Compatible-standard reports are lenses on AI Controls Matrix (AICM) answers from the function diagnostic — the AI Consensus Assessments Initiative Questionnaire (AI-CAIQ) is the attestation view of that spine, shown as a sample. Not certification.
Pick the line that matches where you are today, least to most mature. Each question is a real control objective; the verification note says where to confirm it. 8/8 to answer.
Re-assessing Northwind Retail. A rated sample: illustrative answers are loaded, nothing is saved. Change what improved and the maturity and the gate recompute live.
IAM
IAM-01Is there a written rule for who and what can reach your AI systems, and how access is granted and removed?
verify · Ask for the access-management policy and check it names the AI systems and the non-human (service/agent) accounts, not just staff.
IAM-13Does signing in to anything that controls the AI require more than a password?
verify · Pull the identity-provider report: what share of accounts with access to AI systems have multi-factor enforced.
IAM-05Does each person and service get only the access they actually need to the models, training data, and pipelines?
verify · Sample three accounts (one human, one service, one agent) and check what they can reach versus what their role needs.
IAM-07When someone changes role or leaves, is their access to the AI systems changed or removed quickly?
verify · Take the last three leavers and time the gap between their exit date and when AI-system access was revoked.
IAM-08Is who-can-reach-what reviewed on a regular schedule, with the odd exceptions chased down?
verify · Pull the most recent access-review record: its date, whether it covered all AI systems, and the exceptions log.
IAM-18Are AI agents that act on their own held to tighter access limits than a normal user?
verify · List the autonomous agents in this function and check each one’s credential scope and action log.
Governance
HRS-15Are the people who run identity and access trained on using AI safely and verifying its output before acting?
verify · Ask for the training record for this team: who completed it, when, and whether it covers verifying AI output.
GRC-15Is there a named person accountable for reviewing what the AI does in identity and access work?
verify · Get the name and the review cadence; confirm it is a real responsibility, not a title.