Module 3: Governance & Risk Management, BoK I.B
Tailoring governance: six differentiators
There is no universal AI governance design. Six organisational factors drive the differences → company size, maturity, industry/sector, products & services, objectives and risk tolerance. The exam asks for all six.
There is no universal AI governance design. Six organisational factors drive the differences, and the exam asks for all six.
- Company size → correlates with the number, scope and variety of AI systems and available resources. Smaller firms combine AI duties with privacy or legal functions and extend existing screening tools → larger firms create AI-specific offices and detailed ML and GenAI processes.
- Maturity → correlates with the organisation's ability to build sufficient infrastructure for managing the risks AI introduces.
- Industry / sector → highly regulated sectors (healthcare, insurance, banking) already fold AI into existing compliance and receive regulator guidance on AI-specific risk.
- Products & services → the amount of AI embedded in offerings drives the scope of governance; oversight must be proportional to the complexity and impact of the AI.
- Objectives → strategic choices to develop, incorporate or merely use AI should be structured around the risks each entails; tie potential uses to desired outcomes (profit, quality of service, work culture).
- Risk tolerance → AI may ease some risks but almost certainly introduces new ones; risk assessments give only a relative score, so the organisation must judge fit with its position, values and plans.
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.