Session Description:
Many organizations are responding to AI adoption by creating policies, risk registers, and governance committees. While these tools are useful, they are not enough on their own. AI risk changes quickly as models, data sources, integrations, workflows, and user behaviors evolve. For IT audit, security, compliance, and governance leaders, the challenge is no longer simply identifying AI risk. The challenge is operationalizing governance so that AI oversight becomes part of how systems are built, deployed, monitored, and improved.
This session will explore how organizations can move from static AI governance artifacts to practical governance workflows that support accountability, auditability, and risk-informed decision-making. The discussion will connect AI governance to familiar security and audit practices, including control ownership, incident management, change management, risk assessment, monitoring, and evidence collection. The session will also address how security and audit professionals can help their organizations avoid “paper governance” and instead build governance practices that are measurable, repeatable, and aligned to business outcomes.
Audience Takeaways:
- Understand why traditional risk registers and policy documents are not sufficient for managing AI risk over time.
- Learn how AI governance can be embedded into existing IT security, audit, compliance, and operational workflows.
- Identify practical control points across the AI lifecycle, including intake, development, deployment, monitoring, and incident response.
- Recognize the difference between governance theater and governance that produces usable evidence for oversight and audit readiness.
- Leave with a practical framework for asking better AI governance questions inside security and risk programs.