Back to Assessments & Documents
AI & Digital Transformation Active

AI Governance - Capability & Performance Maturity Assessment

A comprehensive, originally authored assessment evaluating AI governance maturity across the complete lifecycle, from organizational context scanning and board-endorsed strategy through risk assessment, data governance,...

Start Assessment

Overview

A comprehensive, originally authored assessment evaluating AI governance maturity across the complete lifecycle, from organizational context scanning and board-endorsed strategy through risk assessment, data governance, model engineering integrity, fairness and transparency, AI-specific security, human oversight, third-party compliance, and continuous improvement. 80 questions across 10 capability domains. Written for the Chief AI Officer who needs to answer: is our AI governance a functioning control framework that protects the organization and its stakeholders, or a set of published principles that nobody operationalizes?

Detailed Description

AI governance is the most consequential capability gap in enterprise technology today. Organizations deploy AI systems that make decisions about credit, healthcare, employment, and safety without the governance infrastructure that every other consequential business process requires. The gap is not awareness. The gap is operationalization.

This assessment evaluates AI governance maturity across ten critical dimensions aligned to the structure of ISO/IEC 42001 and the functions of the NIST AI RMF. It examines organizational context: does the governance framework reflect the actual operating environment? It assesses leadership: is there a board-endorsed vision with operationalized ethical principles? It evaluates risk: are assessments repeatable, impacts quantified, and residual risk formally accepted? It scrutinizes data: are quality standards enforced, lineage tracked, and privacy designed in? It examines engineering: are models tested across multiple dimensions, versioned, and deployed through gates? It assesses fairness: is bias detected, mitigated, validated, and monitored in production? It evaluates security: are AI-specific threats modeled, adversarially tested, and fallback mechanisms designed? It examines execution: are humans in the loop, operators trained, and audit trails complete? It assesses third parties: are vendors governed equivalently and contracts AI-specific? And it measures improvement: are governance KPIs tracked, nonconformities investigated, and lessons learned applied?

Each question includes a framework mapping column (Column R) showing exactly which ISO 42001 clauses, NIST AI RMF functions, and EU AI Act articles the question addresses. This transforms the assessment from a standalone tool into a compliance traceability instrument.

Assessment Details

Audience

Chief AI Officer / CIO / CISO / Chief Ethics Officer / VP of AI & Data / Head of AI Engineering / General Counsel. Also valuable for board members exercising AI oversight, regulators conducting supervisory reviews, and external auditors assessing AI management system conformity.

Purpose

Identifies governance gaps across every dimension of AI risk management, from policy and accountability through engineering integrity, fairness, security, and compliance. Shifts AI governance from aspirational principles to operational controls with measurable effectiveness. Produces a quantified maturity score that demonstrates governance progress to the board, regulators, and stakeholders.

Effort

Estimated 6-8 hours for initial assessment with a cross-functional team (AI leadership, engineering, data science, legal, compliance, security, ethics). Allow 1-2 weeks for evidence gathering across all 10 domains. Subsequent reassessments: approximately 4-5 hours.

Cadence

Bi-annually (every 6 months). AI regulation, model capabilities, and threat landscapes evolve too rapidly for annual assessment to maintain governance currency.

Assessment Outline

(10 chapters · 80 questions)
  1. 1

    1 Organizational Context & AI Governance Scope

    • 1.1 Environmental & Context Analysis 1 questions
    • 1.2 Environmental Sustainability 1 questions
    • 1.3 AI System Inventory & Role Clarity 1 questions
    • 1.4 Stakeholder Identification & Needs 1 questions
    • 1.5 Governance Scope Boundary 1 questions
    • 1.6 Governance Framework Structure 1 questions
    • 1.7 Regulatory & Jurisdictional Register 1 questions
    • 1.8 Cross-Functional Strategic Alignment 1 questions
  2. 2

    2 Executive Sponsorship, Policy & Accountability

    • 2.1 Board-Endorsed AI Vision 1 questions
    • 2.2 Leadership Championing & Communication 1 questions
    • 2.3 Business Process Integration 1 questions
    • 2.4 Resource Allocation & Independence 1 questions
    • 2.5 Formal AI Policy with Objectives 1 questions
    • 2.6 Ethical Principles Operationalisation 1 questions
    • 2.7 Acceptable Use & Prohibited Applications 1 questions
    • 2.8 Roles, Responsibilities & Decision Authority 1 questions
  3. 3

