AI Governance Self-Assessment: NIST AI Risk Management Framework

This document is a self-assessment. It is not a certification, not an audit, and not a third-party verification. 8 main sections: services, Govern, Map, Measure, Manage, in plain language, advisory practice only, not an audit of a client system, EU AI Act readiness support only.

This document is a self-assessment by 1000823315 ONTARIO INC., operating as Movahedi Solutions. It is not a certification, not an audit, and not a third-party verification. It describes, in plain language, how the advisory practice of Movahedi Solutions addresses the four functions of the NIST AI Risk Management Framework: Govern, Map, Measure, and Manage. It is a self-assessment of the advisory practice. It is not an audit of a client system.

Date: October 27, 2026 Company: 1000823315 ONTARIO INC., operating as Movahedi Solutions Location: Mississauga, Ontario, Canada Contact: mohammad@movahedi.ca Public site: https://www.movahedi.ca

1. Status and scope

This self-assessment covers advisory services only. It describes how Movahedi Solutions works with a client to set up AI governance, find AI uses, assess risk, and keep governance current. It does not rate a client AI system, and it does not state that a client system is safe, fair, or compliant. Those findings, where needed, are made per engagement, for the systems in scope for that engagement.

Movahedi Solutions is an independent privacy and AI governance consultancy. Its founder holds, as personal credentials, ISC2 CC, CIPP/C, and Lean Six Sigma coursework (LinkedIn Learning, 2022). Those are personal credentials. They are not company certifications.

2. Advisory practice in scope

Services offered by Movahedi Solutions:

1. AI Governance
2. Privacy & Data Governance
3. Cookie & Script Governance
4. Process Excellence
5. Custom AI & Data Solutions
6. Fractional Advisory

In plain terms, the practice helps a client answer four questions: who decides, what AI is in use, what the risk is, and what happens next. The NIST AI Risk Management Framework functions below follow that same order.

Client data rules for engagements: client data is used only for its engagement, access is limited, and client data is removed at the end of the engagement, or returned or deleted on client instruction. There is no sale of client data and no use of client data for model training. A client is not named publicly without written permission.

3. Govern: who decides, and how

Govern means setting up the people, roles, and rules before AI decisions are made.

What Movahedi Solutions does:

• Helps a client name who owns AI decisions, who reviews them, and who can pause or stop a use.
• Helps a client write a custom AI governance framework for its own teams, including acceptable use, human oversight, and review steps.
• Helps a client connect AI governance to privacy governance, so a use that handles personal information is reviewed for both AI risk and privacy risk.
• Helps a client record decisions, so a later review can see who decided what, and why.

What is confirmed per engagement: the decision owner, the review route, the framework document in scope, and the record the client will keep.

What this function does not do here: it does not set a client policy by itself. The client approves its own policy, roles, and limits.

4. Map: what AI is in use, and in what context

Map means finding AI uses and understanding the context for each one.

What Movahedi Solutions does:

• Builds AI and agent inventories, including tools, agents, and uses a client may not have listed yet.
• Helps a client classify each use by purpose, data, people affected, and risk level.
• Helps a client record the context for each use: what the system does, what data it uses, who uses the output, and what happens if the output is wrong.
• Supports EU AI Act readiness assessments, by mapping uses against readiness questions a client needs to answer for its own program.

What is confirmed per engagement: the systems and agents in scope, the classification for each use, and the inventory record the client will maintain.

What this function does not do here: it does not test a model. Testing sits under Measure, and only for systems the engagement names.

5. Measure: what the risk is, and what can be checked

Measure means checking risk with methods that fit the use, and recording what was found.

What Movahedi Solutions does:

• Carries out risk assessments for AI uses in scope, covering purpose, data, human oversight, explainability, and monitoring needs.
• Helps a client choose checks that fit the use, such as a review of explanations for a decision, a check of the data going into a system, or a review of who can override the output.
• Helps a client record findings in plain language, with the limits of each check stated, so a reader can see what was checked and what was not.
• Builds knowledge bases that keep assessment records, decisions, and guidance in one place a team can search and reuse.

What is confirmed per engagement: the uses to be assessed, the checks to be used, the findings record, and the limits of those checks.

What this function does not do here: it does not give a pass or fail score for a client system as a whole, and it does not replace testing the client must do in its own systems.

6. Manage: what happens next, and how governance stays current

Manage means acting on findings, watching for change, and updating governance when a use changes.

What Movahedi Solutions does:

• Helps a client turn findings into actions, with an owner and a next review date for each action.
• Helps a client set monitoring steps for uses in scope, including when a use must be reviewed again, such as a change in data, purpose, or vendor.
• Helps a client update its custom AI governance framework and its inventory when a use is added, changed, or retired.
• Helps a client keep a record of actions taken, so the next review starts from what actually happened.

What is confirmed per engagement: the action list, the owner for each action, the monitoring step, and the next review point.

What this function does not do here: it does not run a client system day to day. Day to day operation stays with the client.

7. What this document does not claim

This self-assessment is not a certification, not an audit, and not a third-party verification, as stated in Section 1. It covers only the scope stated in Section 1, and engagement-specific matters are confirmed in writing for that engagement. Contact: mohammad@movahedi.ca.

8. Evidence and contact

Evidence cited in this document:

• Services list, as offered by Movahedi Solutions, Section 2.
• Public site, https://www.movahedi.ca checked on October 28, 2026: AI governance coverage follows use-case discovery, risk classification, explainability, bias, human oversight, acceptable use, and monitoring.
• Client data rules, Section 2, as stated by Movahedi Solutions for its engagements.
• Framework structure: NIST AI Risk Management Framework functions Govern, Map, Measure, Manage, addressed in Sections 3 to 6 in that order.

Registrations and third-party listings recorded October 27, 2026: UNGM Basic; MERX Basic Free; CanadaBuys / SAP Ariba; CPSS ePortal; Ontario Tenders Portal; LinkedIn Services; Catalant; Clutch, https://clutch.co/profile/movahedi 0 reviews; Trustpilot, https://www.trustpilot.com/review/movahedi.ca 0 reviews / 0.0.

Contact: mohammad@movahedi.ca. A buyer who needs a document for a specific procurement can request it through that contact, and Movahedi Solutions will confirm what it can provide for that procurement.

Related pages

• Trust Center
• Documents
• Self-Assessments
• Security Practices
• Privacy and Data Handling

Scope and limits, stated briefly

Where a matter is to be confirmed per engagement, it is stated as such, and it is confirmed in writing for that engagement before work starts. Contact: mohammad@movahedi.ca.