The third line needs an instrument.
Audit committees are asking. Methods have not caught up.
Boards now expect internal audit to report on AI. Most audit programs answer with what they know how to test: policies, inventories, model documentation. That is governance evidence. It is not control evidence.
Governance is policy. Control is evidence.
The exposures that matter sit where current methods do not reach:
Deep. Below the model: the data centers, computing and power on which it runs, often rented, often in another jurisdiction, under someone else's key custody.
Wide. Beyond the institution: inside the asset managers, servicers and providers to whom it has delegated work, but not liability.
An audit that stops at the model layer, or at the institution's own walls, reports on the part of AI that is easiest to see.
WHAT WE PROVIDE
A method built for AI control.
Institutional AI equips internal audit functions with the 5×5 Control Matrix™, the instrument behind our research on eighty of the world's leading financial institutions.
The Matrix reads the five ecosystems of the Institutional AI Stack™ (Power, Computing, Data Centers, Models and Agentic Applications) against five pillars of control: Jurisdictional, Logical, Technical, Operational and Contractual. That makes twenty-five intersections, each tested on its own terms and never collapsed into a single score.
Every intersection is classified by one standard: evidenced, assumed or absent.
INDEPENDENCE BY DESIGN
We equip the third line. We do not replace it.
Institutional AI does not issue audit opinions, attestations or certifications. Your internal audit function retains ownership of its work, its conclusions and its reporting line to the audit committee.
Institutional AI maintains no hyperscaler alliances, no model-provider partnerships and no resale economics with technology vendors. The method has no product to protect.