Submit your papersSubmit Now
For Enquiries: [email protected]
IIARD LogoIIARD

Conceptualizing Enterprise AI Governance Functions as Institutional Standards for Auditable and Defensible Risk Management

Michael Ominyi, Cyril Chimelie Anichukwueze, Ngozi Samuel Uzougbo

Abstract

As enterprises move artificial intelligence from pilot projects into core business processes, the informal governance arrangements that sufficed during experimentation are proving inadequate for regulatory, contractual, and reputational scrutiny. This paper argues that enterprise AI governance functions, the organizational structures and processes through which firms decide, monitor, and account for AI use, are best understood not as internal management preferences but as institutional standards: patterned, transferable practices that gain legitimacy through convergence with recognized external frameworks. Drawing on institutional theory and the current landscape of AI governance instruments, including ISO/IEC 42001, the NIST AI Risk Management Framework, and the phased obligations of the EU AI Act, the paper develops a conceptual model in which governance functions are organized around five interlocking capabilities: direction setting, risk classification, measurement and testing, control and response, and independent assurance. The model is examined through two properties increasingly demanded by regulators, courts, and boards: auditability, the capacity to reconstruct and evidence a decision after the fact, and defensibility, the capacity to justify that decision against a documented standard of care. The paper concludes that treating governance functions as institutional standards, rather than bespoke internal controls, offers enterprises a more durable basis for managing AI risk amid regulatory uncertainty, including recent revisions to the EU AI Act's high-risk implementation timeline.

Keywords

AI governanceinstitutional theoryauditabilitydefensibilityISO 42001NIST AI RMFEU AI Actenterprise risk managementthree lines model

References

Adegbite, M. P., Adebayo, A., & Ahmed, M. O. (2022). A security architecture model for IT and OT convergence in regulated energy networks: Design principles and governance alignment. International Journal of Computer Science and Mathematical Theory, 8(2), 81 to 132. https://doi.org/10.56201/ijcsmt.v8.no2.2022.pg81.132 Adegbite, M. P., Adebayo, A., & Ahmed, M. O. (2024). An AI driven security operations architecture for utility sector SOCs: Integrating threat intelligence, behavioral analytics, and automated response. International Journal of Engineering and Modern Technology, 10(11), 197 to 256. https://doi.org/10.56201/ijemt.v10.no11.2024.pg197.256 Adegbite, M. P., Adebayo, A., & Ahmed, M. O. (2025). A cyber risk quantification and governance architecture for critical infrastructure: From posture measurement to executive reporting. International Journal of Computer Science and Mathematical Theory, 11(12), 232 to 293. https://doi.org/10.56201/ijcsmt..pg232.293 Adelanwa, A., Basnet, A., & Anene, U. N. (2023). Predictive analytics models for financial risk detection and fraud prevention in public systems. International Journal of Advanced Multidisciplinary Research and Studies, 3(6). https://doi.org/10.62225/2583049X.2023.3.6.5969 Adesuyi, M. O., Akomolafe, O., Olaogun, B. O., Ndukwe, V. U., & Sakyi, J. K. (2025). AI-enabled fraud detection ecosystem model for securing international payment channels. International Journal of Advanced Multidisciplinary Research and Studies, 5(6), 866 to 882. https://doi.org/10.62225/2583049X.2025.5.6.5284 Adeyelu, O. O. (2018). A predictive compliance monitoring framework for detecting systemic safety risks through aviation consumer complaint data. Iconic Research and Engineering Journals, 1(8), 250 to 276. https://doi.org/10.64388/IREV1I8-1718478 Adeyelu, O. O. (2023). A risk-tiered oversight model for unmanned aircraft operations in shared controlled airspace over Nigerian airports. International