Evaluation

At intervals the organization checks the framework's performance against what it is for, the plans for putting it in place, its indicators and the behaviour expected of it, and judges whether it is still fit to help reach the objectives (ISO 31000:2018, 5.6). Test it on the 5.6 question at the next framework review.

What it asks

At intervals the organization checks the framework's performance against what it is for, the plans for putting it in place, its indicators and the behaviour expected of it, and judges whether it is still fit to help reach the objectives (ISO 31000:2018, 5.6). For AI the question is whether the framework has kept pace with changes in the organization's AI systems, how they are used and the rules around them.

Where generative AI changes the answer

Evaluation asks whether the risk work changed what the organisation deploys, not whether the workshop happened.

Who it binds

Top management, the AI risk owner and the functions that supply resources and communication. For 5.6 the named role is the owner of periodic evaluation of the AI risk management framework with indicators.

Evidence an auditor normally samples

• Periodic evaluation of the AI risk management framework with indicators

The test you can run

Take periodic evaluation of the AI risk management framework with indicators and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.

Common failures

• Framework never re-examined after the first AI deployment

Before the draft publishes

For 5.6, check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one. The first artefact to produce is periodic evaluation of the AI risk management framework with indicators.

Where this sits against the draft

5.6 carries the framework: leadership, integration and improvement part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 5.6 (evaluation) with this record and note the change in the register.