# AI Governance Gap Assessment and Ownership Audit Templates A structured way to face the recurring hard problems: an obstacle assessment mapping each common challenge to your current state, a control enforcement audit comparing documented to verified, and an ownership gap log. **Who this is for:** The governance lead doing an honest st-take of where the program is stuck. Source playbook: https://aigovernance.com/playbook/ai-governance-challenges --- ## Governance obstacle assessment _The common challenges, each with your current status and the next action._ ### Template | Challenge | Our current status | Impact if unaddressed | Next action | Owner | |---|---|---|---|---| | Shadow AI outpacing the inventory | | | | | | Controls documented but not enforced | | | | | | Second line lacks the technical depth to challenge | | | | | | Ownership is diffuse; activities fall between teams | | | | | | Regulatory change faster than remediation capacity | | | | | | Agentic systems ahead of the governance model | | | | | | Board sees status, not risk | | | | | | Vendor dependencies not really governed | | | | | ### Worked example | Challenge | Current status | Impact | Next action | Owner | |---|---|---|---|---| | Shadow AI outpacing inventory | quarterly survey + egress scan; still find new tools each cycle | classification gaps; DPA exposure | add SSO/OAuth grant review to the discovery set | AI Gov Lead | | Controls documented not enforced | audit found 2 of 8 in this state | false assurance | enforcement verification log; add CI checks | Risk | | Second line technical depth | 1 of 4 can question an eval report | rubber-stamping | embed a technical advisor; training | CRO | | Diffuse ownership | 3 activities have no clear owner | things not done | update the RACI; sign-off | AI Gov Lead | ### Acceptance criteria - Every listed challenge has an honest current status, not aspirational. - Each has a concrete next action with an owner. - The assessment is revisited each quarter to show movement. --- ## Control enforcement audit template _For each control, compare what the policy says to what the system actually does._ ### Template | Control | Documented requirement | Verification method | Verified behaviour | Enforced? | Gap action | |---|---|---|---|---|---| | | | test / log review / config check / observation | | Y / partial / N | | ### Worked example | Control | Documented requirement | Verification method | Verified behaviour | Enforced? | Gap action | |---|---|---|---|---|---| | Deployment gate | no model to prod without a complete registry entry | check last 10 deploys against registry | 8 of 10 had complete entries at deploy time | partial | make the gate a pipeline block, not a checklist | | Decision logging | every decision logged at decision level | sample 25 decisions | all 25 fully logged | Y | none | | Retrieval scoping | RAG constrained to the current customer | red-team + code review | one system unconstrained (fixed post-incident) | partial | add a CI test for all RAG systems | | Bias re-test cadence | monthly for people-affecting systems | check test logs | last test 7 weeks ago | N | automate the schedule; alert on overdue | ### Acceptance criteria - Verification is by testing, log review, or config check, not by asking the owner. - Every "partial" or "N" has a specific gap action. - Results feed the maturity assessment and the obstacle assessment. --- ## Governance ownership gap log _Activities with no clear owner, or contested ownership, tracked until resolved._ ### Template | Activity | Current owner (if any) | Problem | Proposed owner | Resolved | Date | |---|---|---|---|---|---| | | none / disputed / unclear | | | Y / N | | ### Worked example | Activity | Current owner | Problem | Proposed owner | Resolved | Date | |---|---|---|---|---|---| | Monitoring alerting setup | none | "Platform vs DS" ambiguity; nobody built it | ML Platform (build), DS (thresholds) | Y | 2026-09-10 | | Vendor requalification on model change | disputed | Procurement thinks Security, Security thinks Procurement | Vendor Risk Manager | Y | 2026-09-12 | | Agent kill-switch testing | unclear | new capability, no owner | Security | N | target 2026-09-30 | ### Acceptance criteria - Every unowned or contested activity is logged with the specific problem. - Each is resolved by naming an owner in the RACI, with a date. - The log is reviewed in the governance committee until empty. --- ## Governance controls this kit produces evidence for - **MGV-003**: The obstacle assessment and its quarterly review are governance-program milestone tracking. - **BRD-002**: The ownership gap log resolves into the committee RACI and decision rights. - **CMP-001**: The jurisdictional-applicability challenge ties to multi-jurisdiction compliance mapping. - **MGV-004**: The enforcement audit is a continuous-assurance activity comparing documented to verified controls. - **BRD-005**: Enforcement audit results feed the governance maturity assessment.