Preparing and implementing risk treatment plans

Treatment plans set out how the chosen options will be put into effect, so that everyone involved understands the arrangements and progress can be tracked (ISO 31000:2018, 6.5.3): the reasons for the choice, who is accountable for approving and carrying it out, the actions, the resources, how performance will be measured, the constraints, what is reported and monitored, and when actions happen. The step before 6.5.3 supplies its input, so run both together.

What it asks

Treatment plans set out how the chosen options will be put into effect, so that everyone involved understands the arrangements and progress can be tracked (ISO 31000:2018, 6.5.3): the reasons for the choice, who is accountable for approving and carrying it out, the actions, the resources, how performance will be measured, the constraints, what is reported and monitored, and when actions happen. For AI the plans fit into the system's development and operating plans and its life cycle stages.

Where generative AI changes the answer

A treatment plan that names the control but not the owner, the date and the evidence is a wish list that an auditor cannot test.

Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use. For 6.5.3 the named role is the owner of treatment plans for AI risks with owners, actions and timing.

Evidence an auditor normally samples

• Treatment plans for AI risks with owners, actions and timing

The test you can run

Compare treatment plans for AI risks with owners, actions and timing with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Treatments agreed in a workshop and never planned or tracked

Before the draft publishes

For 6.5.3, run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template. The first artefact to produce is treatment plans for AI risks with owners, actions and timing.

Where this sits against the draft

6.5.3 carries the risk management process part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 6.5.3 (preparing and implementing risk treatment plans) with this record and note the change in the register.