Assigning organizational roles, authorities, responsibilities and accountabilities

Authorities, responsibilities and accountabilities for every relevant risk management role should be assigned and communicated at all levels (ISO 31000:2018, 5.4.3); for AI that means defining who is accountable for each AI system across its life cycle, including the roles that own data, models, deployment and human oversight, and making sure the people assigned have the AI-specific competence the role needs. Test it on the 5.4.3 question at the next framework review.

What it asks

Authorities, responsibilities and accountabilities for every relevant risk management role should be assigned and communicated at all levels (ISO 31000:2018, 5.4.3); for AI that means defining who is accountable for each AI system across its life cycle, including the roles that own data, models, deployment and human oversight, and making sure the people assigned have the AI-specific competence the role needs.

Where generative AI changes the answer

Generative AI splits ownership three ways, between the business owner of the use, the technical owner of the model or vendor, and the risk owner, and each needs a name.

Who it binds

Top management, the AI risk owner and the functions that supply resources and communication. For 5.4.3 the named role is the owner of assigned accountability for each AI system and its data, model, deployment and oversight roles.

Evidence an auditor normally samples

• Assigned accountability for each AI system and its data, model, deployment and oversight roles

The test you can run

Compare assigned accountability for each AI system and its data, model, deployment and oversight roles with the use as it runs today; the gap between the two is the finding to record.

Common failures

• AI system with no named accountable owner
• Accountability assigned to a role with no AI competence

Before the draft publishes

For 5.4.3, check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one. The first artefact to produce is assigned accountability for each AI system and its data, model, deployment and oversight roles.

Where this sits against the draft

5.4.3 carries the framework: leadership, integration and improvement part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 5.4.3 (assigning organizational roles, authorities, responsibilities and accountabilities) with this record and note the change in the register.