Journal of Scientific Research in Civil Engineering, 7(4), 147 to 184. https://doi.org/10.32628/IJSRCE237419 Adeyelu, O. O., & Dagodzo, D. (2024). A maturity model for predicting airport safety audit outcomes in resource-constrained regulatory environments. International Journal of Scientific Research in Civil Engineering, 8(4), 132 to 170. https://doi.org/10.32628/IJSRCE248423 Afrihyia, E., Akinse, S. G., & Ojukwu, P. U. (2024). Comparative governance of AI-driven healthcare management: Executive oversight, regulatory structures, and accountability in the United States and developing countries. International Journal of Advanced Multidisciplinary Research and Studies, 4(6), 3087 to 3102. https://doi.org/10.62225/2583049X.2024.4.6.5920 Airia. (2026). Defensible AI: Building execution-level audit trails for enterprise AI. https://airia.com/blog/defensible-ai-execution-level-audit-trails/ Akanbi, O., & Sunday, E. A. (2025a). A systematic review of AI-driven autonomous mobile robots in scalable micro-fulfillment centers. International Journal of Advanced Multidisciplinary Research and Studies, 5(6), 2363 to 2379. https://doi.org/10.62225/2583049X.2025.5.6.6182 Akanbi, O., Ganiu, O. S., & Sunday, E. A. (2025b). A multi-agent AI framework for swarm intelligence in autonomous mobile robot fleet coordination. International Journal of Scientific Research in Humanities and Social Sciences, 2(1), 81 to 109. JAFM JAFM JAFM Akin-Oluyomi, O. T., Atima, M. E., & Akinleye, O. K. (2023). Regulatory compliance and supplier risk assessment frameworks in international pharmaceutical procurement. International Journal of Advanced Multidisciplinary Research and Studies, 3(6), 2194 to 2204. Akintola, A. S., Fawehinmi, Y. O., Aiyenitaju, O., Chinemerem, B., & Emmanuella, O. (2025). Digital transformation in telehealth: A systematic review of user trust, privacy, and regulatory governance in AI-powered remote monitoring systems. Journal of Scientific Research and Reports, 31(11), 163 to 182. https://doi.org/10.9734/jsrr/2025/v31i113658 Akomolafe, O., & Agu, M. U. (2018). A conceptual model for enhancing internal audit quality through technology-enabled risk assessment frameworks. Iconic Research and Engineering Journals, 1(9), 458 to 475. Akomolafe, O., Agu, M. U., & Bello, A. (2025a). A conceptual model for advancing risk governance through data-driven compliance analytics in financial institutions. Journal of Accounting and Financial Management, 11(11), 211 to 228. https://doi.org/10.56201/jafm..pg211.228 Akomolafe, O., Olaogun, B. O., Adesuyi, M. O., Ndukwe, V. U., & Sakyi, J. K. (2025b). Collaborative governance framework for secure cross-border payment data sharing. International Journal of Advanced Multidisciplinary Research and Studies, 5(6), 849 to 865. https://doi.org/10.62225/2583049X.2025.5.6.5283 Aliliele, C., Mbonu, I. S., & Iwuanyanwu, U. (2024). A conceptual framework for enterprise data sensitivity classification and regulatory traceability mechanisms. International Journal of Advanced Multidisciplinary Research and Studies, 4(6), 3103 to 3124. https://doi.org/10.62225/2583049X.2024.4.6.5991 Aliliele, C., Mbonu, I. S., Uzoka, E., & Iwuanyanwu, U. (2025a). A review of AI assisted continuous auditing systems in technology risk and cybersecurity oversight. Gyanshauryam, International Scientific Refereed Research Journal, 8(4), 210 to 250. https://doi.org/10.32628/GISRRJ258369 Aliliele, C., Mbonu, I. S., Uzoka, E., & Iwuanyanwu, U. (2025b). Advances in data lakehouse governance architectures for enterprise data loss prevention and compliance assurance. Shodhshauryam, International Scientific Refereed Research Journal, 8(4), 171 to 213. https://doi.org/10.32628/SHISRRJ258474 Annan, A. O. (2022). Data privacy governance models for cross-border digital platforms. International Journal of Multidisciplinary Research and Growth Evaluation, 3(6), 949 to 964. Annan, A. O. (2024). Algorithmic accountability and trade secret protection in artificial intelligence. Shodhshauryam, International