Demo scope context
How to use this working paper in discovery
- Start with the scope assumptions and ask the auditee to correct them.
- Use the candidate AI Risks as discussion prompts, not as final findings.
- Confirm whether the expected controls exist, who owns them, and what evidence is available.
- Capture provisional impact and likelihood only as auditee discovery input.
1. AI Ambition-Feasibility Mismatch
Direct candidateAI Strategy & Value Mgmt.
AI strategy feasibility and readiness review
Objective: Confirm material AI ambitions, roadmap items, and major use cases are achievable, resourced, and aligned to organizational readiness before funding or commitment.
Description: Require each material AI ambition or major AI initiative to document business objective, intended purpose, feasibility assumptions, technology and data readiness, organizational buy-in, capability/resourcing gaps, accountable owner, funding model, risk assumptions, decision rights, and approval gate before investment approval.
Evaluate AI strategy feasibility and readiness review
Trace the control for AI strategy feasibility and readiness review from the event, decision, or cadence that triggers it through execution, review, exception handling, and retained evidence. Use the control objective as the reference point.
2. Lack of Clear Accountability
Direct candidateAI Organization & Culture
AI accountability, RACI, and decision-rights control
Objective: Make AI ownership, decision accountability, and control responsibility explicit, communicated, and testable for material AI systems.
Description: Define, approve, communicate, and maintain accountable owners, responsible parties, consulted/informed stakeholders, escalation paths, and decision rights for material AI systems across business decisions, technical/model operation, AI risk management, data quality, human oversight, vendor management, control execution, monitoring, and issue remediation.
Analyze AI accountability, RACI, and decision-rights control
Trace the control for AI accountability, RACI, and decision-rights control from the event, decision, or cadence that triggers it through execution, review, exception handling, and retained evidence. Use the control objective as the reference point.
3. Missing AI Inventory
Baseline governanceAI Governance & Risk
AI system inventory and reconciliation control
Objective: Ensure AI systems, models, use cases, automations, owners, lifecycle stages, vendors, data/resource dependencies, classifications, and governance/control status are visible, current, and available for risk management, oversight, and audit scoping.
Description: Maintain a complete, current, periodically reconciled AI inventory/catalog covering material AI use, including AIS name, version, license/cost where relevant, deployment/access method, purpose/intended use, frequency of use, stakeholders, accountable owner, business/process owner, model/use-case linkage, data/tooling/system/human resources, vendor/third-party details, classification/risk status, lifecycle stage, approval/control status, monitoring status, and decommissioning status. Refresh at least annually and when intake, procurement, architecture, project, release, technical-discovery, survey, or interview evidence indicates new or changed AI use.
Review AI system inventory and reconciliation control
Trace the control for AI system inventory and reconciliation control from the event, decision, or cadence that triggers it through execution, review, exception handling, and retained evidence. Use the control objective as the reference point.
4. Sensitive Data Disclosure & Inference
Specialist overlayAI Data Management
AI sensitive-data protection and disclosure prevention
Objective: Prevent unauthorized disclosure, retention, reproduction, or exposure of sensitive, confidential, or personal data through AI training, tuning, retrieval, prompts, outputs, logs, and connected data sources.
Description: Define and operate AI data-use rules covering data classification, approved data purposes, minimization, masking/tokenization/redaction, least-privilege access to training/retrieval/runtime data, restrictions on sensitive prompt/output content, retention/deletion expectations, logging without sensitive-data sprawl, and exception handling for systems that process PII, IP, trade secrets, credentials, health/financial records, or other confidential data.
Examine AI sensitive-data protection and disclosure prevention
Trace the control for AI sensitive-data protection and disclosure prevention from the event, decision, or cadence that triggers it through execution, review, exception handling, and retained evidence. Use the control objective as the reference point.
5. Inadequate Verification & Validation
Lifecycle itemAI Engineering & Lifecycle
AI verification, validation, and release acceptance control
Objective: Confirm AI systems meet documented requirements, trustworthiness criteria, risk tolerance, and intended-use expectations before operational reliance or release.
Description: Define, document, and execute AI verification and validation measures before release, including acceptance criteria, test data selection and representativeness, model/system performance, robustness, safety, bias/fairness, security/resilience where applicable, limitation handling, anomaly resolution, release criteria, and approval evidence.
