How to Do an AI Governance Review: 4 Alternative Ways to Get Started

Providing assurance or advisory services over AI use and governance is a new frontier for Internal Audit. Everyone has questions, and we’re all learning as we go.

That’s exactly what’s keeping many Internal Audit teams from starting their first AI governance reviews. Overwhelmed by the influx of new AI frameworks and guidance, AI news, and AI-related content on LinkedIn, they’re unsure where to begin and whether they know enough to do the work.

In reality, Internal Auditors were made to do this work. You don’t have to be a technical expert on AI to do an AI governance review. The biggest need is bringing your risk expertise and mindset, objective perspective, curiosity, and cross-functional business knowledge and relationships. 

Of course, it helps a ton to hear directly from peers who have already done this work. That’s what inspired the Internal Audit Collective’s new eBook, The AI Governance Playbook for Internal Audit: A Practical Guide to Providing AI Assurance and Advisory Services, released this week. 

The following is an excerpt from “Section Three: What Does Getting Started Look Like?”

But why stop here? Download the complete eBook now. 

4 Alternative Ways to Open the Door to an AI Governance Project

Some Internal Audit teams will feel ready to take on an organization-wide AI governance project. For other teams, starting smaller may make sense. A smaller scope lets you get your feet wet, learn, iterate, and notch a win, shoring up your credentials for taking on an organization-wide review.

Option 1: Start In Internal Audit

Pilot the AI governance review within Internal Audit. 

Start by documenting your own AI use and governance policy. Then, consider the activities recommended in section four (e.g., use case inventory, gap assessment, RCM, testing, monitoring, training/awareness) to develop a report and recommendations on improving AI governance within Internal Audit. Then, share your policy, report, and recommendations with organizational leadership. You’re essentially saying, “We did this for our team; here’s how it benefited us. We can do this for the entire company.”

This is the approach Senior Data Analyst Paul Kirstein’s Internal Audit team ended up taking. After his team conducted an initial AI audit for their organization, “It resulted in realizing how little we had around governance and assurance at that point,” explained Paul. But Paul’s team has also been helping to lead the charge on AI implementation. So they decided to start with the smaller scope of an AI governance review focused on developing and improving Internal Audit’s AI use policy and governance. Said Paul, “We're trailblazing — starting with ourselves. Then we can use our lessons learned to provide recommendations to the wider business where it makes sense.” 

Option 2: Start With a Specific Business Unit

If your Internal Audit team’s AI use and governance is already on solid ground, consider piloting the AI governance review within a single business unit or geography. 

The same basic idea applies: Limiting your scope lets you test and refine your approach before rolling it out more widely. But performing the review for a different group will help you access more wide-ranging feedback and perspectives (versus auditors speaking to auditors). 

Ideally, approach a group you have relationships with. Having established trust and rapport may make it easier to get constructive, honest, and transparent feedback during and after the project.

Option 3: Start by Doing the First ~30% of an Audit

If organizational leadership isn’t interested — or isn’t listening — start something anyway. 

Create a deliverable that gets their attention and sets a foundation for a productive discussion. 

This option was inspired by advice IT Audit, Risk, and Advisory Senior Director Brian Elliott offered during one roundtable. A leader helming a new Internal Audit function was having a hard time getting a seat at the AI table. His company is implementing AI, and he feels his team can add more value proactively versus reactively. He wanted ideas to insert Internal Audit into the conversation. 

“I would approach that by doing basically the first 30% of an audit,” said Brian. “Map out the AI process, figure out the landscape, and find a way to summarize it, both in text form and as a graphic if possible.” Then, present your draft to stakeholders, asking them to share what resonates and what they don’t agree with, so that together, you can figure out what the AI process/landscape really looks like. 

Brian explained, “Then, your first deliverable would be, ‘Here's where we are now and how things work’.” This general consensus on the current state gives Internal Audit the opportunity to acknowledge what’s already going right — while giving stakeholders a mechanism to start identifying areas for improvement (e.g., access, data privacy, human review thresholds). This consensus and documentation become the foundation for your AI governance project.

Option 4: Consider Co-Sourcing in Limited Cases, But Keep the Knowledge

Some teams have enlisted a consultant to work alongside them for their first AI governance reviews. They sought to upskill their teams while sourcing expertise they felt they lacked. This is a reasonable option when Internal Audit resources are seriously constrained, or when conflicting management priorities make finding bandwidth impossible.  

Ultimately, however, every Internal Auditor already has the chops to do this work, given our risk mindset, objective perspective, independence, and risk, controls, process, and change management expertise. 

I genuinely believe we have the skills to provide advisory services over ANYTHING.

Plus, as I asserted in the introduction, Internal Audit’s ability to provide assurance and advisory support around our organizations’ AI use and governance is central to how our profession will stay relevant and keep providing value. Again, if a consultant does this work, what do they need you for?

Last but not least, you need to ensure that all AI governance knowledge actually ends up inside your organization. As one Internal Audit leader shared, his organization has spent “crazy money with consultants, so I'm here to get that under control and ensure we keep that knowledge in-house. So I'm doing an AI landscape survey to establish what our AI governance process actually looks like, because everybody has a hand on a different part of the elephant and they’re all telling me different things.”

Effective AI governance requires seeing the entire elephant. Whatever course you take, make sure you can do that. 

To be clear, co-sourcing partners can do a fine job. But if we immediately seek to outsource, we are missing a massive opportunity to help — and be recognized for helping — our organizations in this very important area. So, if you need to outsource anything, consider co-sourcing or outsourcing the commodity work (e.g., SOX or routine audit projects). Use this eBook to take on this new, non-routine, and highly relevant project with confidence.

THE LAST WORD: Let Your Peers Show You the Path 

Just like last week’s article, this article is only 2 pages in the complete 50-page eBook, AI Governance Playbook for Internal Audit: A Practical Guide to Providing AI Assurance and Advisory Services. 

“Section Three: What Does Getting Started Look Like?” also includes seven example project scopes from actual AI governance reviews performed by Internal Audit Collective members, and Section Four offers detailed guidance and practitioner insights on AI governance project steps like policy assessment, use case inventory, risk/gap assessment, RCM creation, and monitoring. You’ll also find detailed project profiles for several projects, framework links, AI risk information, and so much more.

This eBook is packed with your peers’ first-hand, real-world knowledge of what works — and what doesn’t — in AI governance reviews. They’ve done the hard work to figure it out. Download the full eBook today to start putting those lessons to work. And keep an eye out for our September 2026 webinar where several of those peers will share their insights and answer your questions.

Paired with the audit chops you already have, this eBook gives you what you need to start having the right conversations, asking the big questions, and start the AI governance review your organization urgently needs. 

‍