# 5.4.4 Allocating resources

Appropriate resources should be allocated to managing risk: people with the skills and competence needed, processes, methods and tools, documented procedures, systems for managing information and knowledge, and professional development (ISO 31000:2018, 5.4.4). In practice the record is resource plan for AI risk management naming expertise, tools and capacity. Test it on the 5.4.4 question at the next framework review.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 5.4.4
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

Appropriate resources should be allocated to managing risk: people with the skills and competence needed, processes, methods and tools, documented procedures, systems for managing information and knowledge, and professional development (ISO 31000:2018, 5.4.4). For AI the specialized resources include AI and data science expertise, tooling for evaluating models and data, and the time and computing capacity that testing and monitoring AI systems demand.

## Where generative AI changes the answer

The resource that runs short is evaluation capacity: people who can test an output, read a vendor's model card and keep the evidence.

## Who it binds

Top management, the AI risk owner and the functions that supply resources and communication.

## Evidence an auditor samples

- Resource plan for AI risk management naming expertise, tools and capacity

## The test you can run

Ask for the risk register entry for the use. If there is none, the framework has not reached it.

## Common failures

- AI risk evaluation attempted without model evaluation tooling or expertise

## Before the draft publishes

Check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.