Monforte General Services Division

A structured assessment of the organization’s existing AI governance arrangements, including leadership accountability, policies, AI inventory, risk and impact assessment, supplier oversight, workforce competence, operational controls, monitoring, and reporting.

The engagement compares existing arrangements and available evidence against an agreed baseline. That baseline may include ISO/IEC 42001, selected NIST AI Risk Management Framework outcomes, organizational policies, or relevant contractual requirements. ISO/IEC 42001 provides a management-system framework; the NIST framework is voluntary risk-management guidance rather than a certification standard.

Typical deliverables: Executive findings report, requirements-to-evidence gap register, prioritized improvement roadmap, and recommended ownership of corrective actions.

Service options: An initial governance diagnostic or a more detailed evidence-based assessment. Maturity observations are distinguished from findings against specific requirements.

Outsourced internal auditing of the organization’s AI management system, conducted on its behalf. ISO/IEC 42001 places internal auditing and the internal audit programme under clause 9.2.

The audit examines the management system against ISO/IEC 42001 and the organization’s own requirements, using document review, interviews, evidence sampling, and examination of actual practices. The scope can include governance processes, AI risk and impact assessments, applicable controls, competence arrangements, supplier management, and operational oversight.

Typical deliverables: Audit programme support, audit plan, evidence-based findings, nonconformity reports, management briefing, and agreed follow-up verification.

Service boundary: This is internal auditing of the AI management system—not merely an audit of the internal audit procedure, and not a certification audit.

A scoped assurance engagement examining a particular AI application, business process, governance arrangement, or set of controls. The assessment considers whether controls are suitably designed, implemented, and operating against agreed criteria.

Possible subjects include human oversight, approval authority, use restrictions, output verification, supplier controls, incident escalation, and the evidence supporting management’s representations about responsible AI use.

Typical deliverables: An assurance report identifying the subject matter, criteria, period covered, evidence examined, findings, conclusions, and limitations.

Service boundary: We accept independent assurance engagements only where independence can be established. It is not a blanket declaration that an AI system is “safe,” “ethical,” or legally compliant.

Facilitated workshops built around the organization’s actual activities, AI applications, affected stakeholders, and operating environment. These are working sessions—not simply presentations on AI terminology.

Participants examine realistic situations, identify governance gaps, clarify accountability, and develop practical actions.

Workshop settings and exercises include:

Healthcare and healthcare administration

Clinical decision support, patient communications, documentation, scheduling, revenue-cycle activities, purchasing, and administrative decision-making.

Manufacturing, aerospace, and industrial operations

Automated inspection, predictive maintenance, production planning, engineering support, supplier evaluation, and technical-record preparation.

Financial services and insurance

Customer communications, credit and eligibility decisions, fraud detection, claims handling, and oversight of AI-supported recommendations.

Education and training

Assessment integrity, tutoring, admissions support, research assistance, student information, instructional design, and administrative use.

Government and public services

Public-facing information, eligibility decisions, case handling, procurement, transparency, accountability, and meaningful human review.

Professional services and government contractors

Translation, document analysis, advisory work, research, confidentiality, evidence integrity, and client or contract restrictions.

Food, retail, and hospitality

Demand forecasting, supplier oversight, quality and traceability records, customer communications, and AI-supported operational decisions.

Typical deliverables: Workshop findings, an initial use-case and risk map, agreed governance priorities, responsibility assignments, and a practical action plan.

Audience options: Executive leadership; application owners and operational managers; assurance and control functions; or cross-functional teams.

These bespoke organizational workshops are distinct from the standardized courses being developed by the Edifice Training Foundation.

An evaluation of workforce capability beginning with Responsible AI Literacy as the organization-wide foundation, then examining the competence required for particular roles.

Assessment can cover understanding AI limitations, protecting sensitive information, verifying outputs, recognizing inappropriate uses, following organizational policy, exercising human judgment, and knowing when to escalate a concern.

The assessment combines knowledge assessment with scenarios, practical exercises, and examination of work practices. Self-reported confidence alone is not treated as evidence of competence.

The assessment connects assigned roles, responsibilities, and authorities under ISO/IEC 42001 clause 5.3 with the competence provisions under clause 7.2. NIST’s framework similarly connects defined responsibilities with training appropriate to people’s duties.

Typical deliverables: Workforce competence profile, role- or department-level gap analysis, prioritized development recommendations, and a reassessment plan.

Assessment populations: Executive accountability; application ownership and lifecycle management; enablement, control, and assurance; and workforce responsible use.

Practical assistance establishing or strengthening an AI governance framework and, where required, an AI management system aligned with ISO/IEC 42001.

The engagement defines decision rights, application ownership, approval processes, risk and impact assessment methods, competence responsibilities, supplier oversight, monitoring arrangements, and management reporting. It can incorporate the organization’s existing information-security, quality, privacy, and business-continuity arrangements rather than creating unnecessary parallel processes.

Integration with existing organizational processes and management structures is consistent with the approach described in ISO/IEC 42001.

Typical deliverables: Governance operating model, responsibility matrix, implementation roadmap, selected policies and procedures, control and evidence requirements, and certification-readiness action plan.

Service boundary: Implementation support and readiness review do not constitute certification.