AI Governance and Risk · Topic 5 of 6
AI Ethics and Leading Practices
Responsible AI for auditors: fairness, transparency, accountability, OECD AI Principles, NIST AI RMF and the Generative AI Profile as audit criteria.
- 5 min
- NIST AI RMF functions: Govern, Map, Measure, Manage; Govern is cross-cutting.
- The Generative AI Profile is NIST AI 600-1.
- OECD AI Principles: adopted 2019, updated 2024.
What it is
Responsible AI means designing and using AI in ways that are fair, transparent, accountable, safe and respectful of privacy and human rights. Ethics principles say what the organization stands for; leading practice frameworks turn those principles into activities that can be checked.
For the auditor, these frameworks are a source of audit criteria. A finding needs a criterion, and when no law applies, an adopted framework or the organization's own ethics policy provides it.
How it works
Core responsible AI principles
| Principle | What the auditor looks for |
|---|---|
| Fairness | Bias testing across relevant groups, with thresholds and actions |
| Transparency | People are told when AI is used; documentation explains how it works |
| Explainability | Decisions can be explained at the level users and regulators need |
| Accountability | Named owners, decision records, a way to challenge outcomes |
| Safety and robustness | Testing against failure, misuse and attack |
| Privacy | Lawful, minimal and protected use of personal data |
| Human oversight | People can monitor, intervene in and stop the system |
| Sustainability | Environmental cost is considered against benefit |
Ethics is only real when it reaches decisions. The auditor looks for evidence that an ethics review changed or stopped a project, or that an ethics concern was escalated and resolved.
OECD AI Principles
The OECD AI Principles were adopted in 2019 and updated in 2024. They are the first intergovernmental standard on AI and are widely used as a reference.
| Values-based principle | In short |
|---|---|
| Inclusive growth, sustainable development and well-being | AI should benefit people and the planet |
| Respect for the rule of law, human rights and democratic values, including fairness and privacy | Respect law, human rights, fairness and privacy |
| Transparency and explainability | Meaningful information about AI systems |
| Robustness, security and safety | AI should work reliably and safely throughout its life |
| Accountability | Those who build and run AI are accountable for it |
The OECD also gives recommendations to governments, such as investing in AI research and building human capacity.
NIST AI Risk Management Framework
The NIST AI RMF is a voluntary framework from the US National Institute of Standards and Technology. Its core has four functions.
| Function | Purpose | Example audit question |
|---|---|---|
| Govern | Culture, policies, roles and accountability; applies across all functions | Are AI risk roles and policies defined and followed? |
| Map | Establish context and identify risks for each AI system | Was the intended use, context and impact documented? |
| Measure | Analyse, assess and track risks with methods and metrics | Are performance, bias and robustness measured? |
| Manage | Prioritise and act on risks, including response and recovery | Are measured risks treated and monitored? |
NIST describes characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed.
The Generative AI Profile (NIST AI 600-1) applies the AI RMF to generative AI. It lists twelve risks that are unique to or worsened by generative AI, among them confabulation (confidently false output), information integrity, harmful bias or homogenization, data privacy, intellectual property and information security, with suggested actions mapped to the four functions.
Using frameworks as audit criteria
| Situation | Best source of criteria |
|---|---|
| A law applies | The legal requirement |
| The organization adopted a framework or standard | That framework, as adopted and tailored |
| Internal policy exists | The policy |
| None of these | Leading practice, agreed with management before fieldwork |
Agreeing criteria in advance avoids disputes later. The auditor should also check that the organization's adoption of a framework is real: mapped to controls, with owners, not just named in a policy.
A worked example
A media company says it follows the NIST AI RMF. The auditor finds a policy that names the framework, but no mapping of Map and Measure activities to its AI systems, and no measurement of bias or accuracy for its content recommendation model.
The finding is that the framework was adopted in name only. The criterion is the organization's own policy commitment. The recommendation is to map each AI RMF function to processes and owners, starting with high-risk systems.
How the exam asks about this
- "Which NIST AI RMF function addresses organizational culture, policies and accountability?" Govern.
- "What is the BEST source of criteria for auditing an AI system where no AI law applies?" The framework or standard the organization has adopted, together with its own policies.
- "Which is the BEST evidence that ethical AI principles are applied in practice?" Records showing ethics reviews influenced decisions, such as changes or rejections of AI proposals.
What to remember for the exam
- NIST AI RMF functions: Govern, Map, Measure, Manage; Govern is cross-cutting.
- The Generative AI Profile is NIST AI 600-1.
- OECD AI Principles: adopted 2019, updated 2024.
- Frameworks supply audit criteria when no law applies.
- Agree criteria with management before fieldwork.
An ethics statement on a website is not a control. Look for the process that applies it and the records that show it changed outcomes.
Common mistakes
Treating NIST AI RMF as mandatory. It is voluntary unless a contract, regulator or the organization's own policy makes it binding.
Mixing up Map and Measure. Map sets context and identifies risk; Measure assesses it with metrics.
Auditing against personal opinion. Every finding needs a stated criterion that management accepted.
Check yourself
What are the four functions of the NIST AI RMF core?
Govern, Map, Measure and Manage, with Govern applying across the other three.
What does the NIST Generative AI Profile add to the AI RMF?
It describes risks specific to or made worse by generative AI, such as confabulation, and suggests actions mapped to the four functions.
Why should audit criteria be agreed before fieldwork?
So findings rest on a standard management has accepted, which avoids disputes about whether a gap is real.
Topic 5 of 6 in AI Governance and Risk
Test yourself on AI Governance and Risk
The full ISACA AAIA question bank has 750 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.