Selection of risk treatment options

Choosing treatment weighs what an option gains against its cost, effort and drawbacks, and options can be combined (ISO 31000:2018, 6.5.2). In practice the record is selected treatment options per AI risk with the rationale. The step before 6.5.2 supplies its input, so run both together.

What it asks

Choosing treatment weighs what an option gains against its cost, effort and drawbacks, and options can be combined (ISO 31000:2018, 6.5.2). They are: not starting or stopping the activity so the risk is avoided; accepting or increasing risk in pursuit of an opportunity; eliminating the source; altering likelihood; altering consequences; sharing the risk, for example by contract or insurance; and keeping the risk by an informed decision. For AI, eliminating a source or altering likelihood can mean changing the data, the model, how much is automated or the human oversight, and sharing can mean contract terms with AI suppliers and users.

Where generative AI changes the answer

The treatment menu runs from avoiding the use, through retrieval and output controls and human review, to transferring risk to a supplier by contract.

Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use. For 6.5.2 the named role is the owner of selected treatment options per AI risk with the rationale.

Evidence an auditor normally samples

• Selected treatment options per AI risk with the rationale

The test you can run

Compare selected treatment options per AI risk with the rationale with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Every AI risk 'accepted' with no option considered

Before the draft publishes

For 6.5.2, run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template. The first artefact to produce is selected treatment options per AI risk with the rationale.

Where this sits against the draft

6.5.2 carries the risk management process part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 6.5.2 (selection of risk treatment options) with this record and note the change in the register.