Continually improving

The organization keeps making the framework, and the way the process is woven into the organization, more fit for purpose, more adequate and more effective, drawing up plans and tasks as gaps and opportunities come to light (ISO 31000:2018, 5.7.2). Test it on the 5.7.2 question at the next framework review.

What it asks

The organization keeps making the framework, and the way the process is woven into the organization, more fit for purpose, more adequate and more effective, drawing up plans and tasks as gaps and opportunities come to light (ISO 31000:2018, 5.7.2). For AI, risks first discovered in use, what worked and what failed across the AI field, and new research all feed that improvement.

Where generative AI changes the answer

The improvement loop is only real if a bad output is traced back to the assessment, the criteria or the control that should have caught it.

Who it binds

Top management, the AI risk owner and the functions that supply resources and communication. For 5.7.2 the named role is the owner of improvement actions traced to lessons from AI systems in use.

Evidence an auditor normally samples

• Improvement actions traced to lessons from AI systems in use

The test you can run

Compare improvement actions traced to lessons from AI systems in use with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Incidents from AI systems never fed back into the framework

Before the draft publishes

For 5.7.2, check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one. The first artefact to produce is improvement actions traced to lessons from AI systems in use.

Where this sits against the draft

5.7.2 carries the framework: leadership, integration and improvement part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 5.7.2 (continually improving) with this record and note the change in the register.