AI & Agentic AI Governance Assessment
AI and agentic AI governance assessment for clearer approval decisions
AI adoption raises questions about who approves use, what data is involved, and how autonomous actions are controlled. ICA’s scoped governance review connects these questions to a use-case risk register and a policy and oversight roadmap.
MIS
CISSP
CHISL
CPHIMS
CDH-E
Will Long Sr. · Founder
MIS · CHISL · CDH-E · CISSP · CPHIMS
Nearly 40 years in IT & cybersecurity
Former VP & CISO, Children’s Health System of Texas
Tim Pelikan · Co-Founder
Credential details pending confirmation
30 years in cybersecurity & data risk
Interviews & industry conversations
Coffee With Closers
Cybersecurity With Discern
“ICA provides distinctive security professionals who excel at building strong client relationships, demonstrate exceptional organization, and deliver practical, risk-based consulting recommendations to our clients.”
Michael Cox, CIPP/US
Chief Privacy Consultant & Founder, SoCal Privacy Consultants
Partner endorsement of ICA’s advisory work
Decide how AI use should be approved and overseen
Your teams may be adopting AI faster than the organization can document ownership or review risk. A new vendor, an expanding pilot, or a proposal for an agent to act on business records can expose gaps in decision rights.
This assessment is intended for CIOs, CISOs, privacy leaders, and AI steering committees facing those decisions. It examines the governance around agreed use cases so leadership can identify oversight gaps and prioritize changes before extending AI use or delegating more authority.
Cover the use cases and autonomous actions that matter
Scope starts with known AI use cases and the business processes they support. Coverage considers accountability, approval practices, data handling, and vendor oversight. Your team defines which functions, vendors, and decision rights belong in the review.
For agentic workflows, the focus includes safeguards around actions an agent may take. Examples include who authorizes access, which actions require human approval, and who owns escalation when an action falls outside its intended purpose. Missing inventory information is recorded as a limitation; evidence review does not establish that every AI tool has been discovered.
Examine evidence with the people responsible for AI use
The proposed approach combines workshops with review of supporting evidence. Business owners explain intended use and decision authority. Security and privacy stakeholders help clarify data-handling expectations and existing oversight.
Relevant materials may include use-case records, approval decisions, AI policies, vendor-review records, and documented safeguards for autonomous actions. The review compares stated expectations with available evidence and identifies where ownership or support is unclear. NIST’s voluntary AI Risk Management Framework can inform the review criteria where agreed. Criteria and evidence depth are established during scoping. Documented safeguards are reviewed as evidence; their technical effectiveness is not established through attack simulation in this engagement.
Use connected findings to plan governance improvements
Governance gap report. The report describes gaps across the agreed review areas and explains the evidence supporting them. Leadership can use it to discuss where approvals, accountability, or oversight need attention.
Use-case risk register. An organized record connects identified risks to the reviewed uses of AI. It gives business and control owners a shared reference for discussing risk treatment and decisions about continued or expanded use.
Policy and oversight roadmap. Recommended priorities guide changes to governance practices and oversight. Your team can use the roadmap to sequence work and decide who should own each improvement. The engagement scope confirms the contents and depth of these typical outputs.
Prepare the scope around your adoption decisions
Identify the decision the assessment needs to support, such as reviewing an existing AI program or evaluating oversight for proposed autonomous workflows. Agree the use cases, data categories, vendors, and decision rights to be examined.
Preparation includes locating relevant records and involving people who own the workflows and approval processes. Cost and timing depend on coverage, workshop participation, evidence availability, and review depth. Agree appropriate access and handling arrangements for sensitive materials. Evidence gaps can narrow conclusions or create a need for additional review; they should be visible in the agreed scope.
Keep governance review separate from technical testing
This engagement focuses on how AI use is governed. Technical discovery and exposure review belong to the separately scoped AI Discovery, Data Exposure & Technical Security Assessment. Adversarial testing also requires a separate scope and appropriate authorization.
The governance roadmap recommends improvements. Model development, hands-on testing, implementation, and ongoing managed oversight are outside this assessment’s scope. Legal interpretations require appropriate counsel. Findings support your organization’s decisions without guaranteeing compliance, certification, or safe behavior in every AI interaction. Your owners remain responsible for approving use and carrying out changes.
AI governance assessment questions
Is this useful if our AI program is still informal?
Yes. An informal program may need clearer ownership and approval practices. The review can focus on agreed known use cases, while documenting inventory gaps that limit its conclusions.
Can the scope include agents that take business actions?
Agreed agentic workflows can be included. The review examines decision rights and documented safeguards for autonomous actions, with coverage defined around the relevant use cases and data.
What evidence supports the assessment?
Workshops and records such as policies, approvals, vendor reviews, and safeguard documentation support the findings. The agreed method defines evidence depth and how unsupported statements are treated.
What affects cost and timing?
The number and complexity of use cases, vendor coverage, stakeholder participation, and available evidence affect the work. ICA confirms those factors and delivery capacity before agreeing an engagement.
Will this discover unapproved AI tools or test attacks?
