Govern

Objective Create rules, accountability and controls proportional to the context.

A policy does not demonstrate control. Control exists when it has an owner, evidence and a defined review.

Criteria vary by area, and when something goes wrong it is unclear who decides. AI systems already in use have no approved policy, inventory, risk classification or evidence to answer an audit, a funder or an oversight body.

• What controls and owners do we need?
• What evidence must we produce, and who is accountable?
• Which controls are proportional to our context?

• We already use AI with no policy, inventory or evidence to answer an oversight review.
• We have to answer to an audit, a funder or an oversight body.

• Builds the governance model the organisation can sustain: policy, inventory, risk classification, roles and evidence.
• Selects controls proportional to the context.
• Drafts the policy and the responsibility matrix for approval.
• Defines the evidence per control and the review cadence.

• Leadership, which approves the policy and the decision body.
• The areas that take on the defined roles: risk, legal or compliance, technology and data.

The organisation approves the policy and takes on the defined roles. AGORA accompanies implementation and preparation for external reviews.

Defined by scope, based on what the assessment recommends.

• An approved policy and a constituted decision body exist.
• Every control has an owner, evidence and a defined review.

• Governance and risk

  Stages

  • 04 Govern
  • 06 Monitor and scale

  Problem

  We already use AI with no policy, inventory or evidence to answer an oversight review.

  Result

  Owners, review cadence and evidence defined for each control.

  View the solution: Governance and risk →