Designing an AI Governance Program: A Control-Based Model for Risk and Compliance

Abstract

As organizations increasingly use artificial intelligence (AI) for organizational decision-making, cybersecurity, and compliance, the limits of principle-based AI governance have become clear. Frameworks have revealed limitations in principle-oriented AI governance approaches. While frameworks such as the NIST AI Risk Management Framework provide broad, high-level guidance, many organizations still lack practical, auditable mechanisms to operationalize AI governance within their enterprise governance, risk, and compliance (GRC) programs. This research introduces a control-based AI governance model that embeds AI oversight into existing internal controls and risk management structures. The model organizes governance through administrative, technical, and operational controls, including integrating AI risk assessment, compliance mapping, and continuous monitoring throughout the AI lifecycle. Governance controls are mapped to the NIST AI Risk Management Framework and NIST Special Publication 800-53 to demonstrate compatibility and traceability, without requiring demonstration of operational compatibility or mandating specific technologies. This study presents a practical, technology-neutral approach to help organizations implement AI governance and align it with their GRC efforts, promoting an agnostic approach that advances the operationalization of AI governance and its integration with enterprise GRC practices.