AI Governance

AI readiness, inventory, policy, and oversight, so every use of AI is visible, valuable, and accounted for.

Our work is advisory. We don't perform financial statement audits or provide attest services.

Adopt AI at the pace your business needs, with oversight you can defend.

The challenge

AI is al­ready in­side your or­ga­ni­za­tion. Some came through ap­proved projects. Some ar­rived in a ven­dor's lat­est re­lease. Some is run­ning in an em­ploy­ee's brows­er right now. Each use rais­es ques­tions about data, se­cu­ri­ty, ac­count­abil­i­ty, and human judg­ment, and reg­u­la­tors, cus­tomers, and boards have start­ed ask­ing them.

How we help

Governance starts with three an­swers: where AI is in use, what risk each use cre­ates, and who is ac­count­able for the out­come. We build the in­ven­to­ry and in­take process that pro­duces those an­swers, then de­sign over­sight sized to the stakes. A tool that sum­ma­rizes meet­ing notes doesn't need the scruti­ny of a model that in­flu­ences cred­it, claims, or hir­ing de­ci­sions.

From there, we put struc­ture around the whole life cycle, from in­take and risk tier­ing through ap­proval, de­ploy­ment, mon­i­tor­ing, and re­tire­ment. We write the poli­cies and ac­cept­able-use stan­dards, turn re­spon­si­ble AI prin­ci­ples into re­quire­ments teams can apply, de­fine roles from the board down, and de­sign human re­view that has real au­thor­i­ty.

Before adop­tion grows, we can as­sess your readi­ness, help you iden­ti­fy and pri­or­i­tize the use cases worth pur­su­ing, and shape a gov­er­nance-led AI roadmap. When you're ready, we help you pre­pare for ISO/IEC 42001 cer­ti­fi­ca­tion and for the EU AI Act oblig­a­tions that apply to you.

Standards we work with: The NIST AI Risk Management Framework and its Generative AI Profile, ISO/IEC 42001, ISO/IEC 23894, the EU AI Act, and SR 11-7 model risk guid­ance where it ap­plies.

We don't audit or as­sess an AI pro­gram, sys­tem, or use case we de­signed for the same client.

Good fit if AI tools are al­ready in use and no­body can say ex­act­ly where, who ap­proved them, or what data they touch.

Related topics

  • AI governance framework
  • AI readiness assessment
  • AI strategy and roadmap
  • AI inventory
  • AI policy
  • Responsible AI
  • ISO/IEC 42001 readiness
  • EU AI Act readiness
  • NIST AI RMF

Services in AI Governance

Select a service to see what it covers.

AI Inventory and Intake

An inventory of every AI use, including vendor features and employee tools, with an intake process that risk-tiers each new request.

You can't govern AI you can't see. We find the AI already in use, including vendor features and tools employees adopted on their own, and set up an intake process that risk-tiers every new request and names an owner.

What's included

  • Discovery of approved, vendor, and shadow AI
  • Risk tiering with a named owner for each use case
  • An intake workflow for new requests

Ask about this service

AI Policy and Governance Framework

AI policies, acceptable-use standards, roles, committees, and decision rights, sized to the stakes of each use.

We write the policies, define who decides what, and design approval paths sized to the stakes. A tool that summarizes meeting notes gets a light review, and a model that influences credit or hiring decisions gets a thorough one.

What's included

  • AI policy and acceptable-use standards, including generative AI
  • Roles, committees, and escalation paths
  • Approval workflows proportionate to impact

Ask about this service

ISO/IEC 42001 Readiness

Gap assessment and AI management system build-out ahead of an ISO/IEC 42001 certification audit.

ISO/IEC 42001 asks for an AI management system with a defined scope, risk and impact assessments, and regular reviews. We assess your gaps against the standard and help you build what's missing before the certification audit.

What's included

  • AIMS scope and gap assessment
  • AI risk and impact assessment processes
  • Internal audit and management review planning

Ask about this service

EU AI Act Gap Assessment

A review of which EU AI Act obligations apply to your AI systems, and where your current controls fall short.

The EU AI Act's obligations depend on how each AI system is classified and whether you provide it or deploy it. We map those obligations to your systems and show where current controls fall short.

What's included

  • AI system classification by risk category
  • Obligation mapping for your role as provider or deployer
  • A prioritized plan to close the gaps

Ask about this service

Responsible AI Principles and Ethics Framework

Principles for fairness, transparency, accountability, and human oversight, turned into requirements your teams can apply and evidence.

Principles such as fairness and transparency only matter if teams can act on them. We agree the principles with your leadership, then turn them into specific checks built into intake, approval, and monitoring.

