Home / Requirement record / 6.4.2.4
6.4.2.4
Identification of potential events and outcomes
The organization should identify the events that the risk sources can give rise to and the outcomes they can produce for the assets identified, including outcomes the system's designers did not intend and outcomes that emerge from its interaction with people and other systems. The step before 6.4.2.4 supplies its input, so run both together.
- What it asks
- The organization should identify the events that the risk sources can give rise to and the outcomes they can produce for the assets identified, including outcomes the system's designers did not intend and outcomes that emerge from its interaction with people and other systems.
- Where generative AI changes the answer
- The credible events are concrete: a fabricated citation in a regulated filing, a customer record pasted into a public tool, a jailbreak that releases a restricted answer.
- Who it binds
- The AI risk owner, the assessment team and the business owner of each generative AI use. For 6.4.2.4 the named role is the owner of event and outcome scenarios per AI system.
- Evidence an auditor normally samples
- Event and outcome scenarios per AI system
- The test you can run
- Ask for event and outcome scenarios per AI system and for its last review date; an artefact nobody can date is paperwork rather than a control.
- Common failures
- Only failure events considered, with misuse and emergent behaviour omitted
- Before the draft publishes
- For 6.4.2.4, run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template. The first artefact to produce is event and outcome scenarios per AI system.
- Where this sits against the draft
- 6.4.2.4 carries the risk management process part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 6.4.2.4 (identification of potential events and outcomes) with this record and note the change in the register.