Technical discovery and exposure review are separate from this governance assessment. Adversarial testing requires its own authorized scope. Existing discovery findings can inform governance discussions where relevant and agreed.
Does the roadmap include implementing the recommendations?
The roadmap provides policy and oversight priorities. Your team owns implementation unless separate work is agreed. It does not include model development or continuous oversight of AI activity.
Define the AI oversight decisions your team needs to make
Discuss a governance scope around your known AI use and proposed autonomous actions. A focused review gives leadership documented gaps and use-case risks to consider, with a roadmap for improving policy and oversight.
Decide how AI use should be approved and overseen
Your teams may be adopting AI faster than the organization can document ownership or review risk. A new vendor, an expanding pilot, or a proposal for an agent to act on business records can expose gaps in decision rights.
This assessment is intended for CIOs, CISOs, privacy leaders, and AI steering committees facing those decisions. It examines the governance around agreed use cases so leadership can identify oversight gaps and prioritize changes before extending AI use or delegating more authority.
Cover the use cases and autonomous actions that matter
Scope starts with known AI use cases and the business processes they support. Coverage considers accountability, approval practices, data handling, and vendor oversight. Your team defines which functions, vendors, and decision rights belong in the review.
For agentic workflows, the focus includes safeguards around actions an agent may take. Examples include who authorizes access, which actions require human approval, and who owns escalation when an action falls outside its intended purpose. Missing inventory information is recorded as a limitation; evidence review does not establish that every AI tool has been discovered.
Examine evidence with the people responsible for AI use
The proposed approach combines workshops with review of supporting evidence. Business owners explain intended use and decision authority. Security and privacy stakeholders help clarify data-handling expectations and existing oversight.
Relevant materials may include use-case records, approval decisions, AI policies, vendor-review records, and documented safeguards for autonomous actions. The review compares stated expectations with available evidence and identifies where ownership or support is unclear. NIST’s voluntary AI Risk Management Framework can inform the review criteria where agreed. Criteria and evidence depth are established during scoping. Documented safeguards are reviewed as evidence; their technical effectiveness is not established through attack simulation in this engagement.
Use connected findings to plan governance improvements
Governance gap report. The report describes gaps across the agreed review areas and explains the evidence supporting them. Leadership can use it to discuss where approvals, accountability, or oversight need attention.
Use-case risk register. An organized record connects identified risks to the reviewed uses of AI. It gives business and control owners a shared reference for discussing risk treatment and decisions about continued or expanded use.
Policy and oversight roadmap. Recommended priorities guide changes to governance practices and oversight. Your team can use the roadmap to sequence work and decide who should own each improvement. The engagement scope confirms the contents and depth of these typical outputs.
Prepare the scope around your adoption decisions
Identify the decision the assessment needs to support, such as reviewing an existing AI program or evaluating oversight for proposed autonomous workflows. Agree the use cases, data categories, vendors, and decision rights to be examined.
Preparation includes locating relevant records and involving people who own the workflows and approval processes. Cost and timing depend on coverage, workshop participation, evidence availability, and review depth. Agree appropriate access and handling arrangements for sensitive materials. Evidence gaps can narrow conclusions or create a need for additional review; they should be visible in the agreed scope.
Keep governance review separate from technical testing
This engagement focuses on how AI use is governed. Technical discovery and exposure review belong to the separately scoped AI Discovery, Data Exposure & Technical Security Assessment. Adversarial testing also requires a separate scope and appropriate authorization.
The governance roadmap recommends improvements. Model development, hands-on testing, implementation, and ongoing managed oversight are outside this assessment’s scope. Legal interpretations require appropriate counsel. Findings support your organization’s decisions without guaranteeing compliance, certification, or safe behavior in every AI interaction. Your owners remain responsible for approving use and carrying out changes.
AI governance assessment questions
Is this useful if our AI program is still informal?
Yes. An informal program may need clearer ownership and approval practices. The review can focus on agreed known use cases, while documenting inventory gaps that limit its conclusions.
Can the scope include agents that take business actions?
Agreed agentic workflows can be included. The review examines decision rights and documented safeguards for autonomous actions, with coverage defined around the relevant use cases and data.
What evidence supports the assessment?
Workshops and records such as policies, approvals, vendor reviews, and safeguard documentation support the findings. The agreed method defines evidence depth and how unsupported statements are treated.
What affects cost and timing?
The number and complexity of use cases, vendor coverage, stakeholder participation, and available evidence affect the work. ICA confirms those factors and delivery capacity before agreeing an engagement.
Will this discover unapproved AI tools or test attacks?
Technical discovery and exposure review are separate from this governance assessment. Adversarial testing requires its own authorized scope. Existing discovery findings can inform governance discussions where relevant and agreed.
Does the roadmap include implementing the recommendations?
The roadmap provides policy and oversight priorities. Your team owns implementation unless separate work is agreed. It does not include model development or continuous oversight of AI activity.
Define the AI oversight decisions your team needs to make
Discuss a governance scope around your known AI use and proposed autonomous actions. A focused review gives leadership documented gaps and use-case risks to consider, with a roadmap for improving policy and oversight.