There are 10 control objectives here. Each one states what it asks for, the risk it addresses and how it is measured. It then says what each risk tier requires, what evidence proves it, and who may check that evidence. The Operating Model page explains the tiers.
ORG-01Governance bodies that decide
Set up governance bodies, such as a council, an architecture board and an ethics committee, that make timely decisions and see that they are carried out.
- Risk addressed
- Decisions not made or not enforced
- Key metric
- Time from request to decision
What each tier requires
- Tier 1 Exploratory
Experiments need no body's decision.
- Tier 2 Operational
Tier 2 decisions are delegated to named reviewers.
- Tier 3 Critical
Tier 3 decisions go to the architecture board or the ethics committee within a set time.
- Tier 4 Strategic
Tier 4 decisions go to the governance council, with the executive sponsor present.
- Evidence
- The bodies' charters, their minutes and decision times.
- Who may check it
- Internal audit and an outside auditor.
ORG-02A named owner for every agent
Give every agent a named person or organization that answers for it, with clear responsibilities.
- Risk addressed
- Gaps or overlaps in responsibility
- Key metric
- Share of agents with a named owner
What each tier requires
- Tier 1 Exploratory
The builder owns the experiment.
- Tier 2 Operational
A named owner is recorded in the catalog before release.
- Tier 3 Critical
The owner has a named deputy, and ownership is confirmed at each review date.
- Tier 4 Strategic
Ownership sits with a senior manager who reports on the agent to the governance council.
- Evidence
- The owner and deputy in the catalog, and the confirmations at review.
- Who may check it
- Internal audit, an outside auditor and a partner.
ORG-03Who decides, acts and is informed
Write down, for each governance activity, who decides, who acts, who is consulted and who is informed.
- Risk addressed
- Confusion over who decides
- Key metric
- Share of governance activities with assigned roles
What each tier requires
- Tier 1 Exploratory
The builder decides and acts for the experiment.
- Tier 2 Operational
Roles are written down for release and incident decisions.
- Tier 3 Critical
Roles are written down for every activity on this site that applies to the agent.
- Tier 4 Strategic
Roles are reviewed each year by the governance council.
- Evidence
- The responsibility matrix and its review date.
- Who may check it
- Internal audit.
Train executives in agent governance, so that their decisions on strategy rest on understanding.
- Risk addressed
- Leaders deciding without understanding
- Key metric
- Share of executives trained
What each tier requires
- Tier 1 Exploratory
No training is required for an experiment.
- Tier 2 Operational
Sponsors of Tier 2 agents complete the introduction.
- Tier 3 Critical
Sponsors of Tier 3 agents complete the full course.
- Tier 4 Strategic
Members of the governance council complete the full course and a yearly refresher.
- Evidence
- Training records.
- Who may check it
- Internal audit.
Train the people who build agents in secure, compliant development practice.
- Risk addressed
- Insecure or non-compliant building
- Key metric
- Share of builders trained
What each tier requires
- Tier 1 Exploratory
Builders read the sandbox rules.
- Tier 2 Operational
Builders complete the development standards course.
- Tier 3 Critical
Builders of Tier 3 agents complete the security course.
- Tier 4 Strategic
Builders of Tier 4 agents are certified and refresh their training each year.
- Evidence
- Training and certification records.
- Who may check it
- Internal audit.
Train the people who use agents in proper use, so that agents are neither misused nor wasted.
- Risk addressed
- Misuse or little use of agents
- Key metric
- Share of users trained
What each tier requires
- Tier 1 Exploratory
No training is required for an experiment.
- Tier 2 Operational
Users get a short guide before first use.
- Tier 3 Critical
Users of Tier 3 agents complete training on what the agent may and may not do.
- Tier 4 Strategic
Users who approve acts for a Tier 4 agent complete training on what they are approving.
- Evidence
- Training records and the guides issued.
- Who may check it
- Internal audit.
ORG-07Liaisons in the business
Keep liaisons between governance and each business unit, so that governance stays in step with the work.
- Risk addressed
- Business units out of touch with governance
- Key metric
- Business unit satisfaction score
What each tier requires
- Tier 1 Exploratory
No liaison is required for an experiment.
- Tier 2 Operational
Each business unit with production agents has a named liaison.
- Tier 3 Critical
Liaisons meet governance each month.
- Tier 4 Strategic
Liaisons report on their unit's agents to the governance council.
- Evidence
- The list of liaisons and meeting records.
- Who may check it
- Internal audit.
Manage the change governance brings to people's work, so that it is adopted rather than worked around.
- Risk addressed
- Governance that people avoid
- Key metric
- Governance adoption rate
What each tier requires
- Tier 1 Exploratory
No requirement applies to an experiment.
- Tier 2 Operational
New governance steps are announced with guidance.
- Tier 3 Critical
New governance steps are piloted and adjusted before they become mandatory.
- Tier 4 Strategic
Adoption is measured and reported to the governance council.
- Evidence
- Change plans and adoption measurements.
- Who may check it
- Internal audit.
Tell the people affected what governance requires of them, in plain language.
- Risk addressed
- People who do not know the rules
- Key metric
- Awareness survey score
What each tier requires
- Tier 1 Exploratory
The sandbox rules are published.
- Tier 2 Operational
Governance requirements are published where builders and owners work.
- Tier 3 Critical
Changes to requirements are sent to affected owners before they take effect.
- Tier 4 Strategic
Awareness is surveyed each year.
- Evidence
- Published requirements and survey results.
- Who may check it
- Internal audit.
ORG-10Feedback on governance
Collect feedback on governance itself from the people it affects, and act on it.
- Risk addressed
- Governance that does not improve
- Key metric
- Feedback received and acted on
What each tier requires
- Tier 1 Exploratory
Builders can send feedback on the sandbox rules.
- Tier 2 Operational
Feedback is collected after each review.
- Tier 3 Critical
Feedback is tracked to an action or a reason for no action.
- Tier 4 Strategic
Feedback trends feed the yearly framework review in Continuous improvement.
- Evidence
- The feedback log and actions taken.
- Who may check it
- Internal audit.