.svg)
AI Governance and Compliance Oversight
Cherry Hill Advisory helps organizations build practical governance, controls, and oversight for AI adoption. We work with internal audit, risk, and compliance leaders to assess AI risk, strengthen governance, and support responsible use across the enterprise.
AI adoption is accelerating faster than governance and compliance
Many organizations are already using AI tools across departments, vendors, and workflows. The challenge is that oversight, accountability, and compliance often lag behind implementation.
- Policies may exist, but enforcement and monitoring are inconsistent
- Documentation around AI use, inputs, and decision impact is often limited
- Internal audit teams are being asked to assess AI risk without clear methodology
- Vendor AI capabilities can introduce new third-party risk exposure
A Governance-First Approach to AI Oversight
Cherry Hill Advisory supports internal audit, risk, compliance, and executive stakeholders in building AI governance programs that are practical, scalable, and defensible.
.svg)
AI Governance Framework Development
Build governance structures that define how AI tools are approved, used, monitored, and governed across the organization.
.svg)
AI Compliance Readiness & Risk Alignment
Assess AI governance against internal expectations and evolving external requirements, including emerging U.S. and international frameworks.
.svg)
AI Risk Assessments
Evaluate AI-related risks such as model governance, data integrity, bias, cybersecurity exposure, operational risk, and reputational impact.
.svg)
Control Design & Monitoring
Design and evaluate controls for AI oversight, including documentation standards, approval workflows, monitoring expectations, and accountability.
.svg)
Internal Audit Enablement
Provide internal audit teams with practical frameworks and methodology for evaluating AI governance in a structured and repeatable way.
.svg)
Third-Party AI Risk Oversight
Assess vendor AI use and the risks it introduces, including governance expectations, control gaps, and compliance implications.
The service behind this page
Get your AI house in order, with Calibr
Calibr is how our team assesses an AI governance program and builds what is missing. It is a service, not software you adopt. We run it, score the program against our Trust operational methodology, and hand you findings a committee can act on.
What the assessment covers
Inventory of the AI tools in use across the organization
Adversary scanning and configuration reviews of the major LLMs your teams use
MCP server audits and AI skill reviews across your connected agent stack
Program scored against our proprietary Trust operational methodology
Governance assessment, findings, vendor risk tiers, and a ready-to-run work program
How Cherry Hill Helps Internal Audit Govern AI
Internal audit teams need practical ways to evaluate AI risk, establish governance oversight, and audit AI systems as adoption expands across the organization. Cherry Hill Advisory provides the structure, methodology, and practitioner expertise to make that possible.
What you're used to
- AI tools adopted across the organization without a clear governance framework
- Limited visibility into where AI is being used or how decisions are made
- Internal audit teams asked to assess AI risk without a defined audit methodology
- Algorithm bias and model risks not formally evaluated
- Uncertainty around how AI can be used safely within the audit function
- AI governance programs that are not aligned with emerging regulatory expectations
- Structured AI risk assessments and governance frameworks for internal audit oversight
- Algorithm bias and control gap analysis to identify emerging AI risks
- AI use case inventories with defined audit approaches for evaluating AI systems
- Governance aligned with EU AI Act and evolving U.S. regulatory frameworks
- Guidance on leveraging AI to enhance internal audit efficiency
- Practitioner-led methodology for auditing AI systems
Cherry Hill Advisory Is Leading the Conversation on AI
Implementing AI Governance: A Practical Guide for Internal Audit, Risk, and Compliance Teams
AI Governance Questions, Answered
What does internal audit do about AI risk?
Internal audit reviews how the organization governs, monitors, and controls AI deployments, then reports findings to the audit committee. The scope typically includes the AI governance framework, model risk management practices, training data controls, ongoing monitoring, and the controls that prevent unintended use. The reference frameworks most audit committees expect to see are NIST AI RMF and, for European exposure, the EU AI Act, and Cherry Hill's AI governance work ties the audit findings back to both.
How do we audit a machine learning model?
A machine learning audit reviews the model's training data, design choices, ongoing performance monitoring, drift detection, retraining cadence, and the controls around access and change management. The audit also tests whether the use case sits inside the organization's AI risk policy. Auditing the model in isolation without auditing the controls around it is the most common mistake, which is why Cherry Hill scopes ML audits to cover both.
Does the EU AI Act apply to US companies?
The EU AI Act applies to US companies if their AI systems are placed on the EU market, used by parties in the EU, or produce output used in the EU, regardless of where the company is headquartered. High-risk AI systems carry the heaviest compliance obligations and the longest preparation runway. Most US companies first realize they have EU exposure when a customer in the EU asks for the documentation, which is the point at which Cherry Hill's AI governance practice typically gets the call.
Build AI governance Before It Becomes a Compliance Issue
If your organization is adopting AI tools and needs clear governance, oversight,
and compliance alignment, we can help.
