The Director's Guide to The Assurance Line

Each domain answers a question that the later domains depend on. Start with Visibility: what AI is actually in use? Then establish who answers for it, why it is used, and what it could do to the organization.

The later questions examine what the systems are built on, which obligations apply, whether the claims have been independently tested, and how failures would be detected and handled.

The sequence matters because a convincing answer can rest on an uncertain foundation. Independent testing of the systems on a list cannot establish whether that list includes every system in use.

You can investigate a particular issue at any point. When you report the result, make the underlying scope and dependencies clear. A strong result later in the line does not repair a gap earlier in it.

Every domain uses the same structure. Purpose and scope explain what it addresses and which systems or activities it covers. Reasoning explains why the requirements matter.

Control objectives state what needs to be in place. Each has an identifier, such as VIS-1, that you can follow across the framework and its companion resources. Supporting evidence names records or artifacts to examine and explains what their contents, or absence, may reveal.

Assurance criteria describe what each of the five states looks like in that domain. They help distinguish a documented arrangement from one that has been demonstrated and independently tested.

The standards mapping connects requirements to selected external references. It provides context and traceability. It is not certification, a finding of legal compliance, or a complete account of every obligation that may apply. Neither a downloaded guide nor a completed self-assessment supplies those conclusions.

An objective is a requirement, not a box to tick because a document exists. The example below comes from Visibility, which is available in full for free.

The five assurance states describe how much confidence the evidence supports. They are shared across all eight domains; the detailed criteria explain how each state applies to a particular domain.

A self-assessment records the organization’s own answers. It can reveal gaps and direct follow-up work, but completing it does not establish independent assurance. Selecting Assured does not perform or replace the testing that state requires.

Read the domain results together with their scope, supporting evidence, and unanswered items. An incomplete assessment remains incomplete; it does not establish a result for the whole organization.

The framework supports the board’s oversight and management’s work. Use your organization’s delegation arrangements to establish who decides what and which matters return to the board.

Your role as a director

Ask whether material AI uses are understood, responsibility is clear, and management’s claims are supported. Examine the limits of the evidence and whether important gaps have an owner and a follow-up date.

You can challenge an assurance claim without inspecting every technical test. Ask what was tested, by whom, what was outside the scope, and what happened after the findings were reported.

Management’s role

Identify the systems in use, assign responsibility, establish controls, and provide evidence that they operate. Bring material decisions, unresolved exposure, and incidents to the board under the agreed arrangements.

Management also needs to keep the picture current as systems, data, vendors, and uses change. An inventory or assessment from an earlier meeting may no longer describe the organization’s AI.

Close the conversation with a next step

For an unresolved issue, record the decision or evidence needed, the person responsible, and when the board will hear back. A useful discussion should leave management with a clear action and the board with a clear expectation.

Start with the work you need to do. The free resources explain the approach and give you a starting point. The paid editions provide the detailed resources for applying it.

The Board Edition focuses on meeting preparation and examining management’s answers. The Professional Edition includes the board resources and adds the complete framework, full assessment, and practical governance tools.