Builds the policies, records and controls that let an organisation show how its AI is run.
Why this one is hard to judge
A framework can be recited. Having actually taken an organisation through an audit is a different thing entirely.
What to ask for
Ask for a policy they wrote that a team actually changed its behaviour because of.
Ask how they decide which AI use cases need review and which do not.
Ask for an example where they said yes to a use case others were nervous about.
Ask what records they would want kept for every model decision, and why.
The mistake most hirers make
Hirers often choose someone who can write long policy documents but has never applied one to a real, awkward case. Good governance people can say yes to sensible ideas quickly, not just no to risky ones. A governance function that only slows things down will get quietly ignored.
What good looks like after 90 days
A simple, working process for deciding which AI projects need review. At least one use case approved faster because the process existed. A short record of decisions made, so nobody has to remember them from memory.
How we assess it
Against a rubric that is published in full, on evidence the practitioner supplies and a reviewer checks. Where something has not been verified, the profile says so.