Audit Documentation & Governance

Criteria (what was expected), Condition (what was found), Cause (why the gap exists), Consequence (what is the risk/impact), and Recommendation (what should be done).

First line: AI development and operations teams own and manage risks. Second line: AI risk and compliance function oversees and challenges. Third line: Internal audit provides independent assurance.

Documentation review (model cards, risk assessments, etc.), technical testing (independent evaluation, fairness testing, red-teaming), interviews (structured interviews with key personnel), and process observation (verifying procedures match practice).

Critical (immediate risk, immediate action required), High (significant weakness, action within 30 days), Medium (improvement needed, 90 days), Low (best practice recommendation, advisory).

AI Policy, AI Risk Appetite Statement, AI System Register/Inventory, Model Risk Management Framework, Data Governance Framework, Incident Response Plan, and Responsible AI Principles. These should be reviewed and updated annually.

Auditors must not have development responsibilities for the system being audited. Independence ensures objective evaluation free from conflicts of interest. An auditor who developed the system cannot objectively assess their own work. This is a fundamental professional audit principle.

Shadow AI is unauthorized use of AI tools by employees (e.g., uploading confidential data to public AI services). It's a governance concern because it creates data leakage risks, compliance violations, and uncontrolled AI usage outside the organization's risk management framework.

Structure: Executive summary, scope/methodology, system description, findings by severity, management response, and appendices. The primary audience is non-technical executives and board members, so reports must translate technical findings into business risk language.