AI governance consulting
AI governance consulting for responsible innovation and strategic business growth
Artificial intelligence solutions are evolving rapidly, creating vast potential for increased insight, productivity and collaboration. But as organizations develop an AI strategy to harness the technology’s innovative features and significant benefits, they must also prioritize responsible implementation and consideration of risks.
RSM’s experienced AI risk professionals deliver comprehensive AI solutions to help you establish an effective AI governance program before you implement this advanced technology. AI governance differs from typical corporate, data or IT governance because it extends beyond people, process and technology to encompass additional ethical and data considerations. AI solutions—especially generative AI and agentic AI—require guardrails and controls to confirm their output is unbiased. AI processes should also align with business strategies and regulatory guidelines.
RSM’s proven AI Governance Framework guides our risk approach and our work with clients. Continuously evolving, it incorporates critical elements from many best-practice frameworks, delivering a more comprehensive approach and addressing a wider range of potential risks compared to typical single frameworks. While extensive, the RSM framework is also adaptable, tailoring AI governance to your specific level of risk exposure.
The RSM AI Governance Framework leverages key elements of several leading resources, including:
- National Institute of Standards and Technology (NIST) Cybersecurity Framework
- NIST AI Risk Management Framework
- NIST Privacy Framework
- EU Artificial Intelligence Act
- Australian AI Ethics Principles
- Microsoft Responsible AI Standard
- Google Secure AI Framework
- Health Information Trust Alliance (HITRUST) AI certification guidelines
- Office of the Information & Privacy Commissioner for British Columbia
- Canadian Freedom of Information and Protection of Privacy Act
- Government of Canada Directive on Automated Decision-Making
- Organisation for Economic Co-operation and Development AI Principles
- Information Systems Audit and Control Association AI Audit Toolkit
- Institute of Internal Auditors’ updated AI Auditing Framework
- ISO/IEC 42001:2023 Information Technology – Artificial Intelligence – Management System
Our AI policy and governance services include:
Establishing AI governance
- Description: This roadmap is designed to guide your organization’s strategic approach to AI governance and provide management with actionable direction to grow and mature your governance program.
- Approach: RSM leverages our AI Governance Framework to support your AI governance and strategy journey. We evaluate your existing enterprise risk management strategy, adjust it where necessary to address gaps and meet industry and regulatory requirements, and establish a flexible and adaptable roadmap for AI governance success.
- Timeline: Eight to 12 weeks
- Description: We review your current governance posture, identify governance principles that extend to AI, and develop an AI governance policy tailored to the needs of your organization.
- Approach: RSM leverages our AI Governance Framework to benchmark the scope, depth and quality of your organization’s current policies; provide a detailed analysis of potential gaps and recommendations for addressing them; and deliver a clear policy implementation roadmap.
- Timeline: Two to four weeks
- Description: We identify current AI policy gaps and vulnerabilities, and then determine appropriate policy changes and develop a roadmap to implement them.
- Approach: RSM leverages our AI Governance Framework to benchmark the scope, depth and quality of your current policies; provide a detailed analysis of gaps with recommendations for addressing them; and deliver a clear roadmap to implement required changes.
- Timeline: One to two weeks
- Description: We design and implement an efficient, scalable AI governance program to meet your industry and regulatory demands, risk appetite and business needs.
- Approach: RSM assesses your AI strategy and then utilizes our AI Governance Framework to establish entity-level AI governance. We assist with AI use case evaluation, system impact assessments and system inventory procedures to support ongoing governance. We may also design and deliver stakeholder training materials to support program implementation and maintenance.
- Timeline: 14−16 weeks
Educating around AI governance
- Description: We develop and support tailored training (potentially CPD-eligible) for organizations or their board members while providing strategic insights into AI governance methodologies .
- Approach: RSM deepens your understanding of AI within your global and local industry through educational advisory. We seek to understand current AI use throughout your organization to develop a governance strategy and determine training needs. Insights gathered will provide critical inputs for tailored training specific to your organization for the responsible adoption of AI technology.
- Timeline: Content development two to four weeks; training as needed
Evaluating existing AI governance
- Description: We perform an internal audit of your organization’s AI governance practices in either a co-sourced or fully outsourced engagement.
- Approach: RSM leverages our AI Governance Framework (or a framework of your choosing) to evaluate controls and threat vectors and gauge residual risk. Insights gained will provide critical inputs to develop a robust strategy for the responsible adoption of AI technology.
- Timeline: Eight to 12 weeks
- Description: We evaluate your existing control environment and vision for AI, identify and prioritize risks, and build a flexible and adaptable roadmap for responsible AI adoption.
- Approach: RSM leverages our AI Governance Framework to analyze your risk posture across any of five focus areas: use case intake governance, model lifecycle governance, at-scale governance, product governance and data governance.
- Timeline: Four to six weeks
-
Description: We incorporate third-party AI risk into existing risk assessments, build a framework for evaluating third-party risk, and implement risk monitoring.
-
Approach: RSM applies risk management principles to vendors that utilize AI and deliver products/services to your organization. We leverage deep third-party risk management experience and leading practices to build and/or incorporate AI risk evaluation into your inherent and residual risk rating frameworks. Insights from this process will provide visibility into AI usage and risk across your third-party ecosystem.
-
Timeline: Four to eight weeks
- RSM also provides outsourced due diligence services to assess inherent or residual vendor risk on your behalf.
- Timeline: Two to four weeks
- Description: We deliver AI security assurance for software products and enterprise deployments through customized penetration testing.
- Approach: RSM assesses the defensive posture applied to your AI deployments. Our adversarial AI penetration testing methodology evaluates security risk assessments, key business objectives and your use cases that leverage AI solutions. Test objectives within our assessments serve to customize testing efforts using threat-focused goals particular to each area where you utilize AI.
- Timeline: Four to eight weeks
In most cases, our approach involves working alongside you, with limited intervention into your day-to-day business. We build out your governance structure and an operational set of procedures and tools independently and then integrate changes into your business when the time is right.
RSM has provided powerful, responsible AI solutions for many years, guiding clients through successful strategy development. With a governance-first AI approach, your company can unlock more opportunities and achieve meaningful results. Contact the RSM team to learn more.
Frequently asked questions (FAQs)
Featured insights from our team
- /insights/services/risk-fraud-cybersecurity/coso-aligns-ai-governance-with-internal-control-guidance
- /insights/services/digital-transformation/agentic-ai-for-internal-audit
- /middle-market/cybersecurity-mmbi/artificial-intelligence
- /insights/services/risk-fraud-cybersecurity/rethinking-ai-total-cost-ownership
Related solutions
Find out how RSM can help you realize the potential of customer and employee experience.
- /services/digital-transformation/artificial-intelligence
- /services/digital-transformation/data-analytics/advanced-analytics
- /services/business-strategy-operations/business-transformation/technology-advisory
- /services/digital-transformation/automation-solutions