A municipal vendor AI questionnaire is completed, but results never feed the enterprise AI risk register. What should audit recommend?

Audit should recommend integrating vendor AI due-diligence findings into the enterprise AI risk register and ongoing risk monitoring. Completing a municipal vendor AI questionnaire creates evidence only if results feed enterprise risk views—owners, treatments, key risk indicators, and re-evaluation triggers. Otherwise due diligence is a filing exercise disconnected from how the city manages AI risk day to day.

Filing vendor AI questionnaire results in the procurement system to inform contract renewal decisions fails because evidence confined to procurement renewal scoring cannot shape the enterprise AI risk register or drive treatment, owners, and monitoring. Consolidating vendor AI questionnaire scores into a procurement dashboard for sourcing team review fails conceptually: assurance artifacts must connect to enterprise risk ownership, not merely feed a sourcing dashboard for procurement optics. Routing vendor AI due-diligence findings to IT vendor management for service performance tracking and follow-up fails because cooperative vendors can still present material AI risks; service performance tracking is not the same as enterprise AI risk register ownership, treatment, and monitoring.

Exam caveat: pasting questionnaire scores into a register without translating findings into municipal risk language (likelihood, impact, owner, treatment) still leaves decision-makers without actionable entries. Operational check: pick recent AI vendors with completed questionnaires and trace each material finding to a register item, owner, and monitoring activity—or document the gap when no link exists.