Risk evaluation

Evaluation sets the analysis results against the risk criteria to decide where more needs to be done (ISO 31000:2018, 6.4.4); the outcome may be to do nothing more, to look at treatment options, to analyse further, to keep existing controls or to revisit objectives. The step before 6.4.4 supplies its input, so run both together.

What it asks

Evaluation sets the analysis results against the risk criteria to decide where more needs to be done (ISO 31000:2018, 6.4.4); the outcome may be to do nothing more, to look at treatment options, to analyse further, to keep existing controls or to revisit objectives. For AI, effects on individuals and society and on the AI objectives carry weight alongside effects on the organization.

Where generative AI changes the answer

Evaluation compares the assessed risk with criteria the organisation set before the pilot, which is why the criteria belong in the record first.

Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use. For 6.4.4 the named role is the owner of evaluation record comparing each AI risk to the criteria with the decision taken.

Evidence an auditor normally samples

• Evaluation record comparing each AI risk to the criteria with the decision taken

The test you can run

Compare evaluation record comparing each AI risk to the criteria with the decision taken with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Risks accepted with no comparison to stated criteria

Before the draft publishes

For 6.4.4, run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template. The first artefact to produce is evaluation record comparing each AI risk to the criteria with the decision taken.

Where this sits against the draft

6.4.4 carries the risk management process part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 6.4.4 (risk evaluation) with this record and note the change in the register.