Six phases.
One complete system.
Sequential, iterative and built to produce tangible deliverables. Each phase answers one plain question a board can ask, and ends with artefacts an auditor can inspect.
Discover
What AI does the organisation actually have?
We map every AI tool, vendor and workflow in use, approved or not. The result is a living AI inventory that becomes the foundation for all governance work.
- AI Inventory
- Shadow AI Findings
- Vendor and Data-Flow Map
Govern
Who is responsible?
Three foundational documents establish principles, acceptable behaviour and organisational ownership of all AI activity.
- AI Governance Policy
- Roles & Responsibilities Matrix (RACI)
- AI Acceptable Use Policy
Assess
What are the risks?
Each AI system is evaluated for regulatory, ethical and operational risk, including bias, privacy exposure, compliance gaps and misuse, then prioritised.
- AI Risk Assessment
- AI Impact Assessment
- AI Risk Register
Control
How do we reduce the risks?
Every identified risk gets a treatment: mitigate, transfer, accept or avoid. Controls are documented, assigned and tracked to closure with a named owner and a deadline.
- AI Control Framework
- Risk Treatment Plan
- AI Approval Process
Monitor
How do we know everything is still okay?
Ongoing visibility of AI usage, incidents and control status, with scheduled reviews quarterly by default and triggered reviews on material change.
- Monitoring Dashboard
- AI Incident Register
- Periodic Review Process
Assure
Can we prove we manage AI responsibly?
The final phase creates an auditable trail ready for regulators, investors and board-level scrutiny. Governance becomes provable rather than promised.
- Internal Audit Checklist
- Management Review Report
- Evidence Repository
The AI Trust Evidence Pack.
Every engagement converges on one artefact: a unified record of what exists, what can go wrong, what controls are in place, whether the AI behaves safely, and what risk remains.