An IS auditor is reviewing the company ' s AI procedure.

AI governance requires a " Tiered Approach " based on risk. The most critical gap is the lack of " Mandatory Assessments " (such as Bias or Privacy Impact Assessments) for high-impact or critical systems. These assessments are the " Control Gates " that prevent the deployment of unsafe or unethical AI. While privacy principles (Option C) and oversight (Option D) are essential components, they are typically the outcome of the risk assessment process. Without a mandate to assess systems before they go live, the organization has no way to ensure that any of its other AI controls are being applied where they are most needed.