GV-1.6 Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities
Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities. A maintained inventory identifies the AI systems and models in use, and the resource given to maintaining it
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of periodic reconciliation between the inventory and systems actually in production · Policy repository / GRC workspace
governing documentDocuments that govern the control
- The AI system and model inventory with the fields it captures per entry · Policy repository / GRC workspace
- The intake process that causes a new system or model to be added · Document repository
- Named owner and resourcing for inventory maintenance · Policy repository / GRC workspace
First move
Common gaps auditors find
- Inventory covers models built in house but omits embedded and third-party AI features
- Compiled once for an audit and not maintained since
- No link from an inventory entry to its documentation, so the entry carries no usable detail
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetGV-1.5 Ongoing monitoring and periodic review of the risk management process and its outcomes are planned, organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review · GV-1.7 Processes and procedures are in place for decommissioning and phasing out of AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness