Verolara › Sample deliverable
Sample deliverable: AI risk register and gap matrix
An excerpt of what an AI governance readiness review produces, shown on a fictional organization so you can judge the depth before you commit to anything.
Illustrative only. Northwind Health is a fictional organization. Nothing on this page comes from a client engagement, and no results are implied. Ratings and findings are examples of format and reasoning.
Excerpt 1: Qualitative AI risk register
Each risk names the scenario in plain language, rates it, records what exists today, and recommends a treatment with a named owner role.
| ID | Scenario | Category | Rating | Today | Recommended treatment | Owner role |
|---|---|---|---|---|---|---|
| R‑01 | A clinical note summarizer sends patient information to a third-party model with no data-use restrictions in the contract | Data and third party | High | Vendor signed a standard agreement; no AI terms reviewed | Add data-use, retention, and training restrictions to the contract; confirm the vendor attestations; restrict inputs to approved fields | Privacy lead |
| R‑02 | Staff paste confidential documents into a public chatbot | Data leakage | High | No acceptable-use policy for AI; no inventory of tools in use | Publish an AI acceptable-use policy; run a short staff briefing; offer an approved alternative | Security lead |
| R‑03 | A triage assistant gives different quality of advice to different patient groups and nobody notices | Bias and harm | Medium | No monitoring of outputs; vendor testing results not requested | Request the vendor testing data; define a quarterly sample review with a named reviewer | System owner |
| R‑04 | Prompt injection through an uploaded document changes what a patient-facing assistant says | Security | Medium | No adversarial testing; no input filtering described | Add the scenario to the next independent security test scope; add human review for high-impact outputs | Security lead |
| R‑05 | A new AI feature launches with no impact assessment because there is no intake step | Governance | Medium | Projects start in departments; approval is informal | Create a one-page AI intake and impact assessment; assign an approving committee | Governance lead |
Excerpt 2: Control traceability and gap matrix
Each row ties a requirement area to what the organization has, what evidence exists, and the gap. The ISO/IEC 42001 references are to its Annex A control areas, and the NIST AI RMF references are to its four functions.
| Requirement area | Framework reference | Status | Evidence seen | Gap and next step |
|---|---|---|---|---|
| AI policy and roles | ISO/IEC 42001 Annex A (policies, internal organization); NIST AI RMF Govern | Partial | A draft policy; no named accountable executive | Approve the policy; name the executive owner; define review cadence |
| Assessing impacts of AI systems | ISO/IEC 42001 Annex A (assessing impacts); NIST AI RMF Map | Gap | None | Create the impact assessment template and run it on the two highest-risk systems first |
| Data for AI systems | ISO/IEC 42001 Annex A (data for AI systems); NIST AI RMF Map and Measure | Partial | Data classification policy exists; no provenance records for AI inputs | Record data sources and quality checks for each system |
| Third-party and customer relationships | ISO/IEC 42001 Annex A (third-party relationships); NIST AI RMF Govern | Partial | Vendor register exists; AI terms not reviewed | Add AI questions to vendor review; update contracts at renewal |
| Monitoring and improvement | ISO/IEC 42001 performance evaluation; NIST AI RMF Measure and Manage | Gap | None | Define metrics, owners, and an internal review cycle |
What you also receive
- An AIMS Scope and Context Summary, stating what is in and out of scope and why
- A prioritized roadmap with owners and sequence, so you know what to do first
- A 60-minute executive briefing, with the AI Readiness Report as the written record
A review is an advisory assessment, not a certification or attestation. See how an engagement runs.