Defining the scope

The organization sets out the scope of each risk management activity (ISO 31000:2018, 6.3.2): its objectives and the outcomes expected, the period and places covered, what is in and out, the tools and techniques, the resources and who is responsible, and how it connects with other projects, processes and activities. The step before 6.3.2 supplies its input, so run both together.

What it asks

The organization sets out the scope of each risk management activity (ISO 31000:2018, 6.3.2): its objectives and the outcomes expected, the period and places covered, what is in and out, the tools and techniques, the resources and who is responsible, and how it connects with other projects, processes and activities. For AI the scope names the system, its intended use and users, and where it fits among the organization's other activities.

Where generative AI changes the answer

The scope decision that causes most trouble is whether a bought copilot embedded in another product is in scope, because no one on the team owns it.

Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use. For 6.3.2 the named role is the owner of scope statement naming the AI system, intended use and exclusions.

Evidence an auditor normally samples

• Scope statement naming the AI system, intended use and exclusions

The test you can run

Compare scope statement naming the AI system, intended use and exclusions with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Scope silent on which uses of the system are covered

Before the draft publishes

For 6.3.2, run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template. The first artefact to produce is scope statement naming the AI system, intended use and exclusions.

Where this sits against the draft

6.3.2 carries the risk management process part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 6.3.2 (defining the scope) with this record and note the change in the register.