Recording and reporting

The process and what comes out of it are written down and reported (ISO 31000:2018, 6.7), so that activities and results are shared across the organization, decision-makers have information, risk management gets better, and dealings with stakeholders, including those accountable for risk, are supported. The step before 6.7 supplies its input, so run both together.

What it asks

The process and what comes out of it are written down and reported (ISO 31000:2018, 6.7), so that activities and results are shared across the organization, decision-makers have information, risk management gets better, and dealings with stakeholders, including those accountable for risk, are supported. For AI the organization decides what to record about each system's risks and treatments and what regulators, customers and affected people need to be told.

Where generative AI changes the answer

The record that matters is the one that lets someone reconstruct why an output was accepted, months later, with the versions that produced it.

Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use. For 6.7 the named role is the owner of records of AI risk assessments and treatments; reports to stakeholders and regulators.

Evidence an auditor normally samples

• Records of AI risk assessments and treatments; reports to stakeholders and regulators

The test you can run

Take records of AI risk assessments and treatments; reports to stakeholders and regulators and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.

Common failures

• AI risk decisions with no record of who decided what and why

Before the draft publishes

For 6.7, run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template. The first artefact to produce is records of AI risk assessments and treatments; reports to stakeholders and regulators.

Where this sits against the draft

6.7 carries the risk management process part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 6.7 (recording and reporting) with this record and note the change in the register.