Allocating resources

Appropriate resources should be allocated to managing risk: people with the skills and competence needed, processes, methods and tools, documented procedures, systems for managing information and knowledge, and professional development (ISO 31000:2018, 5.4.4). In practice the record is resource plan for AI risk management naming expertise, tools and capacity. Test it on the 5.4.4 question at the next framework review.

What it asks

Appropriate resources should be allocated to managing risk: people with the skills and competence needed, processes, methods and tools, documented procedures, systems for managing information and knowledge, and professional development (ISO 31000:2018, 5.4.4). For AI the specialized resources include AI and data science expertise, tooling for evaluating models and data, and the time and computing capacity that testing and monitoring AI systems demand.

Where generative AI changes the answer

The resource that runs short is evaluation capacity: people who can test an output, read a vendor's model card and keep the evidence.

Who it binds

Top management, the AI risk owner and the functions that supply resources and communication. For 5.4.4 the named role is the owner of resource plan for AI risk management naming expertise, tools and capacity.

Evidence an auditor normally samples

• Resource plan for AI risk management naming expertise, tools and capacity

The test you can run

Compare resource plan for AI risk management naming expertise, tools and capacity with the use as it runs today; the gap between the two is the finding to record.

Common failures

• AI risk evaluation attempted without model evaluation tooling or expertise

Before the draft publishes

For 5.4.4, check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one. The first artefact to produce is resource plan for AI risk management naming expertise, tools and capacity.

Where this sits against the draft

5.4.4 carries the framework: leadership, integration and improvement part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 5.4.4 (allocating resources) with this record and note the change in the register.