Finance wants the tax-FAQ chatbot’s controls mapped to specific statutory and policy obligations. What governance artifact is needed?
Select an answer to reveal the explanation.
Short Explanation
Compliance mapping is a translator: this control covers that obligation—no guessing later in an audit. A risk register lists failure modes and owners, but it doesn't show which control satisfies which obligation. An audit log export records chats, and a data retention schedule sets log disposal rules—neither is a control-to-obligation matrix.
Full Explanation
Finance wanting the tax-FAQ chatbot’s controls mapped to specific statutory and policy obligations needs a compliance mapping artifact: a matrix that shows which implemented civic AI controls satisfy which legal and policy requirements (e.g., records retention for prompts/outputs, accessibility, nondiscrimination, privacy notices, accuracy expectations for tax guidance, vendor data-processing terms). Unmapped controls leave auditors and operators guessing whether encryption, logging, grounding, or human review actually cover a given obligation, and leave gaps invisible until an audit or incident. Explicit mapping supports assurance, procurement clauses, and remediation prioritization when statutes or city policies change. For a tax-FAQ assistant, mapping also clarifies where generative answers are informational only versus where human escalation is mandatory. A risk register listing chatbot failure modes and mitigation owners tracks operational risk, but it doesn't show auditors which controls satisfy which statutory and policy obligations—it's a risk-tracking artifact, not a compliance mapping artifact. An audit log export recording user queries and chatbot responses for review captures interaction data, but it does not link controls to specific statutes or policies—it's a logging artifact, not a compliance mapping artifact. A data retention schedule defining chatbot log storage periods and disposal rules governs records retention, but it does not demonstrate which controls satisfy which legal obligations—it's a records-management artifact, not a compliance mapping artifact. What finance needs is the explicit control-to-obligation matrix itself, not a risk register, an audit log export, or a data retention schedule standing in for one. Exam caveat: do not confuse an audit log export with a control-to-obligation mapping; the stem asks for the governance artifact that links chatbot controls to specific statutes and policies. Operational check: maintain a living mapping spreadsheet or GRC entry for the tax-FAQ bot, review it when laws or prompts change, and sample that each critical obligation has at least one evidenced control with an owner.