Scientific Refereed Research Journal, 7(5), 315 to 347. Annan, A. O. (2025). Automated decision-making and anti-discrimination compliance under U.S. law. International Journal of Advanced Multidisciplinary Research and Studies, 5(2), 2522 to 2540. Arumosoye, O. M., & Obriki, O. D. (2021). Organizational learning-based conceptual maturity model for continuous safety performance improvement. International Journal of Multidisciplinary Research and Growth Evaluation, 2(1), 970 to 980. https://doi.org/10.54660/.IJMRGE.2021.2.1.970-980 Atakpa, M. I., Abetoh, N. F., & Akeju, B. (2024). Advances in artificial intelligence for healthcare payment fraud detection: A review of NHS applications. International Journal of Scientific JAFM JAFM JAFM Research in Computer Science, Engineering and Information Technology, 10(4), 1161 to 1194. https://doi.org/10.32628/CSEIT26123240 Atlan. (2026). Enterprise AI agent guardrails: A compliance checklist for 2026. https://atlan.com/know/ai-agent/enterprise-ai-agent-guardrails-checklist/ Badmus, O., Dosunmu, A. A., & Ozowara, D. E. (2019). A governance framework for Salesforce platform management in regulated healthcare environments. Iconic Research and Engineering Journals, 3(6). Badmus, O., Jooda, D., Ozowara, D. E., & Anunagba, C. O. (2022). A framework for Git-based version control and code review governance in Salesforce development teams. Shodhshauryam, International Scientific Refereed Research Journal, 5(2), 473 to 493. Badmus, O., Dosunmu, A. A., & Anunagba, C. O. (2025). A governance framework for AI- assisted CRM workflows: Agentforce deployment, risk management, and organizational readiness in enterprise Salesforce environments. International Journal of Scientific Research in Humanities and Social Sciences, 2(1), 59 to 80. Cloud Security Alliance AI Safety Initiative. (2026). EU AI Act high-risk deadline: Enterprise readiness gap. https://labs.cloudsecurityalliance.org/research/csa-research-note-eu-ai-act- high-risk-compliance-deadline-20/ CyberSaint. (2026). AI decision governance: How to prepare for the top challenge of 2026. https://www.cybersaint.io/blog/ai-decision-governance-how-to-prepare-for-the-top- challenge-of-2026 DiMaggio, P. J., and Powell, W. W. (1983). The iron cage revisited: Institutional isomorphism and collective rationality in organizational fields. American Sociological Review, 48(2), 147 to 160. DLA Piper GENIE. (2026). The Digital AI Omnibus: Proposed deferral of high risk AI obligations under the AI Act. https://knowledge.dlapiper.com/dlapiperknowledge/globalemploymentlatestdevelopment s/2026/The-Digital-AI-Omnibus-Proposed-deferral-of-high-risk-AI-obligations-under- the-AI-Act Dogbatsey, E. A., Oyeleye, A. O., & Ebhojie, O. (2026). Donor evidence standards and corrective action plan governance in publicly funded capital projects: A public sector accountability framework. International Journal of Applied Research in Social Sciences, 8(5), 107 to 126. https://doi.org/10.51594/ijarss.v8i5.2266 Dosunmu, A. A., & Ogundele, P. O. (2025). Cyber defense performance measurement frameworks for executive and board level governance. Computer Science and IT Research Journal, 6(11), 895 to 913. https://doi.org/10.51594/csitrj.v6i11.2164 Ebhojie, O., Dogbatsey, E. A., & Oyeleye, A. O. (2023). Audit liaison, corrective action planning, and control compliance in multinational organisations: A systematic literature review. International Journal of Advanced Multidisciplinary Research and Studies, 3(6), 2839 to 2850. https://doi.org/10.62225/2583049X.2023.3.6.6200 Eboh, E. E., & Aliliele, C. (2024). AI-driven data analytics framework for risk assessment and detection of venture capital and private equity investment fraud in U.S. capital markets. