Services
AI Governance, Risk & Audit
From AI strategy to AI audit: NIST AI RMF and ISO 42001 applied to the systems you actually run, with the legal layer handled next door.
Book a 15-min intro call
Led by
Gökhan Polat · Information & Technology Governance Expert
More than twenty years in enterprise risk, internal audit and information security; Paribu, SabancıDx, EY Türkiye. CISA, CRISC, CISM, CISSP, CIA; ISACA accredited trainer.
Every organisation now uses AI; few can say which systems, for what, with what data, under whose approval. That gap is where the risk sits: biased decisions nobody can explain, vendor models that change overnight, shadow tools carrying customer data, and a regulator, the EU AI Act, KVKK or a sector supervisor, asking for an inventory that does not exist.
We close the gap in the order it should be closed: strategy and investment case first, so AI is spent where it returns; then governance, an inventory, a risk classification, roles and a policy set aligned to NIST AI RMF and ISO 42001; then assurance, an audit programme that tests the controls. The legal classification under the EU AI Act and Turkish law is delivered together with our AI regulation practice, so the two never contradict each other.
Scope
What this service covers.
AI Strategy and Investment Analysis
Where AI pays off in your operation, what it costs including tokens, integration and people, and what it displaces. A business case the CFO can sign.
AI Governance Framework
System inventory, risk tiering, decision rights, policy set and an AI committee that meets, aligned to NIST AI RMF and ISO 42001.
AI Risk Management and Bias Mitigation
Risk assessment per system: data, model, use and human oversight. Bias testing methods chosen for the decision the system actually makes.
AI Audit and Assurance
An audit programme built on ISACA's AI audit approach: control objectives, test procedures and evidence for internal audit or an external reviewer.
Vendor and Model Risk
Due diligence on model providers and AI vendors, contractual controls and change monitoring, so a silent model update does not become your incident.
Board and Regulator Reporting
One-page AI risk reporting for the board and the file a regulator would ask for, kept current rather than assembled under pressure.
More services