Consensus Assessment Initiative Questionnaire (CAIQ) and Valid-AI-ted
CAIQ and Valid-AI-ted
The CAIQ is the Consensus Assessment Initiative Questionnaire, the questionnaire counterpart to the CCM. Valid-AI-ted is CSA's AI validation framework. The exam tests how CAIQ supports STAR Level 1 and Level 2, and how Valid-AI-ted differs from AI-CAIQ.
Core rules
- CAIQ v4 contains one question per CCM control (approximately 197 questions). Each answer is Yes, No, or NA, with space for evidence and scope notes.
- For STAR Level 1, the completed CAIQ is published on the CSA STAR registry. It is self-declared and not audited.
- For STAR Level 2, the CAIQ can be used as a readiness tool and evidence index, but the auditor independently verifies controls against CCM.
- CAIQ is not a certification. It is a transparency instrument.
- Valid-AI-ted is a CSA framework/questionnaire for validating AI systems. It focuses on AI-specific evidence such as model documentation, bias testing, and human oversight. It is distinct from the AI-CAIQ, which is aligned to the AI Controls Matrix (AICM). Valid-AI-ted supports AI assurance but is not itself a STAR level.
Worked example
A provider wants STAR Level 1. They complete CAIQ v4, answering each question. For a data encryption control, they answer 'Yes' and cite their encryption policy. They publish the CAIQ on the STAR registry. A customer asks how they validate their AI model. The provider uses Valid-AI-ted to document model validation, but that is separate from the STAR Level 1 cloud listing. Reasoning: CAIQ is for cloud controls; Valid-AI-ted is for AI validation. Mixing them in one registry entry is incorrect.
Traps
- Thinking CAIQ responses are audited at Level 1. They are self-reported.
- Believing CAIQ is the same as CCM. CAIQ is derived from CCM but is a questionnaire.
- Confusing Valid-AI-ted with AI-CAIQ. AI-CAIQ maps to AICM; Valid-AI-ted is a validation framework.
- Publishing a CAIQ without scope notes, which weakens transparency.