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 10(6), 2624 to 2665. https://doi.org/10.32628/CSEIT2410787 Eboh, E. E., & Aliliele, C. (2025). Predictive analytics systems for investment risk monitoring in SME FinTech companies and cross-border capital markets. International Journal of JAFM JAFM JAFM Scientific Research in Computer Science, Engineering and Information Technology, 11(2), 3969 to 4010. https://doi.org/10.32628/CSEIT25113398 Ekechi, N. V., Ozowara, D. E., & Anunagba, C. O. (2026). Conceptual framework for AI governance, data privacy compliance, and financial sustainability in digital health. Computer Science and IT Research Journal, 7(4), 275 to 299. Elementum AI. (2026). AI governance framework: Enterprise guide for 2026. https://www.elementum.ai/blog/ai-governance-framework European Commission AI Act Service Desk. (2026). Timeline for the implementation of the EU AI Act. https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline- implementation-eu-ai-act European Parliament and Council of the European Union. (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Eze, F. I., Anene, U. N., & Akinleye, O. K. (2022). Design of an integrated regulatory readiness maturity model for pharmaceutical companies seeking global market entry. International Journal of Health and Pharmaceutical Research, 7(1), 77 to 112. https://doi.org/10.56201/ijhpr.v7.no1.2022.pg77.112 Eze, F. I., Akinleye, O. K., & Anene, U. N. (2024a). Development of a cross-border regulatory harmonization model for African pharmaceutical markets: The ARCH-Model framework. International Journal of Health and Pharmaceutical Research, 9(5), 148 to 186. https://doi.org/10.56201/ijhpr.v9.no5.2024.pg148.186 Eze, F. I., Akinleye, O. K., & Anene, U. N. (2024b). Development of a risk-based accelerated approval decision model balancing speed, safety, and evidence quality in pharmaceutical regulatory science. Research Journal of Pure Science and Technology, 7(6), 120 to 161. https://doi.org/10.56201/rjpst.v7.no6.2024.pg120.161 Fobellah, A. N. (2025a). Cognitive biases in financial decision-making: Implications for audit and risk management in large corporations: A conceptual review. International Journal of Science and Research Archive, 16(2), 17 to 22. https://doi.org/10.30574/ijsra.2025.16.2.2273 Fobellah, A. N. (2025b). Navigating digital transformation: Auditing artificial intelligence- powered financial systems: A conceptual review. International Journal of Science and Research Archive, 16(2), 23 to 28. https://doi.org/10.30574/ijsra.2025.16.2.2274 Fobellah, A. N. (2025c). Unintended consequences of financial regulations: A study of corporate compliance burdens: A conceptual review. International Journal of Science and Research Archive, 16(2), 29 to 34. https://doi.org/10.30574/ijsra.2025.16.2.2275 Hussain, N., & Adebayo, A. (2026). The role of artificial intelligence in strengthening modern cybersecurity systems. World Journal of Innovation and Modern Technology, 10(6), 125 to 181. https://doi.org/10.56201/wjimt.v10.no6.2026.pg125.181 Impiger Technologies. (2026). Why the three lines of defense need an AI native operating model. https://www.impigertech.com/why-the-three-lines-of-defense-need-an-ai-native- operating-model/ Inside Privacy (Covington and Burling). (2026). EU AI Act update: Timeline relief, targeted simplification, and new prohibitions. https://www.insideprivacy.com/artificial- intelligence/eu-ai-act-update-timeline-relief-targeted-simplification-and-new- prohibitions/ Institute of Internal Auditors. (2020). The IIA's three lines model: An update of the three lines of defense. JAFM JAFM JAFM International Organization for Standardization. (2023). ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system. https://www.iso.org/standard/42001 Iternal.ai. (2026). Enterprise AI governance framework 2026: Four components, four risk tiers. https://iternal.ai/ai-governance-framework Jimoh, H. O., Abolle-Okoyeagu, C. J., Ahmed, M. O., & Lawal, N. O. (2023a). Advancing security in IoT-driven critical infrastructure: A focus on smart transportation system. American Journal of Engineering Research, 12(12), 33 to 46. Jimoh, H. O., Ahmed, M. O., & Fagbade, M. O. (2023b). The role of frameworks in cybersecurity governance. Journal of Behavioural Informatics, Digital Humanities and Development Research, 9(4), 7 to 16. https://doi.org/10.22624/AIMS/BHI/V9N4P2 Konfirmity. (2026). ISO 42001: The AI management system standard. https://www.konfirmity.com/blog/iso-42001 Ladapo, O. O., Dosunmu, A. A., Jooda, D., & Abolaji, T. O. (2022). Human-in-the-loop machine learning: A state of the art. Journal of Frontiers in Multidisciplinary Research, 3(1), 656 to 669. https://doi.org/10.54660/.JFMR.2022.3.1.656-669 Ladapo, O. O., Dosunmu, A. A., Jooda, D., & Abolaji, T. O. (2023a). An IT service management literature review: Challenges, benefits, opportunities, and implementation practices. International Journal of Advanced Multidisciplinary Research and Studies, 3(6), 2875 to 2889. https://doi.org/10.62225/2583049X.2023.3.6.6205 Ladapo, O. O., Jooda, D., Dosunmu, A. A., & Abolaji, T. O. (2023b). Systematic literature review on security access control policies and techniques based on privacy requirements in a BYOD environment. International Journal of Advanced Multidisciplinary Research and Studies, 3(6), 2890 to 2904. https://doi.org/10.62225/2583049X.2023.3.6.6206 Ladapo, O. O., Jooda, D., Dosunmu, A. A., & Abolaji, T. O. (2024). Keeping humans in the loop: Human-centered automated annotation with generative AI. International Journal of Multidisciplinary Futuristic Development, 5(1), 81 to 95. https://doi.org/10.54660/IJMFD.2024.5.1.81-95 Ladapo, O. O., Jooda, D., Dosunmu, A. A., & Abolaji, T. O. (2026). On the disagreement problem in human-in-the-loop federated machine learning. International Journal of Multidisciplinary Research and Growth Evaluation, 7(3), 178 to 192. https://doi.org/10.54660/.IJMRGE.2026.7.3.178-192 Lawal, O. A., & Oduleye, T. E. (2018). A review and conceptual framework for tax governance and cross-border compliance analytics. Iconic Research and Engineering Journals, 2(5). Mbonu, I. S., Aliliele, C., Iwuanyanwu, U., & Oluoha, O. M. (2018). A conceptual framework for legal and ethical risk modeling in enterprise data protection governance systems. Iconic Research and Engineering Journals, 2(2), 207 to 226. https://doi.org/10.64388/IREV2I2- 1714911 Mbonu, I. S., Aliliele, C., Iwuanyanwu, U., & Uzoka, E. (2022). A conceptual framework for AI enabled IT general controls and SOX audit automation processes. Gyanshauryam, International Scientific Refereed Research Journal, 5(5), 384 to 414. https://doi.org/10.32628/GISRRJ2256239 Medon, J. J., & Oduleye, T. E. (2022). A comprehensive financial reporting model for strengthening compliance and organizational accountability systems. International Journal of Multidisciplinary Research and Growth Evaluation, 3(6), 768 to 777. JAFM JAFM JAFM MLflow. (2026). Why audit AI decision making: A 2026 guide. https://mlflow.org/articles/why- audit-ai-decision-making-a-2026-guide/ National Institute of Standards and Technology. (2023). AI risk management framework (AI RMF 1.0). https://airc.nist.gov/airmf-resources/playbook Obogo, S. F., Arumosoye, O. M., & Obriki, O. D. (2020). Advances in internal QHSE audit systems for industrial engineering operations. Iconic Research and Engineering Journals, 4(4), 399 to 417. https://doi.org/10.64388/IREV4I4-1715499 Obogo, S. F., Obriki, O. D., & Arumosoye, O. M. (2022). Conceptual safety governance model for large commercial facility operations. Gyanshauryam, International Scientific Refereed Research Journal, 5(6), 383 to 410. https://doi.org/10.32628/GISRRJ225639 Ogbole, J. I., Okoruwa, P. O., Fadayomi, O., Abolaji, T. O., Edivri, J., & Akeju, B. (2021). Conceptual model for identity-centric zero trust architecture in enterprise security governance. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 7(5), 393 to 415. https://doi.org/10.32628/IJSRCSEIT217562 Ogbole, J. I., Okoruwa, P. O., Fadayomi, O., Akeju, B., Edivri, J., & Abolaji, T. O. (2025). Security analytics and digital forensics for enterprise risk management, advances and practical implications. International Journal of Advanced Multidisciplinary Research and Studies, 5(6), 2017 to 2028. Okoruwa, P. O., Fadayomi, O., Akeju, B., Edivri, J., Ogbole, J. I., & Abolaji, T. O. (2020). Conceptual model for privacy-centric security engineering in digital and cloud computing systems. