AI governance covers the day-to-day responsibilities, decisions, controls and records around AI. AI assurance examines the evidence to see whether a system, process or governance claim meets stated criteria.
At a glance
| Activity | Primary question | Typical output |
|---|---|---|
| AI governance | How do we direct, control and remain accountable for AI? | Ownership, policies, registers, controls, monitoring and records. |
| AI risk assessment | What could go wrong in this use, who is affected and is the remaining risk acceptable? | Use-specific risks, controls, owners and decisions. |
| Advisory governance audit | What does the evidence show about our current governance position and gaps? | Scoped findings, priorities, limitations and recommendations. |
| Independent assurance | Can an intended user rely on a defined claim against stated criteria? | An assurance conclusion or report, with scope and level clearly stated. |
| Accredited certification | Does a management system conform to a certifiable standard under an accredited process? | A certification decision by an appropriately accredited certification body. |
Why the distinction matters
An organisation can have governance without independent assurance: it may operate policies, approvals and monitoring internally. Assurance then examines a defined claim or control environment. Certification is narrower still in meaning and should not be implied by an advisory review.
Independence has levels
A person can be independent of the work they are reviewing without being an accredited certification body. Conversely, a provider that helped design a control may face a conflict when asked to provide assurance over that same control. The intended user, criteria, scope and provider role should all be explicit.
Questions to ask before commissioning work
- What exact claim or question will the work answer?
- What criteria or framework will be used?
- Is this advice, internal audit, external assurance or accredited certification?
- Who will rely on the result?
- What evidence and systems are in scope?
- What conflicts or limitations exist?
- What wording will appear in the final conclusion?
Where Mise sits
Mise provides independent advisory audits and risk assessments. We examine evidence, identify gaps and make recommendations, but do not provide accredited certification and do not describe our report as a certification outcome.
Read what an AI governance audit should contain or see how our method labels evidence and judgement.