Home / Requirement record / 5.3
5.3
Integration
ISO 31000:2018, 5.3 applies with nothing AI-specific added: integration begins with understanding how the organization is structured and what surrounds it, risk is handled throughout that structure, each person has a part in it, and governance and leadership determine how deeply AI risk management shapes decisions. Test it on the 5.3 question at the next framework review.
- What it asks
- ISO 31000:2018, 5.3 applies with nothing AI-specific added: integration begins with understanding how the organization is structured and what surrounds it, risk is handled throughout that structure, each person has a part in it, and governance and leadership determine how deeply AI risk management shapes decisions.
- Where generative AI changes the answer
- The integration test is whether a generative AI use appears in the enterprise risk register at all, or only in the team that bought it.
- Who it binds
- Top management, the AI risk owner and the functions that supply resources and communication. For 5.3 the named role is the owner of AI risk management embedded in the organization's governance, strategy and decision-making processes.
- Evidence an auditor normally samples
- AI risk management embedded in the organization's governance, strategy and decision-making processes
- The test you can run
- Take AI risk management embedded in the organization's governance, strategy and decision-making processes and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.
- Common failures
- AI risk handled in a silo outside the enterprise risk framework
- Before the draft publishes
- For 5.3, check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one. The first artefact to produce is AI risk management embedded in the organization's governance, strategy and decision-making processes.
- Where this sits against the draft
- 5.3 carries the framework: leadership, integration and improvement part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 5.3 (integration) with this record and note the change in the register.