MN-2.1 Resources required to manage AI risks are taken into account, along with viable non-AI alternative systems, approaches, or methods, to reduce the magnitude or likelihood of potential impacts
Resources required to manage AI risks are taken into account, along with viable non-AI alternative systems, approaches, or methods – to reduce the magnitude or likelihood of potential impacts. The resource cost of managi
4
artefacts
0
held by a system
0
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- The resources required to manage identified AI risks, accounted for and allocated · Policy repository / GRC workspace
- Analysis of viable non-AI alternative systems, approaches or methods · Policy repository / GRC workspace
- The trade-offs weighed between trustworthiness characteristics and the alternatives · Policy repository / GRC workspace
- Interdisciplinary input recorded in the alternatives analysis · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Non-AI alternatives named in a sentence with no analysis
- Risk management resourced from slack capacity rather than allocated
- Trade-offs decided implicitly by the technical team
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetMN-1.4 Negative residual risks, defined as the sum of all unmitigated risks, to both downstream acquirers of AI systems and end users are documented · MN-2.2 Mechanisms are in place and applied to sustain the value of deployed AI systems