GV-2.2 The organization's personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements
The organization’s personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements. Training is role-spe
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Training curricula differentiated by AI role, with the content covered · Policy repository / GRC workspace
- Completion records by individual and date, including partner personnel where in scope · Policy repository / GRC workspace
- The link from a role definition to the training required for it · Policy repository / GRC workspace
- Evidence of refresh when policies or applicable law changed · Policy repository / GRC workspace
First move
Common gaps auditors find
- One general awareness module issued to everyone regardless of AI duty
- Partner and contractor personnel excluded despite performing AI lifecycle tasks
- Completion tracked but no record of what the training actually covered
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetGV-2.1 Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization · GV-2.3 Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment