Question 1

What evidence do auditors ask for on MP-5.1 Likelihood and magnitude of each identified impact are identified and documented, based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team, or other data?

Accepted Answer

Impact register with likelihood and magnitude recorded per impact; The evidence base cited for each estimate, including comparable systems and incident reports; Beneficial as well as harmful impacts characterised; The use of these estimates in a go or no-go decision.

Question 2

Can MP-5.1 be evidenced continuously rather than by periodic review?

Accepted Answer

This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.

Question 3

What is the most common gap auditors find on MP-5.1?

Accepted Answer

Likelihood assigned by consensus in a workshop with no evidence cited

`MP-5.1` Likelihood and magnitude of each identified impact are identified and documented, based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team, or other data

system holds itEvidence a system already holds

periodic reviewEvidence produced at each review

governing documentDocuments that govern the control

First move

Common gaps auditors find

Do this for your whole sheet