|
SERVICES › SAMPLES › AI GOVERNANCE REVIEW
AI governance review: full worked example
AI and data governance from someone who builds the controls, not just the policies. This is a complete AI governance review, end to end, for one invented company: Quillmarrow Supplies Pte. Ltd. (fictional), an office-supplies distributor and online store with about 80 staff. It shows the register, the policy, the impact assessments, the oversight and agent controls, the vendor questions and the management report you would receive, in about two weeks.
Fictional organisation, illustrative only, not a client case study « All sample previews | About the AI governance review
|
|
| The situation |
|
Staff were using ChatGPT and Microsoft 365 Copilot without clear rules. The helpdesk vendor switched on an AI reply-drafting feature. Purchasing was piloting an agent that can email purchase orders to suppliers. HR proposed a CV-screening service. A large enterprise customer sent a supplier AI questionnaire, and the company had just appointed its own Data Protection Officer. Management wanted to know what its AI may do, and who approves it.
|
|
| Decisions this supports |
- Which AI uses to approve, restrict or pause.
- What information staff may put into each tool.
- When a person must check an output or approve an action.
- What an agent may read, change or send, and what it must never do.
- Which supplier questions need answers before you proceed.
- Who owns each risk, control and follow-up action.
Where each decision is answered
| Decision |
Answered in |
Decided by (role) |
| Which AI uses to approve, restrict or pause |
A2 register, A3 tiering, A5 impact assessments, A9 decisions needed |
COO; MD for Tier 3 uses |
| What information staff may put into each tool |
A4 AI-use policy, section 4 table |
MD approves the policy |
| When a person must check an output or approve an action |
A6 oversight matrix |
COO |
| What an agent may read, change or send |
A7 specification, AIA-02 |
MD, before any sending is enabled |
| Which supplier questions need answers first |
A8 questionnaire and its follow-up actions |
COO with the use owner |
| Who owns each risk, control and follow-up action |
A2 owner roles, A9 30/60/90-day plan |
COO |
|
|
| Everything in the pack |
|
Every file carries the label "Fictional organisation, illustrative only, not a client case study", a version, a date, the preparer and the client approver role.
|
|
|
|
| About this worked example |
|
Prepared by Alex Lew (CFA, AIGP, CIPP/A, FIP). I personally review and sign off every deliverable. The templates behind these documents are in the AI governance and PDPA toolkit: complete and available now; one organisation, internal use, 12 months of updates. DM @alewyl1 on X, pay, then the ZIP arrives by email. This is practical compliance support, not legal advice. For legal advice, use a Singapore-qualified lawyer. You appoint your own DPO. I support them. ISO/IEC 42001 work is a readiness check only, never certification. Want this for your business? DM @alewyl1 on X, or ask for a free intro call (coffee chat).
|
|
|
|