AI governance: show the evidence

1. Start with the AI your business actually uses

Effective governance begins with visibility. That means understanding AI developed internally, bought from suppliers or embedded within existing services. 

This should shape its responsibilities, governance and due diligence. As its role, AI use and associated risks evolve, governance and due diligence should be reviewed and adapted accordingly. 

It also means looking beyond the approved list to identify shadow AI. Employees using personal AI accounts or unapproved coding assistants can create exposures that a neatly documented governance framework misses. 

Define the scope of your AI Management System clearly, then challenge it. Does it reflect how the business operates? Who checks for tools and uses that fall outside it? 

Ultimately, an incomplete picture of AI use leaves an incomplete picture of risk. 

2. Put ownership where decisions happen

ISO/IEC 42001 provides a framework for managing AI responsibly. Making that framework work takes active leadership, clear responsibilities and resources. 

A signature on an AI policy is a starting point. Auditors should also look for evidence that senior leaders understand the risks, review performance and act on concerns. 

For each AI use case, someone should own the risk, approve its intended use and be accountable for the controls. Staff need to understand their responsibilities too. 

If ownership becomes unclear when a difficult decision arises, governance needs strengthening. 

3. Assess the consequences before deployment

AI risk extends beyond a security breach. Inaccurate outputs, bias, misuse and dependence on external providers can all affect business performance and the people relying on it. 

Risk and impact assessments should examine the specific use case: what could go wrong, who could be affected and how serious the consequences could be. 

Where the EU AI Act applies, that assessment should also establish the system’s regulatory classification and the organisation’s obligations. The governance framework should connect those obligations to clear ownership, practical controls and evidence that they work. 

For an insurer, an internal drafting assistant and a system supporting claims decisions warrant different scrutiny. Controls should reflect those differences. 

Establish what data AI may process, how long it is retained and whether it can be used to train or improve supplier models. These controls should cover prompts, uploaded documents and outputs. 

The practical audit question is straightforward: what evidence shows that the risks were assessed and addressed before the system went live? 

4. Test permissions – and the power to act

An approved AI tool can still create risk if it can reach more information than it needs. Access should follow least-privilege principles, with permissions reviewed as roles, systems and business needs change. Supplier oversight should establish how externally provided AI is controlled throughout its use. 

Ask third-party suppliers whether and how they use AI to deliver your services, including whether your data is processed by AI or shared with downstream AI providers. Due diligence should assess the associated controls and require notification of material changes in AI use. 

Agentic AI adds another dimension: the ability to take action. Define clear boundaries for what agents may access, decide and do autonomously, distinguishing permission to retrieve information from permission to act on it. Specify when human review, approval or intervention is required-for example, before consequential actions, when limits are exceeded or when exceptions arise. Agents must not change their own objectives, reward criteria or operating limits without human approval. 

Auditors should look for evidence that these boundaries work, activity is monitored and a tested emergency stop or ‘kill switch’ allows authorised personnel to suspend agent actions or revoke access. Responsibilities for activating it, and the review and approval required before restarting, should be clear. 

5. Keep testing after launch

AI governance needs to operate throughout the system’s lifecycle, from acquisition to retirement. 

The presentation’s Plan–Do–Check–Act approach makes this practical: identify risks, implement controls, measure performance and use the findings to improve. 

Reassess risks and retest controls when models, data sources, integrations or supplier services change-not just at initial deployment. Keep evidence of the change, test results and approval to continue use. 

Useful evidence includes training records, supplier reviews, internal audit findings, management review decisions and corrective actions. Closing an issue should mean checking that the underlying cause has been addressed. 

The strongest assurance comes from being able to trace a risk through to a working control – and show what happened when that control was tested. 

For re/insurers, that is the opportunity: use audit to expose gaps early, sharpen accountability and build confidence in AI adoption. 

Before the next AI deployment, ask for the evidence. After deployment, keep asking. 

Further reading: Your AI Is Creating New Risks. Is Your Auditor Looking for Them?

Pro Global brings the audit discipline to find out. Get in touch to have a conversation: getintouch@pro-global.com