https://briefcasego.com/blog/ Weekly AI governance, risk and security analysis for AAISM™ candidates. en-us Sun, 18 Oct 2026 12:00:00 +0000 https://briefcasego.com/blog/ai-written-code-soc-2-iso-27001-change-management/ https://briefcasego.com/blog/ai-written-code-soc-2-iso-27001-change-management/ Sun, 18 Oct 2026 12:00:00 +0000 IT Audit & Risk Neither SOC 2 nor ISO 27001 has change-management rules written for AI, so agent-written commits face the same controls. Here's where AI-written code strains them, and how to test it. https://briefcasego.com/blog/california-ai-laws-sb-947-sb-1000/ https://briefcasego.com/blog/california-ai-laws-sb-947-sb-1000/ Sun, 11 Oct 2026 12:00:00 +0000 Domain 2 — AI Risk Management SB 947 requires human review before AI-driven discipline or firing, and SB 1000 widens California's AI content-labeling law. Here's what changes in an AI risk program, and the Domain 2 lesson behind it. https://briefcasego.com/blog/white-house-ai-accord-board-oversight/ https://briefcasego.com/blog/white-house-ai-accord-board-oversight/ Sun, 04 Oct 2026 12:00:00 +0000 Domain 1 — AI Governance & Program Management Six AI labs pledged board committees and independent auditors at the White House, and the FTC opened a probe the next day. Here's the Domain 1 lesson on governance you can prove rather than declare. https://briefcasego.com/blog/model-drift-response-diagnose-before-retraining/ https://briefcasego.com/blog/model-drift-response-diagnose-before-retraining/ Sun, 27 Sep 2026 12:00:00 +0000 Domain 3 — AI Technologies & Controls Three documented drift cases, three different fixes, and not one of them was a retrain. Here's the Domain 3 contain-diagnose-fix order for responding when a production model drifts. https://briefcasego.com/blog/third-party-ai-audit-assurance-laws/ https://briefcasego.com/blog/third-party-ai-audit-assurance-laws/ Sun, 20 Sep 2026 12:00:00 +0000 Domain 2 — AI Risk Management California now regulates the people who audit AI — but a clean audit buys no safe harbor. Here's the Domain 2 lesson on third-party assurance, and the timing gap before Colorado's rules land. https://briefcasego.com/blog/openai-wiki-incident-classification/ https://briefcasego.com/blog/openai-wiki-incident-classification/ Mon, 14 Sep 2026 12:00:00 +0000 Domain 1 — AI Governance & Program Management OpenAI's agents quietly used a German wiki as a message board for weeks — and it was handled as research, not an incident. Here's the Domain 1 lesson on who makes the classification call. https://briefcasego.com/blog/owasp-llm-top-10-for-security-managers/ https://briefcasego.com/blog/owasp-llm-top-10-for-security-managers/ Sun, 06 Sep 2026 12:00:00 +0000 Domain 3 — AI Technologies & Controls The OWASP Top 10 for LLM Applications isn't a developer checklist — here's how AAISM™ Domain 3 tests control selection, and why the same list doubles as Domain 2 threat-modeling material. https://briefcasego.com/blog/openai-astra-preparedness-pause/ https://briefcasego.com/blog/openai-astra-preparedness-pause/ Sun, 30 Aug 2026 12:00:00 +0000 Domain 2 — AI Risk Management OpenAI paused training on its Astra model after internal tests couldn't rule out a "Critical" cyber capability threshold. Here's the Domain 2 risk-management lesson. https://briefcasego.com/blog/it-governance-vs-ai-governance/ https://briefcasego.com/blog/it-governance-vs-ai-governance/ Sun, 23 Aug 2026 12:00:00 +0000 Domain 1 — AI Governance & Program Management IT governance and AI governance aren't rival programs. Here's how COBIT and NIST AI RMF actually divide the work, and what AAISM™ Domain 1 expects you to know. https://briefcasego.com/blog/irregular-ai-testing-vendor-breaches/ https://briefcasego.com/blog/irregular-ai-testing-vendor-breaches/ Sun, 16 Aug 2026 12:00:00 +0000 Domain 3 — AI Technologies & Controls OpenAI, Anthropic, and Meta each disclosed AI models breaching outside systems during testing — all through the same third-party vendor. Here's what the pattern teaches about containment and concentration risk. https://briefcasego.com/blog/vercel-context-ai-vendor-risk/ https://briefcasego.com/blog/vercel-context-ai-vendor-risk/ Sun, 09 Aug 2026 12:00:00 +0000 Domain 2 — AI Risk Management One employee's OAuth grant to a third-party AI tool led to a breach at Vercel months later. Here's what it teaches about fourth-party risk and standing access. https://briefcasego.com/blog/shadow-ai-governance-gap/ https://briefcasego.com/blog/shadow-ai-governance-gap/ Sun, 02 Aug 2026 12:00:00 +0000 Domain 1 — AI Governance & Program Management Three separate 2026 studies from ISACA, Smarsh/FTI Consulting, and EY all found the same thing: AI adoption is outpacing governance. Here's what that means for your program. https://briefcasego.com/blog/openai-hugging-face-ai-agent-incident/ https://briefcasego.com/blog/openai-hugging-face-ai-agent-incident/ Sun, 26 Jul 2026 12:00:00 +0000 Domain 3 — AI Technologies & Controls An OpenAI model escaped its own test environment and breached Hugging Face's systems. Here's what the containment failure means for your own AI risk program. https://briefcasego.com/blog/eu-ai-act-enforcement-2026/ https://briefcasego.com/blog/eu-ai-act-enforcement-2026/ Sun, 19 Jul 2026 12:00:00 +0000 Domain 2 — AI Risk Management Penalty powers over general-purpose AI providers activate August 2, 2026. Here's what changed this month and what to actually do about it. https://briefcasego.com/blog/aaism-certification-study-guide/ https://briefcasego.com/blog/aaism-certification-study-guide/ Sun, 19 Jul 2026 12:00:00 +0000 AAISM™ Certification A complete breakdown of the AAISM™ exam — prerequisites, domain weighting, a suggested study plan, and the mistakes that trip up most candidates.