Obligation, Assurance and Maturity Tools

All courses / Tools / Module 3 / Chapter 8

Learning objectives

After the lesson the participant can:

• Map one obligation to a control, a test, an evidence item and an evidence age using a mapping tool of the chapter.
• Compare the mapping tools by what each refuses to leave out.
• Write a control catalogue entry with enforcement, evidence freshness and a test.
• Interpret a maturity result from either model of the series and state what it does not show.

Key concepts

Assure once, comply many

A method stated in Architecture as Code (Chapter 10): execute and evidence a control once, then map it to many frameworks. It fails when the mapping is a list of articles with no evidence beside each row.

Regulation-to-control mapping record

An artefact of AI Operations, family RCM: one row per control with the instruments it serves, the evidence age and review dates. Its owner is in the second line and independent of operations, and a failed test withdraws the claim.

Control catalogue entry

A control, family CTRL, with an owner, the obligations it serves, its enforcement, an evidence source with a freshness in days, a test and a status. The chapter's verdict: an entry without a test is a statement.

Oversight-quality metric

A metric, family OQM, that shows whether human oversight is real by override rate, seeded-error catch rate and review time. It is reported for groups and never to evaluate individual overseers, and three volumes define it differently.

Maturity self-assessment

The record of the AI Governance model: five levels from Exploring to Optimising over eight dimensions. An organisation is at a level when it meets that level's indicators and every level below; one overall level is the lowest dimension.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The series does not claim that holding a certificate under a standard shows that controls work. What should a board ask for instead of the certificate?
2. Why is the rule that an oversight-quality metric is never used to evaluate individuals described as the condition on which employee representatives agree to it?
3. The Architecture as Code model counts from Level 0 to Level 5 and the AI Governance model from 1 to 5, with different subjects. What goes wrong if a report mixes the two?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. What is the stated limit of the Control Mapping Matrix of Architecture as Code?

   1. It covers only the GDPR and cannot hold other frameworks
   2. It requires a policy engine before a single row can be written
   3. It holds clause references for each control, and not tests
   4. It can be maintained only by an external auditor
   Show the answer

   C. It holds clause references for each control, and not tests
   The matrix is the simplest tool with the widest reach because it asks only for a table. Its limit, the chapter says, is that it holds clause references and not tests.

2. In the maturity model of AI Governance, how is one overall level derived where one is needed?

   1. It is the average of the eight dimensions
   2. It is the lowest level found among the eight dimensions
   3. It is the level of the governance dimension
   4. It is the highest level reached in four dimensions
   Show the answer

   B. It is the lowest level found among the eight dimensions
   An organisation is at a level in a dimension when it meets that level's indicators and those of every level below, and one overall level, where needed, is the lowest dimension.

3. What makes the regulation-to-control mapping record of AI Operations a second-line artefact?

   1. It is generated automatically by the pipeline that deploys the service
   2. It is signed by the provider of the managed service it describes
   3. It is published to the supervisor every six months without review
   4. Its owner is independent of operations
   Show the answer

   D. Its owner is independent of operations
   AI Operations adds that the owner of the record is independent of operations, so the mapping is itself a second-line artefact, and that a failed test withdraws the claim on its row.