    3 Risk Strategy, Impact & Objective Setting

    • 3.1 Systematic Risk & Opportunity Identification 1 questions
    • 3.2 Risk Criteria & Tiering Methodology 1 questions
    • 3.3 Repeatable Risk Assessment Process 1 questions
    • 3.4 Control Selection & Statement of Applicability 1 questions
    • 3.5 AI System Impact Assessment 1 questions
    • 3.6 Residual Risk Acceptance & Treatment Plan 1 questions
    • 3.7 Measurable AI Objectives & Action Plans 1 questions
    • 3.8 Controlled Framework Changes 1 questions
  4. 4

    4 Data Governance for AI Systems

    • 4.1 Data Quality Standards 1 questions
    • 4.2 Provenance & Lineage Tracking 1 questions
    • 4.3 Privacy-by-Design Protocols 1 questions
    • 4.4 Consent & Lawful Basis for AI-Specific Uses 1 questions
    • 4.5 Synthetic & Augmented Data Controls 1 questions
    • 4.6 Labelling Integrity Assurance 1 questions
    • 4.7 Retention & Deletion Enforcement 1 questions
    • 4.8 AI Dataset Documentation & Cataloguing 1 questions
  5. 5

    5 Model Development & Engineering Integrity

    • 5.1 Design Standards & Rationale 1 questions
    • 5.2 Training & Validation Rigour 1 questions
    • 5.3 Multi-Layered Testing 1 questions
    • 5.4 Version Control & Reproducibility 1 questions
    • 5.5 Technical Debt Management 1 questions
    • 5.6 Pre-Deployment Gate Review 1 questions
    • 5.7 Change & Release Management 1 questions
    • 5.8 Operational Process Planning 1 questions
  6. 6

    6 Fairness, Transparency & Explainability

    • 6.1 Bias Detection Methodology 1 questions
    • 6.2 Mitigation Effectiveness Validation 1 questions
    • 6.3 Explainability Mechanism Selection 1 questions
    • 6.4 Disclosure & Notification 1 questions
    • 6.5 Recourse Pathways 1 questions
    • 6.6 Representative Population Testing 1 questions
    • 6.7 Production Fairness Monitoring 1 questions
    • 6.8 Affected Community Engagement 1 questions
  7. 7

    7 AI Security & Adversarial Resilience

    • 7.1 AI-Specific Threat Modelling 1 questions
    • 7.2 Adversarial Testing Programme 1 questions
    • 7.3 Secure ML Pipeline Practices 1 questions
    • 7.4 Pre-Trained Component Provenance 1 questions
    • 7.5 Degradation & Fallback Design 1 questions
    • 7.6 AI Incident Response Plan 1 questions
    • 7.7 Emergency Override Mechanisms 1 questions
    • 7.8 Periodic Threat & Risk Reassessment 1 questions
  8. 8

    8 Execution, Lifecycle Controls & Human Oversight

    • 8.1 Human-in-the-Loop Control Points 1 questions
    • 8.2 Operator Competency & Training 1 questions
    • 8.3 Runtime Performance Monitoring 1 questions
    • 8.4 Data & Concept Drift Detection 1 questions
    • 8.5 Audit Trail Completeness 1 questions
    • 8.6 Production Change Controls 1 questions
    • 8.7 Staff Awareness & Policy Understanding 1 questions
    • 8.8 Governance Communication Planning 1 questions
  9. 9

    9 Third-Party, Supply Chain & Compliance

    • 9.1 Vendor & Model Provider Due Diligence 1 questions
    • 9.2 Contractual AI Obligations 1 questions
    • 9.3 Third-Party Governance Equivalence 1 questions
    • 9.4 Downstream Use & Distribution Controls 1 questions
    • 9.5 Regulatory Horizon Scanning & Register 1 questions
    • 9.6 Conformity Assessment & Regulatory Reporting 1 questions
    • 9.7 Internal Audit Programme 1 questions
    • 9.8 Records & Documentation Management 1 questions
  10. 10

    10 Monitoring, Learning & Continuous Improvement

    • 10.1 Monitoring Approach Definition 1 questions
    • 10.2 Governance Effectiveness Evaluation 1 questions
    • 10.3 Management Review & Documented Decisions 1 questions
    • 10.4 Nonconformity Handling & Root Cause 1 questions
    • 10.5 Preventive Measures & Lessons Learned 1 questions
    • 10.6 Corrective Action Tracking & Closure 1 questions
    • 10.7 Workforce Competency Development 1 questions
    • 10.8 Responsible AI Culture & Ecosystem Contribution 1 questions

At a Glance

Category AI & Digital Transformation
Type Free
Chapters 10
Questions 80
Start Assessment

Still have questions? Get in touch

ITSGovernance
  • Twitter

Contact us

ITSGovernance