AI Governance Setup vs AI Audit

AI governance setup establishes how an organisation makes and supervises AI decisions. An AI audit examines specified claims, controls or practices against criteria using evidence. Choose setup when the required operating arrangements do not exist or cannot be used. Choose an audit when you need a defensible examination of what is designed, implemented or operating within a stated scope.

The two can form a sequence. An audit may identify a missing control; setup or remediation can create it; a later examination can assess the resulting evidence. They should have separate acceptance questions. Producing a control does not establish that an independent reviewer has tested it, and receiving an audit report does not implement the recommended repair.

This guide helps Saudi buyers distinguish the work before contracting. It uses a recruitment-assistant example to show what each engagement can conclude, what evidence remains missing and how to avoid describing newly created records as proof of past operation.

Start with the question you need answered

A setup question asks how a decision should work: who receives a new use, what evidence they require, who authorises it and what happens after a change. An audit question asks what can be concluded about a claim: whether a specified approval control was implemented, whether selected decisions followed it, or whether a particular system behaviour meets agreed criteria.

The UK government's AI assurance introduction describes assurance through measurement, evaluation and communication. For procurement, the useful implication is to identify the claim and evidence sought before choosing the label of the engagement. A broad request for “AI compliance” is too ambiguous to compare proposals or judge delivery.

Write the decision that management will make with the result. “Establish an approval route for purchased recruiting features” points towards setup. “Determine whether the recruiting assistant used only the authorised candidate population during the stated period” requires evidence examination and a precisely bounded audit question. The same business area can need both at different times.

Match the unresolved question to the work

Situation	Primary need	Acceptance evidence
No owner or review route for a new AI use	Governance setup	Adopted responsibility and a demonstrated route
Policy exists but implementation is uncertain	Scoped examination	Evidence-based conclusion about the specified implementation claim
Known weakness requires repair	Remediation with clear ownership	Implemented change and relevant verification
Management needs confidence after repair	Re-examination of the repaired claim	New evidence and a conclusion preserving its limitations
Certification is the objective	A separately defined conformity-assessment route	The appropriate assessment outcome for the defined scope

Worked example: a recruiting policy without operating records

Imagine a fictional organisation using an assistant to prepare interview-question drafts from an approved role description. Its policy requires a hiring manager to review the draft before use. The organisation asks an external team to confirm that this review has operated consistently. It provides the policy and screenshots of the drafting interface, but no completed review records for the period being examined.

The examiner can inspect the documented requirement and the available interface. Those items do not, by themselves, demonstrate that managers performed the review in the claimed period. The appropriate conclusion must reflect the evidence gap. It should not silently assume that an approved policy was followed, or infer historical performance from a demonstration prepared today.

Setup work can then define a workable review point: the manager receives the draft with its role-description source, checks relevance and inappropriate personal assumptions, records the permitted use and escalates unresolved concerns. The design identifies an alternate and a way to keep a short review record without duplicating candidate information unnecessarily.

A rehearsal shows that a manager can use this route. A later live period can produce operating records. Those are progressively different evidence states. If a new examination is commissioned, it should identify the period and cases tested, the criteria and the limitations. It cannot convert newly collected evidence into proof that the previous period was controlled.

The example deliberately concerns interview-question drafting. Candidate ranking, eligibility decisions or automated rejection would change the activity and its consequences. A conclusion about this bounded drafting workflow should not be enlarged into an endorsement of all recruitment AI or the supplier's complete product suite.

Distinguish design, implementation and operating effectiveness

A design may be suitable in principle but not implemented. An implemented control may be available but not used. A control used in selected cases may still have gaps under pressure, unusual inputs or changes. These distinctions affect what an engagement should test and how its conclusion is worded.

For the recruiting example, design evidence could be the specified review point and responsibility. Implementation evidence could show that the configured workflow actually requires the intended review. Operating evidence would concern what happened in the examined cases during the relevant period. A screenshot of a configuration is not interchangeable with a completed case record.

