AI is rapidly changing the way organisations work. Finance, business and IT are confronted with new applications every day, but the question is: do we still truly understand how AI affects business processes, and what that means for internal control, audit and assurance?
With Coney Minds AI Consulting, we support organisations in preparing for the future.
The demand for assurance around AI is emerging. Legislation (such as the EU AI Act) and standards (ISO 42001) make it inevitable that organisations must demonstrate how AI is developed, deployed and controlled.
With Coney Minds AI Consulting, we prepare organisations for this by:
Importantly, at this stage the focus is on consulting and preparation. This is how we help organisations take the right steps.
Below you will find the five categories we focus on in our assessment. You can read them on the site or download the list via the button below.
Download the internal checklist
☐ Do we have a formal AI policy and governance structure (e.g. AI board, risk committee)?
☐ Is it documented who owns the AI applications (business, IT, data science)?
☐ Do we have insight into data quality (provenance, completeness, representativeness)?
☐ Is the model lifecycle (development, training, testing, deployment, retraining) documented?
☐ Are there agreements in place regarding ethics, bias, and explainability of models?
Organisations preparing for AI assurance often encounter similar questions: what do we need to document, how do we set up governance, and when is our data quality “good enough”? Because every AI application and every level of maturity is different, we prefer to answer these questions in context. The frequently asked questions below will help you get started — and invite you to explore together which steps are needed to prepare for AI assurance in a careful and pragmatic way.
Many organisations already have individual AI initiatives, but no formal policy. During the preparation phase, we assess whether there is a clear structure in place (e.g. AI board, risk committee) and who holds which responsibilities. This forms the basis for a reliable assurance scope.
The auditor expects clear documentation of who is responsible for business use, IT management and data science. This does not need to be complex, as long as roles, decision-making and escalation paths are transparent and traceable.
We look at provenance, completeness, representativeness and data quality. Clients often ask whether they need to implement new tooling for this — that is usually not necessary; clarity, consistency and basic data quality are the most important first steps.
Yes. The assurance preparation phase is specifically intended to make gaps visible. Many organisations have carried out training, testing and monitoring, but have not formally documented everything. We help determine which elements are needed to arrive at a model lifecycle that can be tested.