People remain accountable.
A named human owner, competent review and clear escalation are required. Professional responsibility stays with people.
Governance & trustAI Governance
AI Governance
& Assurance.
AI with purpose.
Assurance with evidence.
A clear governance approach for responsible AI use, accountable decisions and the confidence our partners and clients need.
01 / Our approachConfidence begins
Confidence begins
with accountability.
Responsible AI is a governance discipline. Our proposed framework connects professional integrity, data protection and technical validation to the decisions that affect clients, employees and the wider public.
Data use has a boundary.
Rights, confidentiality, client separation, vendor reuse and retention must be addressed before information is processed.
Claims follow evidence.
Assurance states the system, scope, period, test and findings. A policy commitment becomes a verified claim only after review.
Designed for practical delivery
Internal AI use, client solutions, vendor AI, predictive models, generative AI and agents are in scope. Financial calculators and Academy prototypes also remain subject to analytical quality controls.
02 / Controlled deliverySeven gates.
Seven gates.
A traceable decision at each.
Explore the evidence and decisions required from intake to retirement. A gate can return work for remediation, restrict a pilot or stop release. Commercial progress does not replace a control clearance.
G0 / Intake
Start with purpose, ownership and a use boundary.
An identified owner records the problem, intended benefit, affected people and a non-AI alternative before work proceeds.
Evidence to retain
- Inventory entry and accountable owner
- Business purpose and intended use
- Non-AI alternative and initial scope
DecisionRegister or reject
AccountabilityGovernance Lead
G1 / Assess
Understand the harm before designing the solution.
Assess risk scenarios, impact on people, legal roles, data rights and foreseeable misuse. Internal tiers and legal classifications are recorded separately.
Evidence to retain
- Risk tier and impact assessment
- Data rights and processing roles
- Specialist review and mitigation plan
DecisionPermit design or redesign
AccountabilityGovernance Lead with specialists
G2 / Design & procure
Build controls into architecture and contracts.
Review the supplier, data flows, access boundaries, evaluation plan and fallback. Connected agents need explicit action limits.
Evidence to retain
- Architecture and access design
- Supplier due diligence and contract controls
- Evaluation plan and fallback design
DecisionPermit build or bounded pilot
AccountabilitySystem Owner and specialist reviewers
G3 / Validate
Challenge performance, security and fairness.
Test the version intended for release against agreed use-case criteria. High-tier uses require independent challenge; material findings must be resolved.
Evidence to retain
- Versioned tests and acceptance criteria
- Privacy, security and fairness findings
- Independent review where required
DecisionPass or remediate
AccountabilityValidation Lead and independent reviewer
G4 / Release
Approve the evidence and the operating conditions.
Finaffairs release and client production acceptance are separate decisions. The approval records the model, configuration, users, limits and expiry.
Evidence to retain
- Signed evidence index and approval
- Client acceptance and operating limits
- Training, stop and rollback tests
DecisionApprove within conditions
AccountabilityRelease authority and Client Owner
G5 / Operate & change
Monitor the outcome, not just the model.
Review performance, complaints, drift, access and incidents. Material changes return to the appropriate gates rather than inheriting an old approval.
Evidence to retain
- Monitoring and outcome reviews
- Incident and complaint records
- Change assessment and revalidation
DecisionContinue, restrict or suspend
AccountabilitySystem Owner
G6 / Retire
Close the service and its dependencies responsibly.
Record client handover, revoked access, retention or deletion decisions and dependency closure. Preserve the evidence needed for the agreed record period.
Evidence to retain
- Client handover and closure record
- Access revocation and dependency closure
- Retention or deletion evidence
DecisionClose and archive
AccountabilitySystem Owner with Data Lead
Release boundary
Unresolved data rights, failed critical tests, withheld clearances or an ineffective stop/fallback mechanism block release under the proposed framework.
03 / Control framework30 controls.
30 controls.
From principle to evidence.
Each requirement has a control identifier, a role owner and an evidence expectation. Select an area to see the controls and the records needed to substantiate them.
G01–G07 / 7 controls
Accountability, purpose and professional integrity.
Named roles, delegated decisions, risk acceptance and honest representations provide the foundation for every engagement.
- G01Entity adoption and delegated authority
- G02Competent roles and independent challenge
- G03AI and material model inventory
- G04Risk scenarios, tier and acceptance
- G05Legal obligations and processing roles
- G06Conflicts, incentives and honest claims
- G07Approved tools and user training
D01–D05 / 5 controls
Protect the rights behind the data.
Establish data rights, minimise collection, separate client environments and control vendor reuse, transfers and retention.
- D01Data rights, purpose and provenance
- D02Minimisation and impact review
- D03Client segregation and retrieval access
- D04Vendor training, retention and transfers
- D05Retention, rights requests and deletion
S01–S03 / 3 controls
Control access, tools and external actions.
Use least privilege, threat testing and explicit tool permissions. A model output alone cannot authorise a transaction or external action.
- S01Identity, secrets and least privilege
- S02Threat testing and secure outputs
- S03Agent boundaries, approval and stop
V01–V02 / 2 controls
Carry the governance boundary through the supply chain.
Review vendors and subprocessors, the contract rights needed for evidence, incident notice, continuity and exit.
- V01Supplier and subprocessor diligence
- V02Contract rights, incidents and exit terms
Q01–Q04 / 4 controls
Test what matters to people and decisions.
Use representative evaluations, relevant fairness and accessibility checks, numerical verification and versioned system documentation.
- Q01Representative independent evaluation
- Q02Bias, accessibility and human oversight
- Q03Source, code and numeric verification
- Q04Versioned model/system documentation
L01–L02 / 2 controls
Make the approved boundary visible.
