GV-4.3 Organizational practices are in place to enable AI testing, identification of incidents, and information sharing
Organizational practices are in place to enable AI testing, identification of incidents, and information sharing. Testing and incident identification are enabled by practice and resourcing, and information about failures
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Records of information shared internally or externally about identified issues · Document repository
governing documentDocuments that govern the control
- In-house testing policy covering the failure modes AI introduces · Policy repository / GRC workspace
- The incident identification and recording mechanism for AI systems · Document repository
- Evidence of resourcing for testing independent of the delivery schedule · Document repository
First move
Common gaps auditors find
- Testing limited to accuracy on a held-out set, missing drift and shortcut learning
- Incidents recorded in a delivery tracker that no risk function reads
- No sharing beyond the team, so the same failure recurs elsewhere
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetGV-4.2 Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate and use, and communicate about the impacts more broadly · GV-5.1 Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks