AI in control

Being in control means that material risks have defined control objectives, controls are implemented and owned, their operation produces evidence, exceptions trigger action, and the residual risk is periodically reviewed by someone with the authority to accept it.

Every word in that sentence carries weight. Objectives make controls testable. Ownership makes failure someone's problem. Evidence makes the claim verifiable. Exceptions with follow-up separate a monitored control from a decorative one. And the residual-risk review is where the organization, not the control, decides whether the remaining exposure is acceptable.

Risk management determines what needs to be controlled. Control management determines how the organization keeps that risk within its accepted boundaries and proves that it did.

The translation runs through a fixed chain: a risk scenario describes what can go wrong; a control objective states which outcome must hold; a control activity is the concrete measure; a control owner answers for its operation; evidence shows the activity took place; and the residual-risk decision confirms whether what remains is acceptable.

Risk management bridges governance and control. Governance design sets the method, the risk appetite, and the authority to accept risk; execution applies them to individual systems and tests whether the treatments work. That is why the AI risk management cornerstone anchors this section and appears in the governance reading route: it belongs to both sides of the line.

One loop organizes everything in this section: design, implement, operate, verify, report, improve. Each step answers a question.

Design: would the control address the identified risk if it operated as intended? Implement: has the control been configured, assigned, documented, and embedded in the process? Operate: is the control performed at the required frequency, for the complete relevant population? Verify: what testing shows that the control operated and produced the intended result? Report: who receives the results, the exceptions, and the residual-risk information? Improve: what changes when the control fails, the system changes, or the risk grows?

The loop is not a framework of this site's making. It is established internal control and assurance practice, applied to AI.

Design effectiveness asks whether the control is capable of addressing the risk. It is assessed before a control is relied upon and reassessed after material change: a system update, a new use, a changed risk, a control failure, or new law. Operating effectiveness asks whether the control actually operated over the relevant period, for the required population, with demonstrable follow-up when exceptions occurred. It is established through evidence produced continuously: monitoring results, control test outcomes, incident records, and the response to each.

Certification and, where applicable, third-party conformity assessment provide external checkpoints on these claims. Other conformity assessment routes remain the provider's own documented assessment, which makes the internal evidence chain more important, not less.