What a Real AI Governance Assessment Actually Covers

The Problem With Simple Checklists

Most AI governance assessments ask one question in seven different ways: do you have this? A policy, a committee, a training program. The answer is almost always yes. Firms have documents. Firms have committees. That is not the same as firms having governance.

The FCG AI Readiness Diagnostic was designed to ask a different question: can you prove it? The full assessment and the Lite version are structured around six domains, each mapped to specific regulatory standards, and each covering the distinct coverage areas where AI risk actually accumulates — not where it is assumed to be controlled.

Six Domains, Fourteen Coverage Areas

The diagnostic is built on six domains weighted by risk and regulatory exposure. Within those six domains, the questions address fourteen distinct coverage areas. That specificity is deliberate.

Strategic Alignment and ROI covers Business Value and Finance — not just whether AI is on the strategic agenda, but whether finance is in the governance process, whether ROI is measured before funding is committed, and whether pilots that fail to perform are actually stopped.

AI Governance and Risk Management — the highest-weighted domain at 30% — covers Risk, Regulatory, Governance, Operations, and Model. This is the domain where most regulated firms have the biggest gap between what their policies say and what their AI use cases actually do. It is also the domain that SEC and FINRA examination teams are focused on.

Data Governance covers Data Governance directly: data inventory, stewardship, quality standards for AI, and the ability to produce an inventory of AI systems in production within 48 hours. If you cannot answer that last question on demand, you cannot govern what you have deployed.

AI Operations covers Cyber, Operations, Governance, and Risk. Shadow AI detection, acceptable use policies, MFA for AI systems, and whether the ERM framework includes AI incidents. These are not aspirational controls — they are the minimum floor for safe AI use in client-facing financial services.

Responsible AI and Accountability covers Governance, Operations, Change and Communication, and Risk. Explainability, no-go zones, vendor agreements, incident root cause analysis. This is where the difference between a firm that has responsible AI principles and a firm that has operationalized them becomes visible.

AI Adoption and Workforce Readiness covers AI Fluency, Change and Communication, Adoption, and Operations. Leadership vision, psychological safety, training programs, adoption measurement. Culture is not soft here — it is the layer where governance either holds or collapses under real-world pressure.

Why the Coverage Areas Matter

The coverage area structure allows the diagnostic to identify patterns that single-domain scores obscure. A firm that scores well on Strategic Alignment but poorly on Regulatory coverage in AI Governance has a funded strategy operating without the compliance infrastructure to sustain it. A firm with strong Cyber controls but no AI Acceptable Use Policy has a perimeter with an open door in the middle.

Those patterns — not the individual scores — are what FCG uses to prioritize. The goal is not a comprehensive list of everything that needs attention. It is a defensible answer to the question: what is the highest-leverage place to start?

Where to Start

The Lite Diagnostic covers all six domains in about six minutes. It is designed to surface the critical gaps and red flags most likely to create regulatory exposure or operational failure. If you want to know where your firm stands before an examiner does, that is the place to begin.

[Take the Lite Assessment](/diagnostic-lite)