Glossary

AI Governance & Audit Readiness Glossary

Plain-language definitions of the terms used in AI governance, shadow IT and shadow AI, risk quantification and audit readiness.

AI Governance: AI governance is the set of roles, policies, approvals and records an organization uses to decide which AI systems it builds or buys, how they are used, and who is accountable for their risk.; RelatedAI Governance Board Two-Stage Approval Shadow AI
AI Governance Board: An AI governance board is a cross-functional group, usually drawn from security, legal, privacy, risk, finance and the business, that reviews and approves AI use cases and keeps a record of its decisions.; RelatedAI Governance Two-Stage Approval
Assessment as a Service: Assessment as a service is a delivery model in which an organization describes its business, technology and the regulations that apply, and receives a completed governance assessment, risk view and audit package from software rather than a long consulting engagement.; RelatedAudit Readiness Audit Package
Audit Package: An audit package is a structured set of files that organizes control assessments, test results, evidence and an audit plan so an independent auditor or a continuous compliance monitoring tool can review them.; RelatedAudit Readiness Continuous Compliance Monitoring
Audit Readiness: Audit readiness is the state of having designed controls, written policies and procedures, and organized evidence before an audit begins, so the audit confirms what is already in place instead of discovering gaps.; RelatedTest of Design Audit Package
Continuous Compliance Monitoring (CCM): Continuous compliance monitoring is the automated, ongoing checking of technical controls through integrations and tests. It works best once controls have already been designed, documented and assessed.; RelatedAudit Readiness Audit Package
Control Crosswalk: A control crosswalk maps the requirements of one framework to those of another, so a single piece of evidence can support several frameworks, for example SOC 2 and ISO/IEC 27001.; RelatedAudit Readiness
EU AI Act: The EU AI Act is a European Union regulation that sets requirements for AI systems according to their risk level. Its obligations phase in over time, so organizations should confirm the current schedule for their use cases.; RelatedAI Governance NIST AI Risk Management Framework
FAIR (Factor Analysis of Information Risk): FAIR is a model for expressing information and technology risk in financial terms by estimating how often a loss event could occur and how large the loss could be.; RelatedValue-at-Risk Inherent Risk Residual Risk
Fourth-Party Risk: Fourth-party risk is the risk that comes from the vendors your vendors rely on. It is one level beyond third-party risk in the supply chain.; RelatedThird-Party Risk
Governance Requirements Document (PRD): A governance requirements document describes an AI system before approval: its purpose, data, architecture, human oversight, monitoring, lifecycle and risk, so an approver reads one document instead of a questionnaire.; RelatedTwo-Stage Approval AI Governance
Inherent Risk: Inherent risk is the level of risk an AI system or process carries before any controls are applied.; RelatedResidual Risk Value-at-Risk
ISO/IEC 42001: ISO/IEC 42001 is an international standard for AI management systems. It sets requirements for how an organization governs the development and use of AI.; RelatedNIST AI Risk Management Framework AI Governance
Kill Switch: A kill switch for an AI system is a documented way to quarantine it when something goes wrong, recording who decided and why and notifying the systems that must stop using it.; RelatedTwo-Stage Approval AI Governance
NIST AI Risk Management Framework (AI RMF): The NIST AI RMF is a voluntary framework from the U.S. National Institute of Standards and Technology that organizes AI risk management into four functions: Govern, Map, Measure and Manage.; RelatedISO/IEC 42001 AI Governance
Remediation Tracker: A remediation tracker records each gap found in an assessment with an owner, a target date and a status, so findings are closed instead of forgotten.; RelatedRisk Register
Residual Risk: Residual risk is the level of risk that remains after controls are applied and measured.; RelatedInherent Risk Value-at-Risk
Risk Register: A risk register is a single list of identified risks with their owners, ratings and treatment status. In RAMP, gaps from every assessment are recorded in one risk register.; RelatedRemediation Tracker
Shadow AI: Shadow AI is the use of AI tools or models by employees or teams without review or approval from security and governance. It is a form of shadow IT.; RelatedShadow IT AI Governance
Shadow IT: Shadow IT is the use of applications, services or devices that the organization has not reviewed or approved. Finding it usually starts with employee reports and with lists from identity, procurement and asset systems.; RelatedShadow AI
Test of Design (ToD): A test of design evaluates whether a control, as described and documented, would prevent or detect the risk it targets if it operated as intended.; RelatedTest of Effectiveness Audit Readiness
Test of Effectiveness (ToE): A test of effectiveness evaluates whether a control actually operated as intended over a period, usually by sampling evidence.; RelatedTest of Design
Third-Party Risk: Third-party risk is the risk that comes from vendors, suppliers and service providers that handle your data or support your operations.; RelatedFourth-Party Risk
Two-Stage Approval: Two-stage approval reviews an AI system twice: a concept review before it is built, and a production clearance by the CISO before it goes live, with a record of who approved what and when.; RelatedGovernance Requirements Document AI Governance Board
Valora: Valora is the AI risk engine in RAMP. The name comes from the Latin valor, meaning worth or value, and from valorar in Spanish and Portuguese, meaning to value or appraise. Valora puts a dollar value on the risk of each AI system, before and after controls, so security, finance and the board decide with the same numbers.; RelatedAI Governance Two-Stage Approval
Value-at-Risk (VaR): Value-at-Risk expresses potential loss in dollars. For AI systems, RAMP estimates inherent and residual Value-at-Risk with a FAIR-based model so risk can be discussed with boards and finance leaders in financial terms.; RelatedFAIR Inherent Risk Residual Risk

Put these terms to work

Use the AI governance starter kit to set up a board, an intake form and an approval process, or schedule a walkthrough of RAMP.

AI Governance Starter Kit Schedule RAMP Walkthrough