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 7(5), 371 to 389. Okoruwa, P. O., Babatope, O. M., Akokodaripon, D. A., & Akinleye, O. K. (2024a). Developing integrated digital platforms for enhancing transparency in procurement and supply chain management. International Journal of Multidisciplinary Research and Growth Evaluation, 5(6), 1719 to 1729. Okoruwa, P. O., Fadayomi, O., Abolaji, T. O., Edivri, J., Ogbole, J. I., & Akeju, B. (2024b). Enterprise cybersecurity trends and threat evolution, advances and emerging research directions. Global Multidisciplinary Perspectives Journal, 1(6), 194 to 204. https://doi.org/10.54660/GMPJ.2024.1.6.194-204 Olaogun, B. O., Adesuyi, M. O., Akomolafe, O., Ndukwe, V. U., & Sakyi, J. K. (2023). Regulatory compliance adaptation model for cross-border payment product redesign. International Journal of Advanced Multidisciplinary Research and Studies, 3(1), 1651 to 1662. https://doi.org/10.62225/2583049X.2023.3.1.5279 Oluwo, K., Dada, T., & Isiekwu, C. P. (2024). Transforming insurance underwriting with machine learning: A review and application cases. International Journal of Advanced Multidisciplinary Research and Studies, 4(6), 3008 to 3019. Onche, V. O., Ogbonna, C. S., & Adegbite, M. P. (2024). Effectiveness of cybersecurity awareness training on insider-threat behavior among university administrators: An integrative academic review. International Journal of Computer Science and Mathematical Theory, 10(2), 117 to 144. https://doi.org/10.56201/ijcsmt.v10.no2.2024.pg117.144 Onche, V. O., Adegbite, M. P., & Ogbonna, C. S. (2026). Human factors in information security: A capability framework for administrative professionals in the digital workplace. World Journal of Innovation and Modern Technology, 10(5), 154 to 179. https://doi.org/10.56201/wjimt.v10.no5.2026.pg154.179 JAFM JAFM JAFM Oteri, O., & Edivri, J. (2026). An operational reliability and service assurance framework for enterprise IT systems supporting large user populations. Gulf Journal of Engineering and Technology, 2(1), 1 to 19. https://doi.org/10.51594/gjet.v2i1.205 Oyeleye, A. O., Dogbatsey, E. A., & Ebhojie, O. (2025). Embedding automated close controls in public sector ERP systems: A conceptual model for audit readiness and financial reporting quality. Zenodo. https://doi.org/10.5281/zenodo.20097950 Security Scientist. (2026). Twelve questions and answers about audit defensibility of AI-assisted decisions: Complete guide for 2026. https://www.securityscientist.net/blog/12-questions- and-answers-about-audit-defensibility-of-ai-assisted-decisions-complete-guide-for-2026/ Tonoyan, A., Dada, O., & Ayivi-Donkor, S. S. (2024a). Advances in supply chain resilience: Predictive models for vendor risk assessment and procurement cost optimization. International Journal of Social Sciences and Management Research, 10(11), 525 to 551. https://doi.org/10.56201/ijssmr.v10.no11.2024.pg.525.551 Tonoyan, A., Dada, O., & Ayivi-Donkor, S. S. (2024b). Real-time KPI tracking systems: A review of automated performance monitoring and data-driven decision making. World Journal of Innovation and Modern Technology, 8(6), 247 to 281. https://doi.org/10.56201/wjimt.v8.no6.2024.pg247.281 Walawalkar, G., Adesuyi, M. O., Kalu, A., & Oduleye, T. E. (2025). Executive financial dashboards for real-time strategic oversight. International Journal of Advanced Multidisciplinary Research and Studies, 5(6), 2042 to 2054. Walawalkar, G., Oduleye, T. E., Adesuyi, M. O., & Kalu, A. (2026). Next-generation financial analytics frameworks for AI-enabled enterprises. International Journal of Advanced Multidisciplinary Research and Studies, 6(1), 1779 to 1791.

More Articles from JOURNAL OF ACCOUNTING AND FINANCIAL MANAGEMENT