# AI Governance Best Practices Checklist and Gap Template A baseline of practices that hold up under scrutiny, each mapped to a control domain and playbook, plus a way to verify they are real: an enforcement verification log and a ranked gap list. **Who this is for:** The governance lead pressure-testing the program against a practical baseline. Source playbook: https://aigovernance.com/playbook/ai-governance-best-practices --- ## Best-practice baseline checklist _The practices to have in place, each tied to its domain and the playbook that explains it._ ### Template | Practice | Domain | Playbook | In place? | Evidence | |---|---|---|---|---| | A complete, owned AI inventory with risk tiers | inventory | complete-ai-inventory | Y / partial / N | | | A repeatable risk classification method | risk | how-to-perform-ai-risk-assessment | | | | Signed risk assessments for all high-risk systems | risk | how-to-perform-ai-risk-assessment | | | | Meaningful human oversight for consequential decisions | oversight | human-oversight-for-high-risk-ai-decisions | | | | Bias testing with a re-test cadence for people-affecting systems | monitoring | algorithmic-bias-detection-and-mitigation | | | | Decision-level logging you can reconstruct | audit | ai-decision-auditability | | | | Production monitoring with thresholds and alerting | monitoring | model-drift-monitoring | | | | An incident runbook and register, drills run | incident | ai-incident-response | | | | Vendor due diligence and monitoring for material AI vendors | third-party | third-party-ai-vendor-due-diligence | | | | A regulatory obligation map kept current | regulatory | regulatory-obligations-for-ai | | | | Quarterly board reporting reconciled to source | board | board-ai-risk-reporting | | | | Independent assurance of the program annually | assurance | ai-governance-auditing | | | ### Worked example | Practice | In place? | Evidence | |---|---|---| | Complete owned inventory with tiers | partial | 2 systems found off-register in audit | | Repeatable risk classification | Y | method doc + rubric | | Signed assessments for all high-risk | partial | 1 of 3 unsigned | | Meaningful human oversight | N | oversight is a formality (audit finding) | | Bias testing with cadence | partial | protocol exists; last run 7 weeks ago | | Decision-level logging | Y | 25/25 sampled decisions fully logged | | Monitoring with alerting | N | metrics defined, no alerts | | Incident runbook + register + drills | Y | 1 drill run | | Vendor DD + monitoring | partial | DD done; monitoring cadence not enforced | | Regulatory map current | partial | mapping in progress | | Board reporting reconciled | partial | template + cadence; not reconciled | | Annual independent assurance | Y | H1 internal audit complete | ### Acceptance criteria - Every practice is rated in place, partial, or not, with evidence for the rating. - Ratings come from verification, not self-assessment. - Each practice links to the domain and playbook a reader can go to for detail. --- ## Enforcement verification log _A record of which practices were tested against actual system behaviour, not just policy review._ ### Template | Practice | Verification method | Date | Result | Verified by | |---|---|---|---|---| | | behaviour test / log sample / config check / drill / interview | YYYY-MM-DD | pass / partial / fail + note | | ### Worked example | Practice | Verification method | Date | Result | Verified by | |---|---|---|---|---| | Decision-level logging | sampled 25 decisions across 2 systems | 2026-09-08 | pass | Internal Audit | | Human oversight is meaningful | 5 reviewer interviews + override-rate data | 2026-09-08 | fail (formality) | Internal Audit | | Deployment gate enforced | checked last 10 deploys vs registry | 2026-09-09 | partial (8/10) | Internal Audit | | Incident runbook works | tabletop of a data-exposure incident | 2026-08-30 | partial (no holding statement ready) | Governance | | Bias re-test cadence | checked test logs | 2026-09-08 | fail (overdue) | Internal Audit | ### Acceptance criteria - Each entry names a verification method that tests behaviour or records, not a document read. - Failed and partial results carry a note on what was wrong. - Practices not yet verified are visible as blanks, not assumed to pass. --- ## Ranked gap list _The gaps, ordered by whether a practice is missing entirely versus partially there, so effort goes to the worst first._ ### Template | Rank | Practice | State | Why it ranks here | Owner | Target | |---|---|---|---|---|---| | 1 | | missing / partial | | | YYYY-MM-DD | ### Worked example | Rank | Practice | State | Why it ranks here | Owner | Target | |---|---|---|---|---|---| | 1 | Meaningful human oversight | partial but failing | High-tier, regulator-relevant, currently provides no protection | Head of Talent | 2026-11-15 | | 2 | Monitoring with alerting | missing | production models can degrade undetected | ML Platform | 2026-11-01 | | 3 | Bias re-test cadence | partial | protocol exists but lapsed; quick to fix | DS team | 2026-10-01 | | 4 | Signed assessments for all high-risk | partial | 1 of 3; the assessment is nearly done | Compliance | 2026-10-15 | | 5 | Regulatory map current | partial | in progress; no imminent deadline missed | Compliance | 2026-11-30 | ### Acceptance criteria - Gaps are separated into "missing entirely" and "partially implemented". - Ranking weighs risk exposure and regulatory relevance, not just ease. - Every gap has an owner and a target date and is tracked to closure. --- ## Governance controls this kit produces evidence for - **MGV-003**: The baseline checklist and ranked gap list are a governance-program milestone and remediation plan. - **BRD-005**: The baseline assessment feeds the governance maturity assessment. - **MGV-004**: The enforcement verification log is continuous-assurance evidence that practices operate, not just exist. - **HOC-004**: Verifying oversight is meaningful tests the automation-bias control. - **ALC-005**: The verification log contributes to regulatory audit readiness.