Methodology starts by fixing the object of the rating.
Enterprise AI governance cannot be rated credibly when scope is ambiguous. A methodology should identify the accountable entity or business unit, the named AI system or operating environment, intended use, lifecycle stage, jurisdictional context, evidence window and as-at date before analytical work begins.
Evidence is tested against the conclusion it is expected to support.
Evidence should be relevant to the requirement, current for the system and period, traceable to an accountable source and sufficient to demonstrate the control operating. Policy and design documents may establish intent; operating evidence is required to support conclusions about effectiveness.
Governance & oversight
Accountability, decision rights, policy and board-level visibility.
Organizational readiness
Skills, operating model, training and management capability.
Risk management
Classification, impact analysis, control design and remediation.
Responsible AI practices
Intended use, transparency, fairness and human oversight.
Enterprise architecture
System design, integration, data flows and control points.
Cybersecurity governance
Access, model and data security, and third-party controls.
Regulatory alignment
Mapping to applicable obligations and jurisdictional requirements.
Operational governance
Monitoring, change management and evidence continuity.
The institutional rating lifecycle
- Scope: establish entity, system, intended use, sector, lifecycle and jurisdiction.
- Classify: determine risk context, materiality, obligations and evidence depth.
- Assess: test controls, artifacts, implementation and material deficiencies.
- Challenge: review evidence sufficiency, judgment, exceptions, conflicts and gate states.
- Decide: translate analytical results into a bounded rating opinion and rationale.
- Monitor: establish validity, surveillance, incident and material-change triggers.
Diagnostic scoring and rating issuance should remain separate.
Analytical scores can support control-level diagnostics and trend analysis. The published rating should be produced through a separate decision layer that considers evidence confidence, material deficiencies and critical conditions. This separation reduces false precision and makes the operative opinion easier to interpret.
Critical conditions require non-compensatory logic.
A severe deficiency in safety, security, privacy, accountability or evidence integrity should not disappear because stronger controls elsewhere increase an average. Institutional methodologies therefore benefit from explicit blocker or critical-gate states that constrain the outcome until the condition is resolved or formally accepted within defined authority.
Methodology governance is part of the rating.
Version control, reviewer calibration, conflict management, confidentiality, record retention, rating actions and appeal determine whether a rating can be reproduced and challenged. The methodology is not only the scoring formula; it is the governance of the decision process itself.