A parks department delegates all AI vendor management to procurement without IT assurance input. What integration gap should audit note?

When a parks department delegates all AI vendor management to procurement without IT assurance input, audit should note that supply-chain and vendor governance for AI must include IT assurance requirements. Procurement can negotiate price and commercial terms, but model risk, security questionnaires, data-handling restrictions, subprocessors, audit rights, model update notice, and SLAs for drift or incident response need technical assurance. Relying on vendor SOC 2 reports for ongoing AI model behavior monitoring externalizes risk to park operations, staff, and residents who rely on department services.

Procurement contract terms for uptime and support alone do not fully replace technical AI assurance reviews when models process photos, maintenance data, or location information. AI vendors are not exempt from security or model-risk questions merely because vendor SOC 2 reports cover ongoing monitoring for AI model behavior or the use case sounds recreational. Centralized procurement ownership improving consistency of annual AI vendor onboarding workflows is too late for preventative vendor due diligence and contract leverage.

Exam caveat: third-party AI risk is jointly procurement and technology/assurance—not a handoff that relies on centralized procurement ownership improving consistency of annual AI vendor onboarding workflows instead of technical assurance. Operational check: embed IT, security, and model-risk requirements in RFP and contract templates; require assurance sign-off before award; and verify ongoing vendor review includes model and data controls—not only invoices and renewal dates.