MN-1.2 Treatment of documented AI risks is prioritized based on impact, likelihood, or available resources or methods
Treatment of documented AI risks is prioritized based on impact, likelihood, or available resources or methods. Treatment order follows a stated prioritisation basis rather than convenience, and the basis is visible in t
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence that higher-priority risks were treated first · Document repository
governing documentDocuments that govern the control
- The risk treatment register showing priority assigned per risk · Policy repository / GRC workspace
- The prioritisation basis applied, whether impact, likelihood, resource or method availability · Document repository
- The link from prioritisation to the organisational risk tolerance · Document repository
First move
Common gaps auditors find
- Priority assigned but treatment order does not follow it
- Prioritisation basis unstated, so the ordering cannot be reviewed
- Low-cost treatments completed first regardless of the risk they address
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetMN-1.1 A determination is made as to whether the AI system achieves its intended purpose and stated objectives and whether its development or deployment should proceed · MN-1.3 Responses to the AI risks deemed high priority as identified by the MAP function are developed, planned, and documented, and risk response options can include mitigating, transferring, avoiding, or accepting