AI Assurance Framework
Executive Summary
Key Takeaways
- ✓ Ongoing assurance over AI-assisted finance work depends on connecting quality assurance sampling, internal control testing, and periodic model re-validation into a single assurance cycle, rather than running the three as disconnected activities.
- ✓ Quality assurance sampling catches output-level accuracy and hallucination issues; control testing catches whether the process controls are actually operating; re-validation catches embedded AI model drift, each activity well positioned to catch what the others are not designed to.
- ✓ Running these three activities in isolation, with separate reporting lines and no shared findings review, leaves gaps each activity is individually well positioned to help close for the others.
- ✓ A combined assurance cycle reports findings from all three activities to a single point, typically the AI centre of excellence or an equivalent governance body, so patterns visible only across activities can actually be identified.
- ✓ This guide functions as the assurance-focused capstone connecting the individual governance, quality assurance, and control practices addressed throughout this domain into a single operating cycle.
Objective¶
This guide sets out a combined assurance cycle connecting the individual assurance activities addressed across this domain, within AI Financial Modelling & Artificial Intelligence in Finance.
Three Activities, Each Catching What the Others Do Not¶
Quality assurance sampling, addressed in AI Quality Assurance, catches output-level accuracy issues and hallucination patterns by independently sampling AI-assisted output over time.
Internal control testing, addressed in AI Financial Controls, catches whether the documented process controls, verification checkpoints, audit trail capture, are actually operating as designed.
Periodic model re-validation, addressed in AI Financial Model Validation and AI Model Governance, catches embedded AI model drift through empirical accuracy re-measurement.
Each activity is well positioned to catch a specific class of issue the other two are not designed to catch: sampling catches output problems even where the process controls appear to be operating correctly; control testing catches process failures even where individual sampled outputs happen to look accurate; and re-validation catches model-level drift even where both process and individual output sampling look fine.
Why Isolation Leaves Gaps¶
Running these three activities with separate reporting lines and no shared findings review means a pattern visible only across activities, declining output accuracy in QA sampling coinciding with a control testing exception in the same period, for instance, would not be identified, since no single reviewer sees both findings together. Each activity in isolation might appear to show an acceptable result while the combined picture reveals an emerging problem.
Structuring the Combined Assurance Cycle¶
Findings from all three activities should report to a single point, typically the AI centre of excellence described in AI Centre of Excellence or an equivalent governance body, on a shared, aligned schedule. This central point reviews findings from all three activities together, specifically looking for patterns that span more than one, and feeds consolidated findings into the AI risk register addressed in AI Risk Management.
Common Construction Pitfalls¶
Running the three activities on unaligned schedules. Misaligned timing makes it difficult to compare findings across activities for the same period, reducing the ability to spot a cross-activity pattern.
Reporting each activity's findings to a different owner with no consolidation. Without a single point reviewing all three activities together, a pattern spanning more than one activity has no natural place to be identified.
Treating the three activities as redundant with each other. Each activity catches a genuinely distinct class of issue; consolidating findings does not mean any one activity can be dropped in favour of the others.
Recommended Practices¶
- Align the schedules for QA sampling, control testing, and model re-validation so findings can be compared for the same period.
- Report findings from all three activities to a single consolidating point, typically the AI centre of excellence.
- Feed consolidated, cross-activity findings into the AI risk register for ongoing tracking.
Continue Reading¶
Related Pillars¶
Related Technical Guides¶
How OXXON tests thisRun a free structural check with FMAE
Frequently Asked Questions
What three activities does an AI assurance framework connect?
Quality assurance sampling of AI output accuracy, internal control testing of process controls, and periodic re-validation of embedded AI models, connected into a single assurance cycle rather than run as three separate, disconnected activities.
Why is each activity individually insufficient on its own?
Quality assurance sampling catches output-level accuracy and hallucination issues but not whether the surrounding process controls are operating; control testing catches control operation but not embedded model drift; re-validation catches model drift but not process-level control failures, each activity well positioned to catch what the others are not designed to.
What is lost by running these activities in isolation?
Gaps each activity is individually well positioned to help close for the others, since a pattern visible only by comparing findings across activities, for example declining output accuracy coinciding with a control testing exception, would not be identified if the three activities report to different places with no shared findings review.
How should a combined assurance cycle be structured?
With findings from quality assurance sampling, control testing, and model re-validation all reported to a single point, typically the AI centre of excellence or an equivalent governance body, so cross-activity patterns can actually be identified and acted upon.
Related Articles
AI Financial Modelling & Artificial Intelligence in Finance
AI financial modelling is the application of machine learning and generative AI techniques within the financial modelling process itself, driver identification, construction assistance, scenario generation, and narrative drafting, while artificial intelligence in finance is the broader application of those same technique categories across the finance function generally. This page is the hub for the Knowledge Centre's AI financial modelling content: the foundational distinction between machine learning, natural language processing, and generative AI; how AI accelerates modelling construction without replacing the auditable calculation layer beneath it; a staged framework for adopting AI reliably; enterprise applications across FP&A, forecasting, valuation, and investment analysis; governance and risk practice; and the institutional best practice synthesis this domain builds toward.
AI Quality Assurance
A quality assurance programme for AI-assisted finance work applies periodic, sampling-based review of AI-assisted output independent of the task-level verification checkpoints, closing the gap those checkpoints alone can leave. This guide sets out how to structure a QA sampling programme, how it connects to the KPI set already used to measure AI adoption, and how QA findings should feed back into governance, checkpoint design, and adoption stage decisions.
AI Financial Controls
AI-specific verification checkpoints, source verification, number tie-outs, formula review, should be integrated into a finance function's existing internal controls framework as testable controls, not treated as a separate, informal practice sitting outside standard control testing. This guide sets out how to document an AI-assisted process's checkpoints as formal controls, how they should be tested, and why integrating them into existing controls testing produces stronger assurance than a parallel, AI-specific control process.
AI Financial Model Validation
Validating an AI-assisted financial model requires separating two genuinely different tasks: validating the model's own structured, auditable calculation logic, using the same methodology applied to any financial model, and validating any embedded AI-derived assumption or prediction, using empirical accuracy measurement against held-out data. This guide sets out both validation tracks and why conflating them produces an incomplete validation of either.
AI Centre of Excellence
A finance function's AI centre of excellence should function as an operating capability, not a nominal committee: maintaining technique-task matching guidance as new applications emerge, running the independent quality assurance sampling programme, and owning the AI risk register on behalf of the organisation. This guide sets out these responsibilities concretely and the signs that distinguish a functioning centre of excellence from a name on an org chart with no operational activity behind it.