As organizations increasingly rely on vendors to develop AI systems, which of the following is the MOST effective way to monitor vendors and ensure compliance with ethical and security standards?

Conducting regular, independent audits is the most effective method for monitoring vendor compliance. Audits provide direct, verifiable assurance that the vendor's processes, controls, and outputs align with contractually mandated ethical and security standards. This approach moves beyond trust-based models like self-attestation, offering a structured and evidence-based mechanism to assess the entire AI development lifecycle. It allows the contracting organization to proactively identify gaps, enforce accountability, and ensure that principles of fairness, transparency, and security are being actively implemented, rather than just claimed.

B. Requiring vendors to monitor their adherence to ethics and security standards: This approach lacks independent verification and creates a potential conflict of interest, making it less reliable than an external audit.

C. Mandating that vendors share source code and AI documentation with the contracting party: While useful for due diligence, code and documentation review is a static, point-in-time assessment and does not guarantee ongoing process compliance.

D. Allowing vendors to self-attest ethical AI compliance and implement benchmark monitoring: Self-attestation is the weakest form of assurance, as it is not independently verified and may not accurately reflect actual practices.

1. ISACA. (2023). Artificial Intelligence Audit Toolkit. In the section on "Third-Party Management

" the toolkit emphasizes the need for organizations to "Perform audits of the third party" and "Review third-party attestation reports (e.g.

SOC 2)" to gain assurance over the controls at the vendor. This directly supports the practice of conducting audits (Option A) over relying on vendor self-monitoring or attestation (Options B and D).

2. ISACA. (2021). Auditing Artificial Intelligence. This white paper states

"The audit and assurance professional should obtain an understanding of the third-party relationships and related processes to determine whether the enterprise has implemented appropriate governance and monitoring controls." It highlights the auditor's role in verifying these controls

which is the essence of an audit. (Page 18

Third-Party Management).

3. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0). In the "Govern" function

section 4.4 "AI System and Third-Party Relationships

" the framework outlines the importance of establishing processes for "monitoring and reviews of third-party providers

" including "audits

and assessments." This underscores that active

independent verification like audits is a core component of managing third-party AI risk. (Page 21).