Generative AI can help businesses create content, analyze information, write code, and automate routine tasks. But it also introduces risks that traditional software controls may not fully address. An AI assistant might invent legal citations, expose confidential information, or generate misleading content that employees mistake for fact. The NIST AI RMF Generative AI Profile helps identify and manage these risks. Published as NIST AI 600-1 in...
Read More
Artificial intelligence is increasingly influencing decisions that affect customers, employees, patients, and entire communities. Financial institutions use AI to evaluate credit applications, healthcare providers deploy algorithms to support clinical decisions, and businesses integrate generative AI into customer service, recruitment, and operational workflows. These applications create opportunities for greater efficiency and innovation, but they also introduce consequences that organizations must understand before deploying AI systems. An AI system...
Read More
Artificial intelligence is becoming part of everyday business operations, influencing how organizations assess risks, serve customers, manage employees, and make important decisions. As AI adoption expands, businesses face growing expectations to demonstrate that their systems operate responsibly and that potential consequences have been properly evaluated. An AI system may deliver accurate technical results while still creating unintended consequences for individuals, communities, or organizations. Automated recruitment tools...
Read More
COBIT and COSO both help organizations improve governance, manage risk, and strengthen controls. However, they address different needs. COBIT focuses on governing and managing enterprise information and technology, while the COSO internal control framework provides a structure for designing and evaluating controls across operations, reporting, and compliance. Organizations do not necessarily have to choose one over the other. They can use COSO to establish internal control...
Read More
An internal control system does not operate in one department or support only one type of objective. Controls can apply to financial reporting, operations, and compliance across different levels of an organization. The COSO cube illustrates this relationship. It brings together three dimensions of internal controls: objectives, components, and organizational structure. The model shows how the five components of internal control apply across different objectives and...
Read More
An effective internal control system needs more than individual policies or control activities. Organizations also need the right oversight, risk assessment, information, communication, and monitoring processes to make those controls work. The COSO internal control framework organizes these requirements into five components and 17 principles. The 2013 framework uses these principles to make the requirements for effective internal control more explicit and to provide a structure...
Read More