GOV Governance, Accountability and Assurance Direction

The governing body shall approve an assurance governance charter that names the in-scope Capability Instances, the accountable executive, the assurance programme lead, the decision authority and the oversight committee; states the decision questions served and the intended users of conclusions; defines the programme model (self-assessment, co-sourced, second-party or independent provider); and states that AIDCF conclusions do not replace engineering, statutory or safety approval and are not certification. The accountable executive shall review the charter at no more than the governance charter review interval and after any change of ownership, organisation or programme model, and shall record the outcome of each review.

Evidence required: E1 Documentary and declarative; E6 Human and experiential. Optional: E5. Operating states: NORMAL.

The accountable executive shall maintain a decision-rights matrix that, for each decision class affecting an in-scope Capability Instance, names the role holding the decision right, its financial or risk limits, the escalation route, the delegation and sub-delegation rules, and the emergency decision rights that apply when the normal holder is unavailable. The assurance programme lead shall ensure that workflow and approval systems enforce the matrix, and that every decision in the sample population was taken by a role holding the right at the time it was taken.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational. Optional: E6. Operating states: NORMAL, EMERGENCY, RECOVERY.

The governing body shall constitute an assurance oversight committee with written terms of reference, quorum and membership that includes at least one member independent of the operating line. The committee chair shall ensure that the committee meets at no more than the oversight meeting interval, receives at every meeting the current gate register, UNKNOWN register (US3 and above), findings register and overdue action list for each in-scope Capability Instance, records challenge and decisions in minutes, and tracks its own actions to closure.

Evidence required: E1 Documentary and declarative; E3 Operational and observational. Optional: E6. Operating states: NORMAL.

The assurance programme lead shall appoint a methodology owner who shall maintain a controlled methodology baseline listing the AIDCF artifact versions (including AIDCF-007A, AIDCF-008, AIDCF-009 and AIDCF-010), the capability profile, scoring version and every approved local tailoring, each with rationale and approval. The methodology owner shall ensure that assessment tools and templates are configured to that baseline and that every report declares the baseline version actually used.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E7. Operating states: NORMAL.

The accountable executive shall maintain a RACI that assigns, for each in-scope process (capability management, assurance, evidence, change, incident, recovery, provider management), exactly one Accountable role and the Responsible, Consulted and Informed roles across owner, operator, tenants and providers. The assurance programme lead shall reconcile the RACI to current appointments and to contractual responsibility clauses at least at the RACI reconciliation interval and after every organisational or contract change.

Evidence required: E1 Documentary and declarative; E6 Human and experiential. Optional: E2, E7. Operating states: NORMAL, MAINTENANCE, EMERGENCY.

The capability owner shall ensure that each Required Function and each material Dependency linked to an in-scope Service Outcome has exactly one accountable owner recorded in the assurance graph, that the owner holds the decision right to commit resources and to authorise degraded-state actions for that function, and that cross-organisational functions (for example utility supply, facility water, network carriers, cloud control planes) have both an internal accountable owner and a named counterparty contact. The assurance programme lead shall reconcile function ownership to the RACI and decision-rights matrix after every change to the Required Function or Dependency set.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E7 Derived and analytical. Optional: E6. Operating states: NORMAL, DEGRADED, EMERGENCY.

The accountable executive shall define risk-acceptance authority levels linked to the risk appetite (MCF-GOV-014) and impact tolerances (MCF-CAP-010). Each risk owner shall record every risk acceptance with the risk description, affected Service Outcomes and gates, residual consequence, compensating measures, acceptor, expiry date and review date. The assurance programme lead shall ensure that no acceptance of a risk that would cause a CRITICAL control or gate to be relied upon is recorded without the decision authority's approval, and that expired acceptances revert to open Findings.

Evidence required: E1 Documentary and declarative; E3 Operational and observational. Optional: E6. Operating states: NORMAL, DEGRADED, MAINTENANCE.

