A school district AI program has no RACI for vendors, data owners, and internal audit. What should program management establish?
Select an answer to reveal the explanation.
Short Explanation
Somebody has to own the data, somebody has to own the vendor, and audit needs a seat—write it down. A helpdesk escalation chart or a vendor SLA isn't the same as naming who's accountable for all three.
Full Explanation
A school district AI program without a RACI for vendors, data owners, and internal audit needs clear roles and accountability structures spanning vendors, data owners, and assurance. Ambiguous accountability produces gaps in data stewardship, contract enforcement, monitoring, incident response, and independent review. Program management should name who owns student and staff data, who manages vendor performance and subprocessors, who approves new classroom use cases, and how internal audit receives timely access for assurance engagements.
A shared responsibility matrix covering classroom staff and helpdesk escalation for AI tools addresses day-to-day support routing, not the accountability for vendors, data ownership, and independent audit the program actually lacks. Centralized vendor contracts defining service levels and delivery timelines for AI systems fix delivery performance but say nothing about who owns the data, who approves use cases, or how internal audit gets engaged. District data stewardship for student records quality and access requests covers only the data-owner slice of the problem and still leaves vendor accountability and audit's role undefined.
Exam caveat: shared responsibility models still require the educational agency to retain ownership of risk and data governance. Operational check: publish a RACI covering build, run, vendor management, privacy, and audit; verify vendors know their control scope in writing; and include audit engagement points on the program calendar before major releases.