A county builds an AI assurance program. Which mapping best reflects an assurance governance model?
Select an answer to reveal the explanation.
Short Explanation
You can think of assurance like a municipal building inspection program: know what you have, test it, audit it, and keep watching. Map those activities to real controls so your assurance rests on evidence, not vendor logos or staff familiarity.
Full Explanation
A county’s AI assurance governance model should map inventory, testing, audit, and continuous monitoring to real controls. This connects each known AI use to risk-proportionate testing, evidence-based audits, and monitoring after go-live, rather than treating assurance as a one-time project or a vendor brochure exercise. Skipping formal inventory because staff already recognize every AI tool fails because shadow AI, vendor add-ons, and departmental pilots can escape informal memory and therefore controls. Relying only on vendor logos instead of testing or audit work confuses brand recognition with assurance evidence and leaves bias, security, and compliance gaps unmeasured. Treating continuous monitoring as optional forever after go-live abandons oversight when risks such as drift and misuse can emerge in operation. Exam caveat: assurance governance is a control chain—know what AI is in use, test it, audit it, and monitor it—not a logo wall or a launch checklist. Practical check: maintain an AI inventory linked to required tests, audit cadence, and monitoring owners; sample a live system and verify that each mapped control has recent evidence and a named accountable municipal role.