Governance teams often report inventories completed, assessments launched and policies published. These are useful activity measures, but they do not demonstrate that important AI risks are controlled.
What Counts as Governance Evidence?
Evidence is a traceable record of a governed object, applicable control, operating event and accountable decision. A status label or dashboard becomes useful evidence only when a reviewer can reach the underlying source and understand its context.
| Field | Purpose |
|---|---|
| Governed object or system ID | Identifies what was controlled |
| Control and policy version | Shows the rule in force at the time |
| Owner | Establishes accountable responsibility |
| Source and timestamp | Establishes provenance and freshness |
| Test or operating event | Shows what occurred |
| Result and exception | Shows effectiveness or deviation |
| Review or approval | Shows the decision and authority |
| Retention and export status | Shows whether assurance can use the record later |
Coverage Metrics
Measure the share of relevant AI systems with a current owner, purpose, risk classification, connected data and tools, approved use and review date. Segment coverage by business unit, geography, lifecycle stage and risk tier so gaps are visible.
Control-Effectiveness Metrics
Track whether expected controls are present and operating: approval gates applied, privileged tools restricted, sensitive-data rules enforced, high-impact actions reviewed and policy violations blocked or escalated. Separate design coverage from tested operating effectiveness.
Remediation and Verification
Time to triage and time to close matter, but closure should require verification. Measure recurrence, overdue high-risk findings, accepted residual risk and the proportion of fixes that produced a confirmed change in access, behaviour or policy outcome.
Evidence Quality
Assess completeness, provenance, timeliness, version context and portability. A current evidence record should survive export without losing its relationship to the system, owner, risk and decision.
Evidence Integrity and Traceability
Protect records against silent change, preserve history and distinguish original source data from later interpretation. Where evidence contains sensitive prompts, data or credentials, retain the minimum necessary content with controlled access and clear redaction.
Metrics That Create a False Sense of Control
Counts of policies, assessments, meetings or alerts can grow while exposure remains unchanged. “Number of policies” is weak unless the organisation also knows which systems are covered, whether the control operated and whether failures were corrected.
A single governance score can hide weak coverage and uncertain evidence. Keep the underlying dimensions visible.
A Compact Executive View
| Metric | Decision it supports | Source | Cadence | Owner | Misinterpretation risk |
|---|---|---|---|---|---|
| Governed AI coverage by risk tier | Where to prioritise discovery and ownership | Inventory and discovery evidence | Monthly | Governance lead | High percentage may exclude unknown AI |
| High-risk control failures | Where deployment or operation needs restriction | Control tests and runtime events | Weekly / event-driven | Control owner | Low count may reflect poor detection |
| Overdue exceptions | Which accepted risks need escalation | Exception workflow | Monthly | Risk owner | Closure may not mean remediation |
| Verified remediation rate | Whether corrective action changed the outcome | Retest and final-state evidence | Monthly | Assurance owner | Self-attestation may overstate effectiveness |
Test Evidence During Platform Evaluation
Ask the supplier to export one complete chain from source signal to control result and final approval. Check search, history, access control, retention and portability. Then change the policy or owner and confirm that the earlier record remains understandable.
Use the maturity assessment to identify evidence gaps and the runtime controls guide to test evidence created during intervention.