management Review Approval

​51. Management Review Closure

​52. Reopening a Management Review

​53. Review Inputs and Evidence

​54. Management Review and Risk

​55. Management Review and Controls

​56. Management Review and Monitoring

​57. Management Review and Assurance

​58. Management Review and Improvement

​59. Management Review and Retirement

​60. Management Review Reporting

​61. Review Frequency

​62. Triggered Reviews

​63. Previous Review Follow-Up

​64. Management Review Validation Requirements

​Structural Validation

​Scope Validation

​Objective Validation

​Input Validation

​Authority Validation

​Participant Validation

​Evidence Validation

​Decision Validation

​Action Validation

​Follow-Up Validation

​Closure Validation

​Traceability Validation