What's included

  • Responsible AI principles agreed with leadership
  • Requirements and checks built into intake and approval
  • Human oversight with real authority

Ask about this service

AI Readiness Assessment

An assessment of whether your data, governance, controls, and skills are ready to adopt AI safely.

Before adoption grows, we assess whether your data, governance, controls, and skills can support AI safely. You get a clear view of the gaps and a prioritized plan to close them.

What's included

  • Data, governance, and control readiness
  • Skills and accountability gaps
  • A prioritized readiness plan

Ask about this service

AI Use-Case Identification and Prioritization

A structured way to find, assess, and rank AI use cases by value and risk before anyone builds them.

We help you find candidate use cases across the business and score each one for value and risk before anything is built. The result is a ranked portfolio, with a risk tier and an owner for each use case.

What's included

  • Use-case discovery across business units
  • Value and risk scoring
  • A ranked portfolio with risk tiers and owners

Ask about this service

AI Strategy and Roadmap (Governance-Led)

An AI roadmap built around your risk appetite, controls, and readiness, so adoption can scale without surprises.

We shape an AI roadmap around your risk appetite, controls, and readiness, with governance checkpoints at each stage. Adoption can then scale without surprises for your board or your regulators.

What's included

  • Objectives aligned with your risk appetite
  • A sequenced roadmap with governance checkpoints
  • Ownership and investment priorities

Ask about this service

Explore our other practice areas

IT & Cybersecurity Audit Advisory

Risk-based IT audits, ITGC and application control testing, and cybersecurity and cloud assessments, with findings owners can act on.

Learn more about IT & Cybersecurity Audit Advisory

Governance, Risk & Compliance

Risk assessments, security policies, vendor oversight, and SOC 2 and ISO 27001 readiness, run as one connected program.

Learn more about Governance, Risk & Compliance

AI Risk, Security, and Audit

Risk assessments, security control reviews, and audits that show whether your AI holds up in daily use, and not only in policy.

Learn more about AI Risk, Security, and Audit

Data Privacy

Know what personal data you hold, where it goes, and whether your controls keep the promises in your privacy notice.

Learn more about Data Privacy

Forensic Accounting & Fraud Risk

Evidence-first analysis of financial irregularities, and of the control gaps that let them happen.

Learn more about Forensic Accounting & Fraud Risk

Professional Training

Workshops and cohorts that build audit, AI governance, and GRC skills inside your team.

Learn more about Professional Training

View All Services

Ways to work with us

Project engagements

A defined scope, timeline, and deliverable, such as an IT review, an AI governance build, or a remediation plan.

Advisory support

Ongoing access to senior guidance as your program, systems, and regulators change.

Audit capacity support

Added hands and specialist skill for your internal audit or risk team, working under your direction.

Training programs

Workshops and cohorts for your team, delivered on a schedule that suits you.

How we engage

  1. Discovery

    A short call to understand your situation.

  2. Scoping

    A written scope with deliverables, timing, and fees.

  3. Delivery

    Regular check-ins and findings you can read in one sitting.

  4. Follow-up

    A review of progress, plus support for what comes next.

Common questions

Are you a CPA firm?

No. We're a risk and tech­nol­o­gy ad­vi­so­ry firm. We don't per­form fi­nan­cial state­ment au­dits or issue audit opin­ions.

Can you help us prepare for SOC 2 or a similar report?

Yes, on the readi­ness side: gap as­sess­ment, con­trol de­sign, and ev­i­dence prepa­ra­tion. The re­port it­self must come from a li­censed CPA firm.

Do you work with our internal and external auditors?

Yes. We co­or­di­nate with in­ter­nal audit, your ex­ter­nal au­di­tors, and your com­pli­ance team so work isn't du­pli­cat­ed.

How long does an engagement take?

It de­pends on scope. After a scop­ing call, you'll get a time­line in writ­ing.

What size organizations do you work with?

Mid-mar­ket and en­ter­prise or­ga­ni­za­tions across in­dus­tries.

Will you keep our information confidential?

Yes. We'll sign an NDA be­fore you share sen­si­tive de­tails.

Can you assess an AI program you helped design?

No. We don't audit or as­sess an AI pro­gram, sys­tem, or use case we de­signed for the same client. If an en­gage­ment would cross that line, we'll tell you dur­ing scop­ing.

Is this legal advice?

No. We sup­port reg­u­la­to­ry align­ment from a risk and con­trols per­spec­tive. For legal ques­tions, work with coun­sel.

Not sure which service fits?

Describe the problem. We'll tell you where to start.

Talk to an Advisor