Risk Management Program

[Application Provider/Orchestrated Service Provider/AI Customer] 
1. Establish AI Risk Ownership: Define clear ownership for AI-related risks within your organization, ensuring alignment with the provider's risk management strategies. 

2. Validate AI Model Usage: Identify key risks (e.g., data privacy, potential biases) in the AI solutions consumed and work with the provider to implement safeguards. 

3. Integrate AI Into ERM Processes: Incorporate AI-specific risk categories, such as accuracy, fairness, and explainability, into your existing ERM and governance frameworks. 

4. Conduct Independent (from Model Provider) Evaluations: Regularly assess critical AI solutions for performance, fairness, and security issues. Request evidence of the provider's compliance with internal risk management policies. 

5. Establish Incident Response Collaboration: Collaborate with the provider to handle AI-related incidents promptly. Document shared responsibilities for remediation, including communication and escalation procedures.

1. Program Examination
a. Verify that the organization has established a formal, documented AI Risk Management (AIRM) program that is approved and sponsored by senior leadership.
b. Confirm the AIRM program includes documented policies and procedures for identifying, evaluating, owning, treating, and accepting risks specific to CSP-operated AI infrastructure and services.

2. Program Assessment
a. Review documentation to assess whether the AIRM program addresses risks related to CSP-specific responsibilities such as model training environments, data leakage prevention, shared resource security, and customer-facing AI services.
b. Verify that risk ownership is defined and that responsibilities are assigned to accountable roles or functions within the CSP organization.

3. Program Evaluation
a. Assess whether risk treatment strategies (e.g., mitigation, transfer, acceptance) are documented and reviewed regularly in response to platform changes or emerging AI risks.
b. Confirm that the AIRM program includes processes for updating risk registers and communicating accepted risks to stakeholders.

4. Program Implementation Validation
a. Examine records of AIRM program reviews (e.g., risk register updates, leadership reviews) conducted at least annually or after significant changes to AI services.
b. Verify that identified issues or gaps in the risk management process are tracked, remediated, and closed in a timely manner.

From CCM:
1. Examine the policy and/or procedures related to the Enterprise Risk Management (ERM) program to determine whether the organization has developed a comprehensive strategy to manage risk to organizational operations and assets, and individuals.
2. Review ERM documentation, processes, and supporting evidence to confirm if the ERM program includes provisions for cloud security and privacy risk.  
3. Examine measure(s) that evaluate(s) the organization's compliance with the risk management policy and determine if the measure(s) address(es) implementation of the policy/control requirement(s) as stipulated in the policy level. 
4. Obtain and examine supporting evidence to determine if the office or individual responsible reviews the information and, if issues were identified, if they were investigated and remediated appropriately.