Question 1

What evidence do auditors ask for on MP-3.2 Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness are examined and documented, as connected to organizational risk tolerance?

Accepted Answer

Documented analysis of costs arising from system error or failure; Non-monetary costs identified, including harm to individuals and communities; The connection drawn between those costs and the stated risk tolerance; Input from parties outside the delivery team on what costs matter.

Question 2

Can MP-3.2 be evidenced continuously rather than by periodic review?

Accepted Answer

This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.

Question 3

What is the most common gap auditors find on MP-3.2?

Accepted Answer

Only direct financial and remediation cost considered

`MP-3.2` Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness are examined and documented, as connected to organizational risk tolerance

system holds itEvidence a system already holds

periodic reviewEvidence produced at each review

governing documentDocuments that govern the control

First move

Common gaps auditors find

Do this for your whole sheet