ISACA Advanced in AI Governance

Governance depends on who decides what. You set up councils and committees, assign decision rights across the business, technology and risk, and define how an AI question reaches the right level.

• AI governance councils and committees
• Executive roles for AI
• Decision rights for use, build, buy and stop
• Responsibility assignment across functions
• Escalation and exception paths
• Connecting to existing governance bodies

You build A decision rights matrix for AI that names who approves, advises and is informed at each stage.

AI spending needs the same discipline as other investment. You align use cases with strategy, build the business case, prioritize a portfolio and govern funding as projects move toward production.

• Aligning AI with enterprise strategy
• Business cases that include risk and run costs
• Portfolio prioritization
• Build, buy and partner decisions
• Funding models and stage gates
• Realizing and tracking benefits

You build A prioritization of six AI initiatives with business cases and stage gate criteria.

Principles only matter once they change behavior. You write AI principles and policies that people can apply, set review processes for ethical questions and define what human oversight must mean in practice.

• Enterprise AI principles
• Policy, standard and guideline structure
• Acceptable use and prohibited use
• Ethical review of use cases
• Meaningful human oversight
• Transparency toward customers and staff

You build An AI policy set with principles, acceptable use rules and an ethics review procedure.

Law, standards and contracts all bind AI use. You map the obligations, apply recognized AI management standards, and settle who is accountable for outcomes and harm.

• AI regulation across jurisdictions
• AI management system standards
• Mapping governance to COBIT and similar frameworks
• Accountability and liability for AI decisions
• Assurance and internal audit roles
• Cross-border data and model issues

You build A compliance and accountability map for the AI uses of a multinational organization.

Governance sets the boundaries AI must stay within. You define appetite and tolerance for AI risk, tier use cases accordingly and decide what oversight each tier needs.

• Risk appetite statements for AI
• Risk tiers for use cases
• Oversight proportionate to risk
• Reporting lines for AI risk
• Third-party AI in governance
• Revisiting appetite as AI use grows

You build A risk appetite statement and tier model for AI, with the oversight required for each tier.

AI is limited by the architecture of the data beneath it. You set principles for data as an asset, quality, lineage, access and interoperability, and see how they constrain which AI uses are sound.

• Data as an enterprise asset
• Data quality, lineage and cataloging
• Data products and ownership
• Privacy and access in the data architecture
• Interoperability and open standards
• Master and reference data for AI

You build A set of data architecture principles for AI, with a test showing how each constrains a decision.

Governance must read the technical design well enough to judge it. You work through the layers of an AI platform, from data to serving, weigh build and buy at each layer, and set principles for security, portability and traceability.

• Reference architecture for an AI platform
• Model development and operations pipelines
• Retrieval, agents and integration patterns
• Model registries and traceability
• Vendor lock-in and portability
• Security and resilience by design

You build A reference architecture and principles document that a governance board can use to review designs.

Value comes when AI changes how work is done. You govern the redesign of processes and roles, plan for people affected, define human-in-the-loop points and manage adoption across business units.

• Process redesign around AI
• Operating models and product ownership
• Workforce impact and skills
• Human-in-the-loop design
• Change management and adoption
• Integration with enterprise systems

You build An integration plan for one business process, with human review points and a change plan.

A governed system is one the enterprise can see. You define indicators for performance, fairness, cost and benefit, monitor drift and usage, and set triggers that bring decisions back to the board.

• Performance, fairness and cost indicators
• Benefit tracking against the business case
• Monitoring drift and model decay
• Usage and shadow AI monitoring
• Triggers for review and shutdown
• Reporting to governance bodies

You build A performance monitoring framework with indicators, thresholds and reporting cadence.

Governance should itself be examined. You review AI uses against policy, use maturity models and audits to find gaps, manage issues and refresh principles and structures as AI practice changes.

• Governance reviews and audits
• Maturity models for AI governance
• Issue management and follow-up
• Refreshing policy and structure
• Retiring or replacing AI systems
• Reporting to the board

You build A governance maturity assessment of one organization, with prioritized improvements.

One blueprint draws every part together. You design the structures, principles, architecture rules, integration approach and monitoring for an enterprise, and present it to a board.

• Assessing the enterprise’s AI position
• Designing structures and decision rights
• Setting architecture and data principles
• Planning integration and monitoring
• Presenting the blueprint to a board

You build An enterprise AI governance blueprint with structures, policies, principles and monitoring.