AI System Advisory & Development • AA-02

AI Risk, Compliance & Assurance

Identify, evaluate, treat and evidence AI risk in a form auditors accept.

Scope

What the engagement covers.

AI risk is not a new register; it is new content in the existing one. This service classifies use cases, assesses impact and produces the evidence trail regulators and internal audit will ask for.

Included capabilities

AI regulatory compliance assessment and readiness audit
AI risk and impact assessments including affected-person analysis
Use-case inventory with risk classification by impact and autonomy
Control mapping, evidence, issue and action management
Independent governance and control assessment

Outputs and deliverables

AI risk and impact assessment reports
Use-case inventory with risk classification
AI control catalogue and traceability matrix
Independent assessment report for audit committee

Workflow

How it is delivered, step by step.

Each step has an owner, an entry condition and an artefact that has to exist before the next step begins.

01InventoryUse cases, models, datasets, vendors, users and deployment context.

02ClassifyRisk tiering by impact, autonomy, data sensitivity and reach.

03AssessImpact assessments with mitigation and residual risk positions.

04MapControls mapped to obligations with evidence requirements per control.

05AssureIndependent testing and reporting to risk committee and audit.

Use cases

Where this is typically applied.

Use case 01

Preparing for AI-specific regulatory supervision

Use case 02

Internal audit requesting assurance over AI deployments

Use case 03

Vendor AI systems requiring impact assessment before procurement

Delivery model

The operating pattern for AI System Advisory & Development.

The same delivery discipline applies across every capability in this line, so combined engagements stay coherent.

Discover

Inventory use cases, models, data, vendors, users and regulatory context.

Classify

Assess materiality by impact, autonomy, data sensitivity and deployment context.

Design

Governance, roles, policy, controls, lifecycle gates and evidence requirements.

Test

Risk assessment, architecture review, red teaming and scenario exercises.

Implement

Controls in delivery workflows, platforms, models and human oversight.

Sustain

Reporting, incidents, change, re-assessment, training and improvement.

Integration

Model registry, feature store and MLOps pipelines for lifecycle gates.
GRC platform for AI control mapping, evidence and issue management.
Data catalogue and lineage tooling for dataset provenance.
Security stack for logging, monitoring and incident handling of AI systems.

Engagement approach

Baseline engagements are a readiness and risk assessment. Build engagements operationalize the framework. Assurance engagements test models, LLM applications, agents and the governance controls around them, then validate remediation.

Other capabilities in AI System Advisory & Development.

View the full AI System Advisory & Development line →

AA-01