# AI Three Lines of Defense RACI and Audit Templates Applying the three-lines model to AI risk without the second line rubber-stamping what it cannot evaluate. A RACI across the lines, a second-line technical literacy assessment, a risk committee reporting template, and a third-line audit program. **Who this is for:** The risk or audit leader mapping AI risk onto an existing three-lines structure. Source playbook: https://aigovernance.com/playbook/three-lines-of-defense-for-ai --- ## Three lines of defense RACI for AI _Each governance activity assigned across first line (owns and manages), second line (oversees and challenges), and third line (independent assurance)._ ### Template | Activity | First line (business / product) | Second line (risk / compliance) | Third line (internal audit) | |---|---|---|---| | AI system inventory and classification | R/A | C (challenge tiering) | I (test completeness) | | Model risk assessment | R | A (set method, review) | I | | Bias and performance testing | R (run) | A (standard, review results) | I (re-perform sample) | | Human oversight operation | R/A | C | I | | Vendor AI risk | R | A | I | | Incident response | R | C | I | | Regulatory obligation tracking | C | R/A | I | | Governance reporting to the board | C | R | A (opinion on the program) | ### Worked example > The contested calls, with the reasoning. | Activity | First line | Second line | Third line | |---|---|---|---| | Bias testing | runs it in the model pipeline | owns the methodology; reviews every high-risk result pre-ship | re-performs on a sample of models each year | | Regulatory tracking | consulted on which systems are affected | R/A (compliance owns it) | tests coverage | | Board reporting | consulted | drafts the report | independent opinion on whether the program is effective, not just present | ### Acceptance criteria - Every activity has one accountable line, and the second line's role is challenge, not execution. - Third line has an independent assurance role on every activity, including the program itself. - Role labels match the organization's actual functions. --- ## Second-line AI technical literacy assessment _Confirms the oversight function can actually evaluate what it signs off. Oversight without competence is theatre._ ### Template | Capability | Needed to oversee | Current state | Gap action | |---|---|---|---| | Read and question a model card and eval report | model risk sign-off | | | | Interpret a disparate-impact and subgroup analysis | bias oversight | | | | Assess whether a human oversight design is meaningful | oversight review | | | | Evaluate a red-team report and residual risk | security sign-off | | | | Understand agentic autonomy and containment concepts | agent deployments | | | | Read a monitoring dashboard and judge a drift response | ongoing oversight | | | ### Worked example | Capability | Current state | Gap action | |---|---|---| | Question a model card / eval | 1 of 4 risk staff comfortable | training + a technical advisor embedded | | Interpret disparate-impact analysis | 2 of 4 | workshop with DS; a checklist aid | | Judge human oversight design | strong | none | | Evaluate a red-team report | weak | pair with Security on the next two reviews | | Agentic concepts | none | bring in external training Q4 | | Read monitoring dashboards | moderate | shadow the ML on-call review monthly | ### Acceptance criteria - Each capability is rated against a real standard, not self-declared confidence. - Gaps have a concrete action (training, advisor, pairing), not "upskill". - The assessment is repeated as the second line takes on new AI risk types. --- ## AI risk committee reporting template _The second line's standing report to the risk committee: posture, movement, and what needs a decision._ ### Template > One to two pages, standing agenda item. - **AI risk posture:** systems by tier; high-risk systems with an open control gap; overdue reviews - **Movement since last meeting:** new systems, retired systems, tier changes, closed and opened gaps - **Incidents and near-misses:** count by severity, status, lessons - **Second-line challenges raised:** where oversight pushed back on first line, and the outcome - **Regulatory:** obligations approaching, readiness - **Third-line findings:** open audit findings and remediation status - **Decisions requested** ### Worked example - **Posture:** 47 systems (3 High, 12 Limited, 32 Minimal). 1 High-tier gap (resume-screener oversight design). 4 overdue reviews, down from 7. - **Movement:** 2 new (both Limited); support-copilot moved Minimal to Limited; F-1 gap closed. - **Incidents:** 0 Sev-1, 2 Sev-2 (both closed with fixes). - **Second-line challenges:** blocked a fraud-model deploy pending an updated bias eval; resolved in 5 days. - **Regulatory:** CA ADMT product work at risk; escalated. - **Third-line:** 2 open findings from the H1 audit, both on track. - **Decisions requested:** approve Q1 budget for ADMT tooling. ### Acceptance criteria - The report shows movement, not just a snapshot. - It records where the second line challenged the first line and what happened. - Third-line findings and their status appear every cycle. --- ## Third-line AI audit program _What internal audit tests to give an independent opinion on the governance program, not just individual systems._ ### Template | Audit area | What is tested | Method | Frequency | |---|---|---|---| | Inventory completeness | is every AI system actually captured? | independent discovery, compare to the register | annual | | Classification accuracy | are tiers assigned correctly and consistently? | re-classify a sample | annual | | Control operation | do documented controls actually run? | test a sample against system behaviour, not just policy | annual | | Second-line effectiveness | does oversight have competence and independence? | review challenge logs; competence assessment | annual | | Incident handling | were incidents classified, notified, and remediated per policy? | trace a sample end to end | annual | | Board reporting accuracy | does the board picture match reality? | reconcile a past report to source data | annual | ### Worked example > H1 audit summary. | Audit area | Result | |---|---| | Inventory completeness | independent discovery found 2 systems not in the register (both Minimal); onboarding checkpoint not consistently applied | | Classification accuracy | re-classified 10; 1 disagreement (borderline Limited/High), resolved to High | | Control operation | tested 8 controls on 6 systems; 2 "documented not enforced" (monitoring alerting, low-score review) | | Second-line effectiveness | challenge log healthy; competence gap on red-team evaluation noted | | Overall opinion | effective, with improvements needed on control enforcement and onboarding discipline | ### Acceptance criteria - Audit uses independent testing (re-discovery, re-classification, behaviour testing), not self-reported status. - The program tests the second line and the board reporting, not only first-line systems. - It produces an overall opinion on program effectiveness. --- ## Governance controls this kit produces evidence for - **MGV-004**: The RACI and third-line program are the continuous AI assurance function design. - **BRD-005**: The third-line opinion and any maturity grid feed the governance maturity assessment. - **BRD-002**: The three-lines RACI clarifies committee decision rights and escalation. - **HOC-007**: The risk committee reporting template is board and committee risk reporting. - **MGV-003**: Audit findings become governance-program milestones.