The assurance programme lead shall appoint an evidence lead who shall assign a custodian role to each evidence repository and each Evidence Package, define who may read, add, alter, export, redact or destroy evidence, and ensure that every custody event defined in AIDCF-008 (transfer, access, export, alteration, redaction, retention action) is recorded. The evidence lead shall review custody records for Evidence Packages supporting gate results before each Assurance Decision is issued.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational. Optional: E7. Operating states: NORMAL.

The policy owner shall maintain a policy hierarchy register that identifies, for each in-scope document, its level (policy, standard, procedure, runbook), parent document, owner, scope (sites, halls, clusters, systems) and approval status. The policy owner shall ensure that no procedure or runbook relies on a superseded or absent parent, and that identified contradictions between documents are recorded and resolved by the owner of the higher document.

Evidence required: E1 Documentary and declarative. Optional: E6, E7. Operating states: NORMAL.

The chief engineer for the capability shall declare a technical standards baseline listing each external standard family, internal engineering standard and OEM specification applied to in-scope infrastructure, with edition or version, scope of application and any declared deviation. The chief engineer shall ensure that design, commissioning and change records cite the baseline edition applied, and that adoption of a new edition is controlled through change control with impact assessment.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E5, E6. Operating states: NORMAL.

The policy owner shall operate an exception process in which each exception records the requirement deviated from, affected Capability Instances, Service Outcomes, controls and gates, the risk assessment, compensating measures, approver, expiry and closure criteria. Exceptions affecting a gate-critical control shall be approved by the decision authority. The assurance programme lead shall ensure that the exception register is an input to every assessment and that expired exceptions are escalated to the oversight committee.

Evidence required: E1 Documentary and declarative; E3 Operational and observational. Optional: E2, E7. Operating states: NORMAL, MAINTENANCE, DEGRADED.

The policy owner shall define document lifecycle states, review intervals by document level and approval roles, and the document control administrator shall ensure that only approved current versions are published at points of use (control room, plant rooms, runbook systems, assessor workpaper templates), that superseded versions are withdrawn from points of use while retained in history, and that review dates are tracked.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational. Optional: E6. Operating states: NORMAL, EMERGENCY.

The assurance programme lead shall prepare, and the oversight committee shall approve, an assurance plan for each planning period that, for each in-scope Capability Instance, states the decision questions, target Assurance Level (AL0-AL6), claim types and gates to be evaluated, assessment type, provider model, resourcing and schedule, and the rationale linking depth to criticality (MCF-CAP-009) and planned change (MCF-CAP-023). The programme lead shall record and approve deviations from the plan.

Evidence required: E1 Documentary and declarative; E7 Derived and analytical. Optional: E6. Operating states: NORMAL.

The governing body shall approve a risk appetite statement covering service continuity, safety, data integrity and dependency concentration for the AI capability. The accountable executive shall translate it into measurable appetite limits per Service Outcome class and shall demonstrate that impact tolerances (MCF-CAP-010), risk-acceptance authority (MCF-GOV-007) and decision condition rules reference those limits.

Evidence required: E1 Documentary and declarative. Optional: E6, E7. Operating states: NORMAL.

The decision authority shall maintain a gate register for each in-scope Capability Instance recording, for every gate CG-01 to CG-15, applicability, CRITICAL control results, evidence sufficiency against the gate floor, Gate Result, controlling effect on the decision and closure criteria. The assurance programme lead shall ensure that Gate Results are computed by the roll-up rule of AIDCF-010, that no Gate Result is changed except by reassessment, and that APPROVED_NA is granted only by the decision authority with a boundary rationale.

Evidence required: E1 Documentary and declarative; E3 Operational and observational; E7 Derived and analytical. Optional: E5. Operating states: NORMAL.

The assurance programme lead shall ensure that every Assurance Decision supporting a material decision question is subject, before issue, to independent review by a reviewer who did not prepare or perform the assessment, has no conflict under MCF-GOV-021 and holds the competence defined in MCF-GOV-023. The independent reviewer shall record challenges, responses and dispositions, and shall have authority to withhold their concurrence. The programme lead shall periodically test review effectiveness by reperformance or by seeded-defect review.