Ask bidders which of these layers their work covers. A document review may be useful and properly scoped, but it should not be presented as a comprehensive examination of production behaviour. Conversely, testing a model's output quality does not automatically assess whether the organisation's decision rights or exception process work.

The model documentation guide helps define technical evidence, while the risk acceptance record preserves management's decision about remaining risk. They serve different purposes. An auditor's finding is evidence for management; it does not automatically transfer the organisation's acceptance responsibility to the examiner.

Keep setup acceptance separate from audit conclusions

Accept setup against the capabilities commissioned. Can a new request be classified? Can a reviewer find the evidence? Can an authorised role decide and communicate conditions? Can the owner handle a material change? The acceptance should identify which capabilities were designed, configured or rehearsed and which await operating evidence.

An audit conclusion should identify its subject, criteria, scope, evidence and limitations. It may report a finding, a qualified conclusion or an inability to conclude on a claim. That is different from a project acceptance decision saying the delivery team supplied the agreed workflow. Do not collapse both into a single green status.

In the example, the client can accept the new review process after an appropriate demonstration while retaining the historical evidence gap as unresolved. It can also require a follow-up operating check before expanding the assistant. The decision record should explain these separate outcomes so the report is not later used to claim broader assurance.

The setup checklist supports capability acceptance. For ongoing reporting, connect remaining findings and conditions to executive oversight so management sees who must act and what evidence will resolve the matter. Closing a project purchase order should not silently close a risk finding.

Handle prior involvement and independence explicitly

A team that designed a process has useful knowledge about it. That involvement can also affect how its subsequent examination should be understood. Disclose the work performed, the people involved, the intended assurance use and the safeguards or separation proposed. Independence should be evaluated in relation to the engagement's requirements, not asserted through a generic marketing description.

A supplier may provide a valuable implementation check without calling it independent assurance. Where independent examination is needed, agree the appropriate reviewer, reporting route and conflict handling. The organisation should understand who designed the control, who verified the evidence and who is entitled to make the conclusion it will rely on.

Do not solve the issue merely by assigning a different person from the same project and assuming that every independence requirement is satisfied. The relevant standards, contractual expectations and intended audience may require more. State the actual arrangements and obtain the necessary agreement before the work begins.

Protect the examiner's ability to report limitations and disagreement. If payment or acceptance depends on producing a favourable conclusion, the procurement arrangement can undermine the purpose of the review. Acceptance should depend on performing the agreed work competently and reporting the evidence, including findings the sponsor would rather not see.

Scope remediation without rewriting the past

When an examination finds a missing operating record, the repair may be to introduce the record and start using it. It is not to backfill approvals as though they happened earlier. If a historical reconstruction is necessary, label it as a reconstruction, identify its sources and uncertainty, and preserve the distinction from contemporaneous evidence.

Assign each repair a control owner, a proposed change, an implementation date and a verification method. Separate “owner reports complete” from “verified against the agreed criterion”. The first is useful progress information; the second is evidence for closing the relevant finding. A status system that merges them prevents management from seeing the remaining verification work.

Consider whether the repair changes the risk elsewhere. A mandatory approval step may create a queue, causing staff to bypass the route. Additional logging may collect unnecessary personal content. Re-examine the whole affected workflow, including capacity and data handling, rather than assuming that adding a control can only improve the situation.

Use exception management when temporary operation is legitimately considered while a repair is pending. The exception needs its own authority, boundary and expiry. It should not be disguised as closure of the original finding or used to remove a requirement that the organisation has no authority to waive.

Compare the evidence access assumptions in proposals

Both setup and audit work depend on access, but in different ways. Setup needs enough information to design a practical route and demonstrate it. An audit needs the evidence necessary for its specified claims. A supplier-controlled model or platform may restrict access, and the conclusion must reflect that limitation instead of treating a questionnaire response as direct observation.

Before contracting, list the source systems, record types, periods, participants and permitted methods of access. Controlled walkthroughs, redacted extracts or synthetic exercises may suit some questions. Other claims require examination of actual operating evidence. The method should follow the claim; convenient access should not quietly change what the report purports to establish.

