Home / Requirement record / 6.4.2.5
6.4.2.5
Identification of controls
The organization should identify the controls already in place that affect the AI risk, including technical measures in the system, organizational measures around it and the human oversight applied, and how effective they are. The artefact behind the answer is register of existing controls per AI system with their effectiveness. The step before 6.4.2.5 supplies its input, so run both together.
- What it asks
- The organization should identify the controls already in place that affect the AI risk, including technical measures in the system, organizational measures around it and the human oversight applied, and how effective they are.
- Where generative AI changes the answer
- Controls for generative AI are layered, from retrieval filters and output checks to a named human who signs off before the output is used.
- Who it binds
- The AI risk owner, the assessment team and the business owner of each generative AI use. For 6.4.2.5 the named role is the owner of register of existing controls per AI system with their effectiveness.
- Evidence an auditor normally samples
- Register of existing controls per AI system with their effectiveness
- The test you can run
- Ask for register of existing controls per AI system with their effectiveness and for its last review date; an artefact nobody can date is paperwork rather than a control.
- Common failures
- Existing controls assumed effective without evidence
- Before the draft publishes
- For 6.4.2.5, run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template. The first artefact to produce is register of existing controls per AI system with their effectiveness.
- Where this sits against the draft
- 6.4.2.5 carries the risk management process part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 6.4.2.5 (identification of controls) with this record and note the change in the register.