Page 362 - CyberSecurityEssentialsEnglish

and require evidence before scaling anything.
• Mistake to avoid: Starting with a procurement decision, and leaving informal use
unmapped because it was never approved.

8.2 Governance, Management, Compliance, and Audit Are Not Synonyms
◆ Key idea: five large words that are not synonyms.
Governance decides and sets the risk appetite. Management delivers. Compliance
evidences the rules. Assurance tests whether it works. Internal audit checks the claim
independently. Using one word for all five leaves the work without an owner.

Institutional work weakens when large words are used with one meaning. A technology team
may think governance means security settings, a legal team may see it as compliance with
regulation, a manager may see it as a committee approval, and a user may see it as training.

All of these matter, but they are parts of a wider system.

AI governance sets the direction, the authority, the risk appetite, and the accountability. AI
management turns that direction into processes, resources, and roles. Risk management

identifies what could happen, how likely it is, what its impact would be, and which controls
are appropriate. Compliance demonstrates adherence to laws, contracts, and policies.
Assurance gathers the evidence that gives stakeholders reasonable confidence that a system
meets defined requirements. Internal audit checks independently whether governance and

controls actually work. And ethics asks a deeper question: is this use fair, acceptable, and
respectful of people, even where no explicit legal text applies?

361