The Governor General Auditor in 2019 reported, “How could Phoenix have failed so thoroughly in a system has a management accountability framework; risk management policies, program evaluations, internal audit groups, departmental audit committees; accounting officers; departmental plans; departmental performance reports; pay-per-performance compensation; and audits by The Office of the Auditor General?”

systems will notice that evaluation of outcomes is a form of performance assessment rather than an audit Assessments are usually conducted more frequently to measure the ability to achieve outcomes as opposed to audits important particularly when trying to maintain a status of compliance during the period between when audits In addition, each objective will require a set of capabilities (some shared) to meet all its criteria Objectives are more than gaps identified by audit findings.

organizational management where compliance is separated from the business—a parallel universe where auditors functional decomposition, job specialization, along with aligning around regulatory frameworks and audit When we stop treating compliance as an audit function and instead recognize it as the fundamental means

Conduct Regular AI Risk Audits Periodically assess your third parties’ compliance with your AI standards This can include requesting audit reports, conducting on-site evaluations, or leveraging AI assessment

They should be effective , independent , and auditable : Effective - A prevention barrier is described Auditable - Barriers should be capable of being audited to check that they work. formally, it could be These would include the ones for barriers: effective, independent, and auditable for similar reasons the extended list of attributes defined by CCPS: independence, functionality, integrity, reliability, auditability For those interested in learning more we have written additional articles on the topic of using bow ties

regulations they will not know what it’s like for compliance to be anything other than rules driven by audits Can you describe this in terms we understand using rules and audits?

either viewing compliance primarily through the lens of corporate compliance, focusing on training and audits AI compliance capabilities, then iteratively advancing monitoring tools, governance structures, and audit

Compliance does not mean just passing an audit or obtaining a certificate. Traditional methods and practices based on inspection and audits are firmly entrenched and are difficult

After years under the tutelage of prescriptive rules and audits it is no wonder that the question of

the reactivity of being buried by standards, frameworks, and controls focused on certifications and audits

Transparent : The logic is visible in the code and can be easily audited. Explainability When an AI system makes a decision, stakeholders—whether users, regulators, or auditors—need Engineering practices must include fairness checks, bias audits, and tools that help identify and mitigate

This requires integration but not with traditional legal, audit, and compliance functions as some may Beyond Audits Towards Operational Compliance Gone are the days when legal departments and compliance However, Operational Compliance is not confined or defined by periodic audits and mandatory reporting