Governance and Oversight: Building AI Risk In TPRM Foundation

What Needs to Change

If your organization's TPRM policies and procedures predate the widespread deployment of AI, and most do, they need to be updated to explicitly account for AI risk identification, assessment, and management.

The changes required will vary based on program size, regulatory environment, and current maturity. But at a minimum, the following elements should be addressed in governance documentation:

An updated Inherent Risk Assessment (IRA) that includes a specific question about whether a vendor uses or produces AI. Changes to due diligence questionnaire templates that include AI-specific questions at each risk tier. Updated policy language that defines what constitutes AI risk, what triggers an AI risk assessment, and who is responsible for conducting it. Training updates to ensure all TPRM staff understand how AI risk differs from traditional cybersecurity or operational risk, and how to evaluate it.

Testing Your Changes

After making updates to governance documentation, it's important to validate that the changes actually work in practice. Run test scenarios through your updated process using realistic vendor profiles, including vendors at different inherent risk levels, to confirm that the trigger logic, assessment workflows, and escalation processes function as designed.

Governance Is Not a One-Time Exercise

Given the pace of change in AI technology and regulation, AI-related governance documentation should be reviewed at least every six months, more frequently than the annual review cycle typical of most TPRM programs.

Coming up next: Pre-contract due diligence: asking the right AI questions before the ink dries.