Agree how unavailable evidence is handled. The team may narrow scope, report a limitation, seek an alternative source or defer the affected conclusion. None of those outcomes should be hidden in a final certificate-like summary. A buyer needs to know which decision the available evidence can support.

The supplier evidence requirements can help identify contractual or operational access gaps before the engagement. Evidence requests should also respect the client's confidentiality and applicable information-handling arrangements. A request to “send everything” is rarely a precise scope for either governance design or assurance.

Write two distinct statements of work when necessary

A statement of work for governance setup can name the operating scope, existing processes to retain, artefacts to develop, configuration responsibilities, representative rehearsals, handover and acceptance conditions. Include ownership of the records and the work the client must perform. A deliverable list alone does not explain how the pieces should function together.

An audit statement of work should name the claims, criteria, systems and period, evidence access, methods, intended audience, reporting form, limitations and handling of prior involvement. Specify whether remediation advice or retesting is included. Avoid a promise to certify all AI compliance when neither the scope nor the assessment route supports that outcome.

Where one programme includes both, keep separate work packages and decision records. A useful commercial arrangement can connect discovery, setup and later examination without merging their conclusions. Use the governance vendor assessment to evaluate delivery capability and the pricing guide to expose what each phase actually includes.

Build a remediation evidence trail that preserves what happened

For the recruiting example, create a chronological remediation record beginning with the original observation: the organisation could not produce the required historical manager-review evidence. Preserve the period and cases covered by that observation. Later work can improve the process without changing what was known about the earlier period.

The next entry records the new review arrangement and its adoption. Identify the responsible manager, what the review must examine, the record it creates and the circumstances requiring escalation. This establishes the design response. It does not yet show that the manager used the arrangement in actual recruitment activity.

A rehearsal entry then identifies the exercise case, participants, evidence available and result. If the manager detects an unsuitable question and records the required action, that is useful evidence about the exercised route. Label the case as an exercise, retain any limitations and avoid mixing it with the later operational population.

Operating evidence begins when relevant real cases occur under the adopted arrangement. Record the population boundary and any exclusions so a later assurance provider can select and examine cases appropriately. If the required activity has not occurred, the truthful conclusion is that the evidence period has not yet supplied that case, with any interim decision stated separately.

How the original finding and subsequent work coexist

Evidence item	Supported conclusion	Still open
Original missing-review observation	The historical evidence limitation for the examined period	Any wider historical conclusion outside the assessed cases
Adopted review procedure	The corrective design has an owner and defined requirements	Whether the procedure is followed in practice
Labelled rehearsal record	The stated route was exercised under recorded conditions	Sustained use during ordinary recruitment activity
Subsequent operating cases	Evidence available for the defined later period	The independent conclusion under the assurance scope and criteria

Agree who may close which item. The setup owner may accept delivery of the corrected process. The assurance owner may require further evidence before closing an assurance finding. The business owner may have a separate decision about continued use. Keep those decisions linked so one administrative closure is not interpreted as all three.

If a later review identifies a different defect, retain its relationship to the original remediation. It may show that the first correction was incomplete, that the environment changed or that a separate weakness exists. The evidence should determine that interpretation. Treating every subsequent issue as proof that no remediation occurred loses useful history; treating the first completed action as permanent closure loses the new risk.

Choose the sequence that fits your evidence state

If the process is absent, start with enough diagnosis to establish the problem, then setup and its acceptance. If a process exists and management needs a reliable view of it, a scoped audit can reveal whether repair is needed. If a significant issue is already known, act on the appropriate containment and remediation rather than commissioning a broad report simply to restate it.

For the recruiting assistant, the useful sequence is to preserve the historical limitation, establish the review route, produce real operating evidence and examine the relevant claim when enough evidence exists. Each step answers a different question. A combined “governance audit package” is only useful if those questions and boundaries remain clear.

Discuss whether your next step is governance setup, repair or a scoped examination with Open for AI. Bring the claim management needs answered, the existing process and the evidence you can actually provide. That combination supports a concrete engagement without promising a conclusion before the work has been performed.