AI Governance in Practice Training: Inventory, Risk Tiers, Impact Assessment and Assurance

Programme Summary

AI governance in practice is the subject of this two-week training course for risk, compliance, data and board-level leaders, ending in an AI governance operating plan for one organisation. Organisations deploy AI faster than they can say which systems exist, how risky each is and who answers for it. The programme moves from decision rights to inventory, risk tiers, policy, impact assessment, management system, lifecycle controls, compliance, assurance and board reporting, using cases from banking, health and public services. Mars Training Centre UK delivers this programme on AI governance in practice to mixed-organisation cohorts.

The Business Case

AI systems enter an organisation through projects, suppliers and everyday software, often without a single owner or record. Without a governance system, leaders cannot tell which uses carry serious risk, which controls apply or what evidence they could show a board or an external reviewer. A common method turns scattered practice into one inventory, one set of risk tiers and one reporting line that leaders can steer and defend.

• AI Risk Exposure: Falls as every system is inventoried, tiered and matched to controls.
• Compliance Readiness: Improves as obligations are mapped to controls and evidence is kept.
• Decision Speed: Improves as clear decision rights and approval gates remove repeated debate.

Principles and Evidence Base

• ISO/IEC 42001 Artificial Intelligence Management System: Provides the management system structure applied in Sessions 6, 7 and 9.
• OECD AI Principles: Frame the ethics and policy requirements built in Sessions 4 and 5.
• Risk-Based Control Principles: Match the strength of control to the level of harm, applied in Sessions 3 and 7.

Intended Participants

• Chief risk officers who set risk appetite and tiering for AI use across the organisation.
• Compliance heads who map obligations to controls and prepare evidence for reviews.
• Chief data and AI officers who own the inventory, approval gates and lifecycle controls.
• Board committee members who receive assurance reporting and challenge management.
• Senior government officials who set expectations for AI use in public bodies.

Typical sectors include banking, insurance, healthcare, telecommunications and public administration.

Learning Outcomes

1. Participants will be able to construct an inventory of AI systems that records owner, purpose, data and supplier.
2. Participants will be able to prioritise AI systems into risk tiers and justify the controls each tier requires.
3. Participants will be able to evaluate policy and ethics requirements against the OECD AI Principles.
4. Participants will be able to design an impact assessment that identifies affected groups and mitigations.
5. Participants will be able to diagnose gaps between a management system and the clauses of ISO/IEC 42001.
6. Participants will be able to justify an assurance plan and a board report for AI governance.

Programme Structure

Day 1: AI Governance in Practice and Decision Rights

What must an AI governance system decide, and who decides it?

• AI Governance Charter
• Decision Rights Matrix
• Governance Body Terms of Reference
• Role and Responsibility Map
• AI Policy Hierarchy Chart

Day 2: AI System Inventory and Ownership

Which AI systems exist, and who answers for each one?

• AI System Inventory Template
• Use Case Intake Form
• Third-Party AI Supplier Register
• Unapproved Use Discovery Checklist
• Ownership Assignment Sheet

Day 3: Risk Tiers and Risk Appetite

How risky is each system, and how much risk will the organisation accept?

• Risk Tiering Criteria Table
• Harm Scenario Catalogue
• Risk Appetite Statement
• Tier-to-Control Mapping
• Risk Register Entry Format

Day 4: Policy and Ethics Requirements

What rules should govern the design and use of AI?

• OECD AI Principles Mapping Sheet
• Acceptable Use Policy Draft
• Fairness and Transparency Requirements
• Human Oversight Standard
• Exception and Escalation Procedure

Day 5: Impact Assessment

Who is affected by a system, and how are harms found and reduced?

• Impact Assessment Template
• Affected Group Analysis
• Data Provenance and Consent Review
• Bias and Performance Test Plan
• Mitigation Action Plan

Day 6: Management System Design

How do policy, roles and controls fit together as one management system?

• ISO/IEC 42001 Clause Mapping Table
• Objectives and Resource Plan
• Competence and Awareness Matrix
• Documented Information Index
• Change Control Procedure

Day 7: Lifecycle Controls

Which controls apply from approval through operation to retirement?

• Model Approval Gate Checklist
• Validation Evidence Pack
• Deployment Readiness Review
• Drift and Performance Indicator Set
• Retirement Criteria Sheet

Day 8: Compliance Obligations and Incidents

How are legal duties met and AI incidents handled?

• Applicable Obligation Register
• Control-to-Obligation Matrix
• AI Incident Response Playbook
• Supervisory Enquiry Response Pack
• Records Retention Schedule

Day 9: Assurance and Board Reporting

What evidence shows the governance system works?

• Assurance Plan
• Control Test Programme
• Audit Finding Tracker
• Board Reporting Dashboard
• Management Review Agenda

Day 10: Operating Plan for One Organisation

Do the earlier records add up to one working governance system?

• Applying the Session 2 AI System Inventory Template
• Testing the Session 3 Tier-to-Control Mapping
• Reviewing the Session 5 Impact Assessment Template
• Checking the Session 9 Board Reporting Dashboard
• Completing the AI Governance Operating Plan

Methodology

The programme uses a structured exercise method built on a shared case of a mid-sized organisation with a growing set of AI systems, some built, some bought and some embedded in software. Participants build each governance artefact on prepared case data, then adapt it to their own organisation and test it against a challenge from a mock board committee.

• Suggested activity: Building an inventory entry and risk tier for five contrasting AI systems.
• Suggested activity: Drafting an impact assessment for a customer-facing decision system.
• Suggested activity: Presenting a quarterly AI governance report to a mock board committee.

Capstone Output

Each participant completes an AI governance operating plan for one organisation. It holds a decision rights matrix, an inventory, a risk tiering table with control mapping, a policy set, an impact assessment template, an assurance plan and a board report. The plan is used at work to launch or reset the governance function and to brief the board on its status.

Frequently Asked Questions

Is AI governance in practice training suitable for leaders without a technical background?

Yes. AI governance in practice is taught through organisational cases and templates. It assumes experience of risk, compliance, data or board oversight but no programming or machine learning knowledge.

Which standards does AI governance in practice training rest on?

AI governance in practice training rests on ISO/IEC 42001 for the management system, the OECD AI Principles for ethics and policy, and risk-based control principles for matching controls to harm.

How is the plan from AI governance in practice training used at work?

You use the operating plan to launch or reset the governance function, agree decision rights, set risk tiers and brief the board on inventory, risks and assurance results.

How does AI governance in practice differ from data protection training?

AI governance in practice covers inventory, risk tiers, impact assessment and assurance for AI systems, while data protection training centres on lawful handling of personal data across all processing.