Implementation Kit
AI Governance Gap Assessment and Ownership Audit Templates
A structured way to face the recurring hard problems: an obstacle assessment mapping each common challenge to your current state, a control enforcement audit comparing documented to verified, and an ownership gap log.
Who this is for: The governance lead doing an honest st-take of where the program is stuck.
1. Governance obstacle assessment
SpreadsheetThe common challenges, each with your current status and the next action.
Template
| Challenge | Our current status | Impact if unaddressed | Next action | Owner |
|---|---|---|---|---|
| Shadow AI outpacing the inventory | ||||
| Controls documented but not enforced | ||||
| Second line lacks the technical depth to challenge | ||||
| Ownership is diffuse; activities fall between teams | ||||
| Regulatory change faster than remediation capacity | ||||
| Agentic systems ahead of the governance model | ||||
| Board sees status, not risk | ||||
| Vendor dependencies not really governed |
Worked example
| Challenge | Current status | Impact | Next action | Owner |
|---|---|---|---|---|
| Shadow AI outpacing inventory | quarterly survey + egress scan; still find new tools each cycle | classification gaps; DPA exposure | add SSO/OAuth grant review to the discovery set | AI Gov Lead |
| Controls documented not enforced | audit found 2 of 8 in this state | false assurance | enforcement verification log; add CI checks | Risk |
| Second line technical depth | 1 of 4 can question an eval report | rubber-stamping | embed a technical advisor; training | CRO |
| Diffuse ownership | 3 activities have no clear owner | things not done | update the RACI; sign-off | AI Gov Lead |
Acceptance criteria
- ✓Every listed challenge has an honest current status, not aspirational.
- ✓Each has a concrete next action with an owner.
- ✓The assessment is revisited each quarter to show movement.
2. Control enforcement audit template
SpreadsheetFor each control, compare what the policy says to what the system actually does.
Template
| Control | Documented requirement | Verification method | Verified behaviour | Enforced? | Gap action |
|---|---|---|---|---|---|
| <control> | test / log review / config check / observation | Y / partial / N |
Worked example
| Control | Documented requirement | Verification method | Verified behaviour | Enforced? | Gap action |
|---|---|---|---|---|---|
| Deployment gate | no model to prod without a complete registry entry | check last 10 deploys against registry | 8 of 10 had complete entries at deploy time | partial | make the gate a pipeline block, not a checklist |
| Decision logging | every decision logged at decision level | sample 25 decisions | all 25 fully logged | Y | none |
| Retrieval scoping | RAG constrained to the current customer | red-team + code review | one system unconstrained (fixed post-incident) | partial | add a CI test for all RAG systems |
| Bias re-test cadence | monthly for people-affecting systems | check test logs | last test 7 weeks ago | N | automate the schedule; alert on overdue |
Acceptance criteria
- ✓Verification is by testing, log review, or config check, not by asking the owner.
- ✓Every "partial" or "N" has a specific gap action.
- ✓Results feed the maturity assessment and the obstacle assessment.
3. Governance ownership gap log
SpreadsheetActivities with no clear owner, or contested ownership, tracked until resolved.
Template
| Activity | Current owner (if any) | Problem | Proposed owner | Resolved | Date |
|---|---|---|---|---|---|
| <activity> | none / disputed / unclear | Y / N |
Worked example
| Activity | Current owner | Problem | Proposed owner | Resolved | Date |
|---|---|---|---|---|---|
| Monitoring alerting setup | none | "Platform vs DS" ambiguity; nobody built it | ML Platform (build), DS (thresholds) | Y | 2026-09-10 |
| Vendor requalification on model change | disputed | Procurement thinks Security, Security thinks Procurement | Vendor Risk Manager | Y | 2026-09-12 |
| Agent kill-switch testing | unclear | new capability, no owner | Security | N | target 2026-09-30 |
Acceptance criteria
- ✓Every unowned or contested activity is logged with the specific problem.
- ✓Each is resolved by naming an owner in the RACI, with a date.
- ✓The log is reviewed in the governance committee until empty.
Governance controls this kit produces evidence for
Completing the artifacts above gives you a head start on the evidence requirements for these controls.
The obstacle assessment and its quarterly review are governance-program milestone tracking.
The ownership gap log resolves into the committee RACI and decision rights.
The jurisdictional-applicability challenge ties to multi-jurisdiction compliance mapping.
The enforcement audit is a continuous-assurance activity comparing documented to verified controls.
Enforcement audit results feed the governance maturity assessment.
This kit backs one playbook. Read the full guidance for the reasoning behind each artifact.
Decide what to implement next
Assess your governance gaps, then create an action plan with owners and target dates. Build and export without an account; sign in when you want to save your plan.
Start the AI governance assessment →