問題文
An enterprise wants to evaluate whether its AI controls are working. What is the most appropriate first step?
選択肢
- Test a sample of each control's operation over the past twelve months and record the exceptions found so that the evaluation is based on evidence of actual performance rather than on documented intent.
- Benchmark the control set against a recognized AI control framework and record the controls that the enterprise does not yet have in place as gaps to be remediated.
- Establish which risk each control is intended to address.
- Ask each control owner to self-assess whether their control is operating as intended and to record the result in the control repository for review.