The Board AI Questions
What to ask management about AI, how to follow up, and which answers warrant a closer look.
Each domain opens with a question, then follows up to test the answer. Every follow-up links to the control objective it tests. The examples highlight answers that need a closer look. Request the supporting evidence before drawing a conclusion.
Start with the eight opening questions below, then explore Visibility as a complete free example. The Board Edition includes the follow-ups and answers to examine for every domain, plus the Board Guide.
The eight opening questions
VIS1. Visibility
How many AI systems are in production in this organization, who owns each one, and when was that list last checked against something other than itself?
ACC2. Accountability
For each material AI system, who is the single person answerable for its outcomes, and what has this board delegated as against retained?
VAL3. Value
What did we say this would deliver, and what has it actually delivered since?
EXP4. Exposure
For this system, what is the worst realistic outcome, by what sequence would it occur, and what stands in the way?
FND5. Foundations
Where did the data come from, were we entitled to use it for this, and whose model is underneath?
OBL6. Obligations
Which obligations attach to our use of AI, who confirmed that list, and when was it last reviewed?
ASR7. Assurance
Who, independent of the people who built it, has tested that this works as claimed, and what did they find?
RES8. Resilience
If this system began producing wrong answers tomorrow, how would we find out, how long would that take, and who can switch it off?
Visibility
Complete free example
What AI are we actually running?
Open with
How many AI systems are in production in this organization, who owns each one, and when was that list last checked against something other than itself?
If the answer sounds complete
- VIS-1: Was that number counted, or estimated?
- VIS-3: What definition of AI system produced it, and who approved that definition?
- VIS-5: How many of those arrived inside a product already in use, rather than being built or procured deliberately?
- VIS-6: If a team activated an AI feature in a tool they already use, by what route would it reach this list?
- VIS-7: Who last went looking for an AI system that was not on it, and what did they find?
Answers to examine
- “We do not really use AI.”
- Treat this as a claim to verify. Ask how management checked for AI features in existing products, systems developed internally, and staff use of public tools.
- “IT maintains a list of that.”
- Ask what the list covers, how IT learns about features activated after purchase, and how business units report their use. A procurement list alone may miss these systems.
- “About a dozen, give or take.”
- Clarify whether this is an estimate or a verified count. Request the counting method, its date, and the known gaps.
- “That is built into the vendor product, so it is their risk.”
- Ask which risks and obligations the vendor handles and which remain with the organization. A vendor feature still needs an internal owner and an assessment of its use.
- “We are refreshing the inventory ahead of the audit.”
- Ask how the inventory is kept current between audits. An audit refresh may be useful, but it does not establish that changes are captured in normal operation.
Generated from the board layer of the eight domains of The Assurance Line, version 1.1. Each follow-up question cites the control objective it tests. Explore the framework at theassuranceline.com/framework.