AI oversight and risk governance
What is governed, who is accountable, and the record that shows the board made an informed decision. We build the program that answers those questions and keeps answering them as AI adoption accelerates.
What we do
Oversight assessment
Oversight layerAbout a dozen senior interviews over three to four weeks. No technical testing. You get a plain statement of what exists, what is missing, and what matters most, measured against what regulators, case law, and standards now expect of boards and executives.
Output: current state of the oversight program, findings, target state, a roadmap at 90 days, 6 months and 12 months, and a board reporting framework.
Program build
Oversight and management layersWe stand up the program with you. At the oversight layer: the charter, named accountability at the committee and officer level, risk tolerance ratified where it belongs, a bounded and expiring authority to operate for any system that acts without a person in the loop, the reporting and escalation line, independent assurance, and the competency to interrogate what gets reported.
At the management layer: the policies, tolerance statements, indicators, and board dashboard that operate it day to day.
Annual re-assessment and the watch
Oversight layerThe program is re-examined each year so board oversight disclosures stay defensible. Between assessments we track the case law, regulation, and standards that change what defensible means, by geography and by industry, and tell you what has changed and what it requires of you.
Six questions only the oversight layer answers
Every control in the layers beneath can be in place and none of them answers these, because each is a decision about accountability, not a control. Drawn from The AI Oversight Governance Layer, published by the Center for AI Oversight.
- The program. Have we chartered an AI oversight program, and does the record show which standards we elected to apply, how far, and who decided?
- The accountability. Which committee holds oversight by charter, which officer answers to it by name, and what have we allowed to sit outside it, accepted by whom?
- The tolerance. Did we set the boundaries of acceptable AI risk in advance, on a stated basis, and ratify them, or were they set by default?
- The authority. What operates without a person in the loop, under what limits, until when, and who can withdraw it?
- The line. Do escalation and disclosure reach us on triggers fixed in advance, by at least one path that does not depend on management's discretion?
- The record. When a regulator, court, or auditor asks, can we show the informed decision, the report we received, what we did with it, and that someone independent confirmed the program did what it said?
How a finding reads
Every finding we deliver has the same five parts. A board member can read it in a minute and know what to do with it.
Most organizations buy AI. The duty is the same.
A few organizations build models. Most put AI to work embedded in products, platforms, and vendors they already use. The oversight duty is the same in kind: who authorized it, under what limits, and who answers when it is examined. We build programs for both, and we are clear about which one you are.
If your board is asking what it should be asking about AI, start here.
A first conversation is 30 minutes with a senior member of our team. We listen to where you are and tell you plainly what we would look at first.