Governance Pack
Put finance AI governance into practice.
Policy, risk review, and ownership for AI use in finance.
We work with your finance and control stakeholders to document current use, define review practices, and prepare a governance package your team can maintain. The scope includes implementation planning and handoff.
Best for
Who this is for
Finance teams that have AI in production, in pilot, or in serious planning, and need governance that holds up to scrutiny. Common triggers: an audit committee question, a SOX implication, a new vendor entering the stack, a board member asking how AI risk is managed, or an examiner request.
The self-serve policy generator can provide an initial draft. This engagement is for teams that need a reviewed framework, ownership model, and rollout plan tailored to their environment.
Deliverables
What the engagement delivers
Tailored to your industry, team size, and existing policy frameworks.
- AI governance policy document with baseline structure plus customizations for your industry and use cases, delivered as an editable Word doc you can maintain.
- Risk register populated with at least 8 finance-specific AI risk scenarios, each scored on likelihood and impact, with documented mitigations.
- Vendor evaluation framework including a scoring rubric and at least 3 vendors evaluated against it as worked examples.
- Rollout plan with phased adoption gates, named owners, and timeline.
- Training session for the policy steward (typically Controller, Head of Compliance, or Internal Audit lead) with materials they can reuse.
- Board-ready summary if requested, formatted for audit committee or board distribution.
How it runs
A four-phase structure
The exact length depends on regulatory scope and review cycles.
- Phase 01
Week 1: Discovery
Stakeholder interviews across finance, IT, legal, compliance, and any active AI use case owners. Current state assessment of existing policies (data governance, vendor management, model risk if applicable). Regulatory scan tailored to your industry.
- Phase 02
Weeks 2 to 3: Policy development
Drafting the policy document with input from interviews and existing frameworks. Iterating through review cycles with the executive sponsor. Building the risk register and vendor evaluation framework in parallel.
- Phase 03
Week 4: Rollout planning
Defining phased adoption gates, naming owners, and locking the rollout timeline. Drafting the training plan. Worked examples in the vendor framework so the team sees how it applies.
- Phase 04
Weeks 5 to 6 (if extended)
Refinement based on feedback, board-ready summary preparation, training session delivery, and final handoff to the policy steward.
What you bring
What we need from your team
- Executive sponsor committed to four to six weeks (Controller, CFO, or Head of Compliance is typical).
- Stakeholder list of 4 to 8 people across finance, IT, legal, and compliance for interviews.
- Current AI use cases or pilots in flight, including any informal uses by individual team members, so the policy covers actual practice.
- Existing policies and frameworks (data governance, vendor management, model risk if applicable, code of conduct).
- Industry and regulatory context (SOX, banking, insurance, healthcare-finance, public company reporting).
- Internal point person for logistics, document gathering, and policy steward training scheduling.
How we know it worked
Success criteria, locked in week 1
Measured in week 4 or 6.
- Policy document approved by the executive sponsor and ready for board or audit committee review without further legal-side work.
- Risk register populated with at least 8 finance-specific AI risk scenarios, each with documented mitigation.
- Vendor evaluation framework operational with at least one vendor scored end-to-end.
- Rollout plan with named owners and a timeline the team will execute.
- Policy steward trained and able to maintain the policy independently (verified by walkthrough at the end of the engagement).
Pricing
Investment and what changes it
Investment
$25k–$45k
Payable in two installments (50% at kickoff, 50% at delivery).
What changes the price
- Regulated industry scope (SOX, banking, insurance, healthcare-finance) adds 30 to 60 percent for additional documentation rigor and review cycles
- Multi-entity governance harmonization if you operate across legal entities or jurisdictions with different requirements
- Board-presentation requirement beyond the standard summary (additional prep cycles, executive coaching for the presenter)
- Number of vendor evaluations included in the framework (default 3; additional evaluations at incremental cost)
- Existing framework alignment if your organization has heavy existing governance the policy must integrate with
We scope and quote on the kickoff call. Published range is the floor.
Related work
How governance connects to implementation
Starts with
A 30-minute scoping call. No prior policy work is required. If your team already has a draft AI policy, we start from it, which shortens discovery.
Leads to
Operations Essentials or Operations Standard for ongoing policy maintenance, vendor reviews as new tools enter the stack, and quarterly governance refreshes. Most clients move directly into a retainer after the Pack so the steward is not maintaining the policy alone.
FAQ
Common questions
Does this include legal review?
No. The policy is drafted to be legally defensible and structured so your counsel can review it efficiently. We coordinate with your legal team during the engagement when their input affects scope. If you need attorney-led drafting, we'll point you to law firms that specialize in AI governance.
What if we already have an AI policy?
That's a good starting point. We assess what exists, identify gaps against current best practices and your specific use cases, and either extend the existing policy or replace it. Roughly half our clients arrive with a partial or outdated policy.
What if our industry has specific regulations like SOX or banking SR 11-7?
We handle SOX-regulated environments, public company reporting requirements, and bank model risk management frameworks routinely. Pricing scales for the additional documentation rigor those environments require. We do not handle FDA-regulated medical AI or DOD-regulated defense AI; for those, you need a specialist.
Who maintains the policy after delivery?
The policy steward you designate, typically your Controller, Head of Compliance, or Internal Audit lead. Part of the engagement is training that person to update the policy as use cases and regulations evolve. The Operations Retainer covers ongoing updates if you prefer continued external support.
Can this work alongside our existing data governance framework?
Yes. The AI policy is designed to layer on top of, not replace, your existing data governance, vendor management, and model risk frameworks. We map the AI policy explicitly to those frameworks so reviewers can see how they connect.
Do we get the policy as a Word doc or just a PDF?
You get the editable Word doc plus a PDF version for distribution. The Word doc is yours to maintain. We do not lock you into a tool or platform.
Put governance around the work underway.
Describe the AI capabilities and control requirements you are managing. We will identify the governance scope that fits your environment.
Explore services
Ask SAL