Validate AI verification, validation, and release acceptance control
Trace the control for AI verification, validation, and release acceptance control from the event, decision, or cadence that triggers it through execution, review, exception handling, and retained evidence. Use the control objective as the reference point.
6. Prompt Injection & Input Manipulation
Specialist overlayAI Security & Malicious Use
Adversarial input and prompt-injection defense control
Objective: Reduce the likelihood and impact of hostile or manipulated inputs overriding AI instructions, bypassing safeguards, exposing data, misclassifying content, or triggering unauthorized actions.
Description: Design, test, monitor, and improve defenses against prompt injection and input manipulation, including input/output validation, instruction hierarchy hardening, untrusted-content segregation, retrieval/tool isolation, least-privilege tool execution, human approval for high-risk actions, adversarial/stress testing, monitoring, and response procedures.
Validate Adversarial input and prompt-injection defense control
Trace the control for Adversarial input and prompt-injection defense control from the event, decision, or cadence that triggers it through execution, review, exception handling, and retained evidence. Use the control objective as the reference point.
7. Inadequate or Missing AI Governance Framework
Baseline governanceAI Governance & Risk
AI governance framework and management system
Objective: Provide a coherent, documented, accountable, risk-based management system for governing AI obligations, risks, controls, lifecycle activities, and reporting across the organization.
Description: Establish, implement, maintain, periodically review, and continually improve an AI governance framework covering mandate and scope, AI policy, roles and decision rights, risk appetite/tolerance, AI inventory and classification, lifecycle controls, legal/regulatory obligation management, impact/risk assessment, third-party responsibilities, monitoring, incidents/concerns, exceptions, and management/governance reporting.
Evaluate AI governance framework and management system
Trace the control for AI governance framework and management system from the event, decision, or cadence that triggers it through execution, review, exception handling, and retained evidence. Use the control objective as the reference point.
8. AI Supply Chain & Third-Party Risk
Baseline governanceAI Governance & Risk
AI supplier and external-component due diligence
Objective: Assess AI vendors, external models, datasets, APIs, plugins, and service providers before and during use.
Description: Apply a standalone control for the third-party/vendor branch of unmanaged acquisition risk; do not make it the primary control because unmanaged use also includes internal builds, pilots, embedded features, and end-user tools outside procurement.
Analyze AI supplier and external-component due diligence
Trace the control for AI supplier and external-component due diligence from the event, decision, or cadence that triggers it through execution, review, exception handling, and retained evidence. Use the control objective as the reference point.
9. Metadata & Lineage Management Failure
Specialist overlayAI Data Management
AI data lineage, provenance, and metadata control
Objective: Make data used by material AI systems traceable, explainable, reproducible, and auditable across collection, preparation, use, change, and retirement.
Description: Define and operate a lifecycle process to record data origin, acquisition/selection rationale, transformations, ownership, data quality checks, labels/enrichment, update/retirement status, lineage flows, dependencies, and metadata for datasets used to develop, test, validate, deploy, or operate material AI systems.
Analyze AI data lineage, provenance, and metadata control
Trace the control for AI data lineage, provenance, and metadata control from the event, decision, or cadence that triggers it through execution, review, exception handling, and retained evidence. Use the control objective as the reference point.
10. Hallucinations (Confabulation)
Direct candidateSocietal & Ethical Impact
AI output accuracy, grounding, and validation control
Objective: Reduce reliance on fabricated, inaccurate, or unsupported AI outputs in material workflows.
Description: For hallucination-prone or material AI outputs, define expected accuracy/assurance criteria, ground outputs in approved sources where feasible, disclose known limitations, require human or expert review for material decisions, test outputs under deployment-like conditions, and monitor accuracy/performance issues after deployment.
Evaluate AI output accuracy, grounding, and validation control
Trace the control for AI output accuracy, grounding, and validation control from the event, decision, or cadence that triggers it through execution, review, exception handling, and retained evidence. Use the control objective as the reference point.
Assurance Boundary
This example shows the shape of an AIRUM output, not the complete method. A real AIRUM export may include more candidate AI Risks, richer rationale, source basis, applicability prompts, and evidence-pack details. Those details are intentionally reduced here.