Evidence-Based AI Governance Assessment

The Failure of Self-Reported AI Risk Questionnaires

When internal audit or compliance teams send questionnaires asking, "Does your AI system store PII or access external APIs?", developers frequently respond based on their intended design rather than actual code reality.

In practice, developers import third-party libraries, configure logging handlers that output prompt transcripts, or equip agents with general-purpose shell tools for debugging. A valid assessment must inspect the codebase to verify what capabilities actually exist in the code.

The Assessment Methodology: 4-Stage Verification

A ComplyPRO AI Governance Assessment follows a rigorous, four-stage technical process:

• Stage 1: Repository Scope Parsing — Separates production application logic from test fixtures, infrastructure scripts, and documentation.
• Stage 2: AST Extraction — Identifies agent definitions, system prompts, tool decorators, LLM API calls, and external protocol connectors.
• Stage 3: Epistemic Gap Analysis — Compares discovered capabilities against authorized baselines to flag unauthorized database writes, unverified network egress, and missing human gates.
• Stage 4: Evidence & Dossier Generation — Compiles findings into an executive governance summary, 12-control scorecard, and RIPD/DPIA regulatory dossier.