Evidence required: E1 Documentary and declarative; E3 Operational and observational; E4 Validation and test. Optional: E5, E6. Operating states: NORMAL.

The capability owner shall maintain a stakeholder obligation register identifying each obligation that constrains an in-scope Capability Instance (for example contracted availability, data residency, grid connection conditions, water abstraction limits, noise and emission permits, insurance warranties), its source document, owner and the Service Outcome, tolerance or operating constraint into which it is translated.

Evidence required: E1 Documentary and declarative. Optional: E6, E7. Operating states: NORMAL.

The compliance owner shall operate a regulatory monitoring process covering each jurisdiction in which in-scope infrastructure is located, record each relevant change with an impact assessment against Service Outcomes, controls and obligations, assign actions, and report material changes to the oversight committee. Changes affecting life safety, hazardous energy or reporting duties shall be escalated within the regulatory escalation time.

Evidence required: E1 Documentary and declarative; E3 Operational and observational. Optional: E5, E6. Operating states: NORMAL.

The commercial owner shall ensure that each customer or tenant commitment concerning availability, performance, integrity, capacity or recovery of an in-scope Capability Instance is recorded with its metric definition, measurement method and exclusions, and is reconciled by the capability owner to the approved Service Outcomes and tolerances before signature and after every change to either. Commitments exceeding approved Service Outcomes shall be approved by the accountable executive with a recorded risk acceptance.

Evidence required: E1 Documentary and declarative; E7 Derived and analytical. Optional: E3. Operating states: NORMAL.

The decision authority shall approve every external communication that conveys an AIDCF assurance conclusion before release. The communications owner shall ensure that each such communication uses the controlled decision language of AIDCF-012, identifies the Capability Instance, scope, period and limitations, includes every gate FAIL and US4/US5 UNKNOWN relevant to the audience, contains no prohibited claim (certification, accreditation, universal safety or resilience), and is withdrawn or corrected when the underlying decision is suspended, withdrawn or superseded.

Evidence required: E1 Documentary and declarative; E3 Operational and observational. Optional: E7. Operating states: NORMAL.

The assurance programme lead shall require every assessor, reviewer, specialist and decision authority to declare interests before assignment and on any change, shall evaluate each declared or identified threat (self-review, self-interest, familiarity, advocacy, intimidation), and shall apply and record a safeguard or exclusion. The programme lead shall prohibit outcome-contingent fees for assurance conclusions and shall exclude from assessment any person who designed, built, operates or advised on the control under assessment within the cooling-off period.

Evidence required: E1 Documentary and declarative; E3 Operational and observational. Optional: E6. Operating states: NORMAL.

The governing body shall define the independence level required for each class of intended reliance (management use, customer reliance, regulatory or financing reliance). The assurance programme lead shall ensure that for each engagement the assessment team's reporting line, provider model and separation of preparation, performance, review and decision meet the required level, and that the actual independence level is stated in the Assurance Statement.

Evidence required: E1 Documentary and declarative; E3 Operational and observational. Optional: E6. Operating states: NORMAL.

The assurance programme lead shall maintain a competence framework for each role and domain (aligned to AIDCF-011 Part IX), a register recording each person's evidenced competence and its currency, and an assignment check confirming that every engagement assignment matches recorded competence. Where competence is not available internally, the lead shall engage a specialist under recorded reliance with scope and responsibility.

Evidence required: E1 Documentary and declarative; E3 Operational and observational; E6 Human and experiential. Optional: E5. Operating states: NORMAL.

The decision authority shall maintain an appeal and challenge procedure that defines who may challenge, grounds, time limits, the impartial reviewer, evidence required, and possible outcomes. The decision authority shall ensure that every challenge is logged, decided by a person not involved in the challenged result, and that the original result, the challenge and the outcome are all preserved, with any change made only by reassessment.

Evidence required: E1 Documentary and declarative; E3 Operational and observational. Optional: E6. Operating states: NORMAL.