Governance and AI risk

AI oversight describes who checks what AI does before its work counts. We use four levels: Not yet known, AI on hold, AI prepares and a person signs off, and AI acts while a person checks exceptions. This is our own scale. It is not a standard. These levels were written by GAAPx. The level is set from your answers and never changes your GAAPx Score. It does affect score status, because a workflow can be Verified only when someone signs off or checks exceptions. The questions are organised around the four groups in the NIST AI Risk Management Framework: Govern, Map, Measure and Manage. We make no claim of NIST alignment, certification or endorsement.

AI oversight is asked once for the whole finance function, not once per area. It has no weights.

The eight questions behind it are draft wording and will be refined.

The four levels

Level	In plain English
Not yet known	Skipped, or too few answers to say who checks the AI's work. Nothing is assumed.
AI on hold	A must-have item is not met: no named owner or approver, or no audit trail or stop path. AI does only light help until it is fixed.
AI prepares, a person signs off	The controls are written down, but testing is incomplete. AI prepares the work and a named person reviews it and signs off.
AI acts, a person checks exceptions	The controls are tested and monitored, and no answer shows a control tested without being written down. AI may act within those controls, and a person reviews the exceptions.

How the level is worked out

1. Too few answers. If you skip the AI oversight step, or answer fewer than 4 of the 8 questions, the level is Not yet known.
2. Must-have items. Two questions are must-have items: a named owner or approver for AI use, and an audit trail or stop path for AI work. If either is not met, the level is AI on hold. "Not sure" counts as not met. "Partly" does not meet a must-have item.
3. Written down, not yet tested. If both must-have items are met but some controls are not tested yet, the level is AI prepares, a person signs off.
4. Tested and monitored. If the controls are tested and monitored, and there is no tested-without-written-down warning, the level is AI acts, a person checks exceptions.

A missing must-have item holds the level down whatever the GAAPx Score is.

Intent and tested

Each area of governance is asked at two levels.

• Intent means it is written down.
• Tested means there is evidence it works.

A policy is not a control that works. Recording the two apart shows the gap between them.

Illustrative example. A finance team has a one-page list of the AI tools in use and the data each one sees. That answers the Map question at the Intent level. Nobody has checked the list against tool accounts or asked the team what they really use, so the Tested question is No. The list is written down but not tested, which is the AI prepares, a person signs off pattern. Once someone checks the list and keeps the result, that question moves from Intent to Tested.

Tested without Intent raises a warning. A control that works but is not written down depends on one person remembering it, so it blocks the top level until it is documented.

The four functions

The questions are grouped under four functions, taken from the NIST AI Risk Management Framework.

Function	What it asks, in plain English
Govern	Who is accountable for AI use in finance.
Map	Knowing where AI and data are used.
Measure	Checking that AI output is right.
Manage	Being able to trace, pause and undo AI work.

Each function has one Intent question and one Tested question. See the NIST AI RMF mapping for the full list of questions.

Reference to NIST AI RMF

This structure is informed by the NIST AI Risk Management Framework, a voluntary reference for thinking about AI risk. GAAPx uses its four function names. It makes no claim of NIST certification, alignment, compliance or endorsement.