> ## Content Index
> Fetch the complete content index at: https://www.aigl.blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# Generative AI Governance Framework
- URL: https://www.aigl.blog/generative-ai-governance-framework-2/
- Published: 2026-09-19T09:04:12.000Z
- Updated: 2026-09-19T09:04:12.000Z
- Description: A governance framework, sponsored by Connor Group, that divides generative AI governance into five domains and pairs named risk categories with control considerations, plus a four-step adoption approach and a five-stage risk assessment.
- Author: Jakub Szarmach
- Tags: Framework, AI Governance, Risk Management, Compliance & Audit, Technical Controls, Responsible AI, #aigl-library

## ⚡ Quick Summary

Sponsored by Connor Group and built with more than 1,000 reviewers, contributors, endorsers and sponsors, this framework sets out how organisations can harness generative AI (GenAI) while managing its risks. It was developed with GenAI specialists, internal and external auditors, regulators, audit committee members and C-suite executives, and is issued as version 1.0.

The framework divides GenAI governance into five domains: Strategic Alignment and Control Environment; Data and Compliance Management; Operational and Technology Management; Human, Ethical, and Social Considerations; and Transparency, Accountability, and Continuous Improvement. Each domain is described and given key objectives and named risk categories, from Strategic and Planning Risks to ESG Risks, Miscellaneous Risks and High Conceptual or Hypothetical Risks.

Adoption is set out in four steps: define GenAI objectives and goals, establish the framework scope for the organisation, complete a GenAI governance risk assessment, and execute the defined plan. The risk assessment is a five-stage process with a deliverable at each stage, from project kick-off and plan through benchmarking and prioritised risks to a final executive report. The main body lists control considerations for each risk category, and recommends use alongside COSO Internal Control – Integrated Framework, COSO Enterprise Risk Management and COBIT.

## 🧩 What’s Covered

The document moves from purpose and adoption steps to a full inventory of risks and control considerations.

- **Purpose and structure:** the introduction explains that GenAI creates new information and therefore new risks, and that staff may use it directly through products such as OpenAI's ChatGPT, unknowingly through embedded components such as Microsoft's Copilot, or through organisation-specific "Company GPT" solutions. Five domains structure the framework, and endorsements from COSO, IIA Germany, IIA Switzerland, Connor Group and Boomi are reproduced.
- **How to use the framework:** four steps, beginning with GenAI objectives aligned to corporate strategy, stakeholder expectations, regulatory requirements and budget, then scoping priority domains, key risks, impacted functions, exposed processes and stakeholders.
- **Five-stage risk assessment:** Planning & Preparation, Data Collection & Review, Risk Assessment & Prioritization, Recommendations & Roadmap and Report Results, each with a named deliverable; a maturity assessment and benchmarking survey sit at genai.global.
- **Strategic Alignment and Control Environment:** Strategic and Planning Risks and Control Environment Risks, with controls such as the GenAI Risk Management Framework, a strategic roadmap, stakeholder engagement, performance monitoring, a GenAI Governance Committee, a centralised GenAI Inventory and an Incident Response Plan.
- **Data and Compliance Management:** Data-Related Risks paired with data governance, access control, encryption and anonymisation, data lineage tools and audits of self-learning models; Legal and Regulatory Regime Risks paired with compliance monitoring, legal risk assessment, training on regulatory changes and a cross-border compliance strategy.
- **Operational and Technology Management:** Process Management Risks (standard operating procedures, performance monitoring, validation and testing, change management); Technology Evaluation and Selection Risks (technology assessment, vendor risk assessment, GenAI feature integration, post-implementation review); and Enhanced Operational and IT Security and Access Risks (IT security policies, data security training, incident response, access management, threat monitoring).
- **Human, Ethical, and Social Considerations:** Knowledge and Training, HR and Employment, Ethical and Bias, Reputation and Social, and ESG risk categories, with controls such as communicating how current a model's data is, reskilling programmes, bias mitigation, third-party ethical audits and "Human-in-the-Middle" review of sensitive AI-generated disclosures.
- **Transparency, Accountability, and Continuous Improvement:** Transparency, Traceability and Trust Risks, Continuing Evolution of the Technology Risks, Miscellaneous Risks and High Conceptual or Hypothetical Risks, with decision documentation and audit trails, traceability protocols, a Technology Evolution Monitoring Program and Innovation Labs.

## 💡 Why it matters?

The framework gives governance, audit and assurance functions a structured way to turn GenAI concerns into scoped work: five domains for assigning ownership, named risk categories for building risk registers, and control considerations that can be tested. Its four-step adoption path and five-stage risk assessment, with deliverables such as benchmarking results, prioritised unmitigated risks and an implementation roadmap, suit organisations starting a GenAI governance programme or auditing one. Because it addresses direct, embedded and organisation-specific GenAI use, it covers tools arriving through enterprise software rather than only standalone chat products. The document positions itself alongside COSO and COBIT rather than replacing them, and points to a maturity model and benchmarking survey at genai.global.

## ❓ What’s Missing

No publication or edition date appears anywhere in the extracted text, and the document names no specific law or regulation, so its compliance guidance stays general; the EU AI Act, NIST AI RMF and ISO/IEC 42001 are not mentioned. Control considerations are listed by name only, without procedures, owners, thresholds or evidence requirements. The framework states that it "is not designed to address all data and technology risks" and should be used with COSO Internal Control – Integrated Framework, COSO Enterprise Risk Management, COBIT and the Three Lines Model. The maturity model, benchmarking and survey are held at genai.global rather than included, and the high-conceptual risks are named without mitigation detail.

## 👥 Best For

Internal audit and assurance teams building a GenAI audit or maturity assessment; risk and compliance leads scoping GenAI risk registers and control frameworks; audit committees and boards needing domain-level oversight questions; and technology, vendor risk and IT security managers working on GenAI inventories, evaluation, training and incident response.

## 📄 Source Details

The document is titled *Generative AI Governance Framework* and is marked v1.0 throughout; the extraction covers all 21 pages. Named authors are Scott A. Emett, PhD, Marc Eulerich, PhD, CIA, Jason Pikoos and David A. Wood, PhD, with affiliations given in "About Our Authors". No publisher, publication year or reference number is printed; the final page carries "Copyright David A. Wood". Connor Group is listed as sponsor and contributor and Boomi as reviewer and contributor, with printed links to genai.global, connorgp.com and boomi.com. The Table of Contents page extracted no entries.