Document release and client acceptance, explain material AI involvement and retain a route to human escalation or challenge.
- L01Gate and client release approval
- L02Disclosure, complaints and appeal
O01–O04 / 4 controls
Keep assurance current as conditions change.
Monitor outcomes and drift, revalidate material changes, respond to incidents and maintain a tested fallback and exit.
- O01Performance, drift and outcome review
- O02Material change and revalidation
- O03Incident containment, notice and remediation
- O04Fallback, continuity and retirement
A01–A03 / 3 controls
Substantiate every conclusion with scoped evidence.
Identify what was reviewed, by whom, for which system and period. Record gaps, findings, corrective actions and management decisions.
- A01Scoped evidence and assurance statements
- A02Independent control testing and findings
- A03Management review and improvements
Governance · Data · Security · Suppliers · Quality · Release · Operations · Assurance
These are framework requirements. Engagement-specific implementation and operating effectiveness must be assessed separately.
04 / Partner & client confidenceKnow what the
Know what the
assurance actually covers.
The companion schedule provides a practical basis for due diligence. Agree the service and evidence first; issue a conclusion after the defined review.
Define the engagement.
Record the legal entity, systems, model versions, assessment period and approved use boundary.
Review the evidence.
Examine control records, tests, reviewers, findings and exceptions through an agreed secure channel.
State the conclusion.
Identify verified items, gaps, limitations, actions and the next review. Keep the conclusion within the assessed scope.
Evidence status
Not assessed → Planned → Partial → Verified
Items start as Not assessed. “Verified” requires dated, scoped evidence and a defined test. “Not applicable” requires a reason. These statuses are not a guarantee of error-free AI.
05 / Document centreThe framework.
The framework.
The evidence schedule.
Read the governance requirements, then use the companion schedule to agree the assurance needed for a specific partner or client engagement.
01 / Governance policyPDF · 32 pages · 477 KB
Governance and
Responsible AI Framework
Decision rights, risk classification, approval gates, data and security controls, human oversight, incidents, monitoring and a 90-day adoption roadmap.
- 30 controls with owners and evidence requirements
- Reusable intake, impact, model and release records
- Supplier, incident and assurance response templates
Version 1.0 · 11 October 2026Proposed for adoption; approval pending
02 / Engagement evidencePDF · 3 pages · 156 KB
Partner and Client
AI Assurance Schedule
A reusable schedule for due diligence, evidence disclosure, contractual commitments and a scoped conclusion after review.
- Engagement scope and accountable contacts
- 11 assurance areas and evidence expectations
- Reviewer findings, approvals and next review
Version 1.0 · 11 October 2026Reusable template; evidence to be completed
If your browser does not display the PDF, use the download links or open it in a new tab.
How to use the documents
Use the framework for formal adoption and delivery governance. Complete the schedule with engagement-specific evidence before issuing an assurance conclusion. Neither document alone establishes operating effectiveness or certification.
06 / Questions & clarityWhat partners
What partners
and clients ask.
Practical answers on scope, data, responsibility and the evidence behind assurance.
Discuss your requirements ↗What assurance can a partner or client request?
Use the assurance schedule to agree the service, legal entity, systems, versions, period and required evidence. A review can cover governance, data handling, suppliers, access, quality, human oversight, agents, operations and independent evidence.
Does the framework mean Finaffairs is ISO-certified?
No. The published framework is proposed for adoption. It draws on recognised governance and risk references, but is not a certification or a statement that all controls already operate. Any certification claim must be supported by a verifiable certificate with its entity, scope, issuer and dates.
Can client information be used to train an AI model?
The proposed framework requires authorised data use and service-specific controls on training reuse, retention, human vendor review and subprocessors. The agreed engagement scope, applicable law, contract terms and verified settings determine what is permitted. Client data should not be uploaded to an unapproved consumer AI account.
Who remains responsible for an AI-assisted deliverable?
A named human owner retains responsibility. Material financial, regulatory or professional outputs require competent review and appropriate numerical or source verification. AI assistance does not replace professional sign-off or client acceptance.
How are high-impact uses handled?
The framework treats uses that materially influence employment, credit, insurance, public-service eligibility or critical infrastructure as at least High tier. Such uses require a fuller assessment, specialist clearances, independent challenge and executive approval before release. Legal classifications are assessed separately.
Can AI agents take action in client systems?
Only within an expressly approved operating boundary. The proposed controls require least privilege, tool allowlists, defined action and transaction limits, retained approvals and an effective stop mechanism. High-impact or irreversible actions require the specified human approval outside the model.
What happens when a model, supplier or data source changes?
A material change returns to the relevant assessment, design, validation or release gates. Monitoring, incidents, complaints and drift can also trigger restriction, suspension or revalidation. Approval applies to the recorded system and context.
How do I raise a governance concern or start due diligence?
Contact Finaffairs with the engagement reference, a short description and the appropriate callback details. Avoid sending confidential evidence in an initial enquiry. The engagement team can agree a secure route for evidence review and escalation.
Design references
The framework draws on NIST AI RMF ↗, public overviews of ISO/IEC 42001 ↗ and ISO/IEC 42005 ↗, OECD AI principles ↗ and relevant privacy and security guidance. The document contains the source references. Legal applicability and sector obligations are assessed for each engagement.
Reference alignment is a design basis; it is not a certification or a complete standards conformity assessment.Start a focused conversationBring clarity to your
Bring clarity to your
AI assurance requirements.
For a partner review, client engagement or governance concern, agree the scope, responsibilities and evidence needed with Finaffairs.
Contact the team Our locations & contact details ↗For an initial enquiry, share a short description and engagement reference. Agree a secure channel before sending confidential evidence.