AI Governance Starter: the review outline.

One bounded two-week engagement. Inspect the scope, customer work and delivery file before requesting a call.

This outline is a discussion document. The signed scope sets the contracting party, fee, dates and handling route.

Agree the boundary before source transfer.

Up to 10 declared AI uses, three vendor disclosures and two stakeholder sessions. Timing begins when agreed inputs and institution reviewers are available. Additional records, uses or interviews require a written scope change.

Customer: a risk officer, COO or CEO preparing for an exam request, board question, vendor AI change or pilot decision. Name the accountable owner and the institution reviewer.

Customer preparation and review responsibilities.

Supply the declared use list, decision question, deadline and permitted source versions.
Identify where the institution looked for AI, teams consulted and coverage exclusions.
Attend the two stakeholder sessions and confirm missing owners and source permissions.
Review the findings, return consolidated corrections at the agreed milestone and record the institution decision.

The working session sets preparation effort, correction round, reviewer dates and escalation. The first inquiry needs only business contact details and a general review question.

Four delivery milestones.

Scope agreed. Record uses, sources, exclusions, reviewers and the approved transfer route.
Evidence examined. Inspect permitted versions for missing, conflicting or outdated evidence. Keep declarations separate from inspected sources.
Findings reviewed. Return evidence gaps, proposed risk tiers, policy gaps and actions for institution review.
File delivered. Retain the reviewed records, board briefing, unresolved questions and next-review triggers.

The delivery file and acceptance test.

Coverage record explaining where the institution looked and what was excluded.
AI use inventory and source/version register.
Evidence assessment and proposed tiers with unresolved reasons visible.
Safe-use policy gaps and actions with owner and due-date fields.
Examiner-request mapping and one-page board briefing.
Institution decision, conditions, review date and later-change triggers.

Acceptance checks the agreed scope, complete supporting records, source relationships and treatment of corrections. It does not require the institution to approve an AI use. Wait, narrow, or do not buy are valid answers.

Sources, confidentiality and commercial terms.

Before transfer, the written scope names the actual contracting party and signatory, confidentiality terms, permitted sources, providers, access, retention, deletion and support arrangements. Confidential engagement materials use the agreed route, separate from the public inquiry form.

Fee fixed in writing after one working session. Call and working-session terms are confirmed before a charge is agreed.

A review prepares a file. It does not certify compliance, give a legal opinion or connect to a core.

Continue from an agreed baseline.

A quarterly supplied-update review can retain the earlier file, record supplied changes, identify affected questions and return an owned review queue. Source volume, customer updates, reviewer dates and fee are agreed in writing.

Read the quarterly review. Inspect the complete illustrative engagement. Try local preparation first.