The NIST AI RMF for AI auditors and the AAIA

NIST's AI Risk Management Framework is the most widely cited voluntary framework for managing AI risk, and an AI auditor meets it constantly: in policies that claim to follow it, in risk registers organized by its functions, and in vendors' assurances. ISACA's AAIA exam content outline never names it, or any other framework, yet seven of our 18 AAIA lessons use it, because an auditor needs criteria and the RMF is one of the most common an organization adopts. This guide is about the framework from the auditor's side: when it becomes criteria, how its four functions turn into a map of the evidence to ask for, what its generative AI profile adds, and what is changing.

The short answer

• Voluntary, until an organization adopts it. NIST says "The Framework is intended to be voluntary". Once an organization commits to it, in a policy, a contract or a public statement, it is a yardstick an auditor can apply.
• Four functions. Govern, Map, Measure and Manage, with Govern running through the other three.
• Seven characteristics of trustworthy AI, from "valid and reliable" to "fair with harmful bias managed".
• Not a checklist. In NIST's words, "Actions do not constitute a checklist, nor are they necessarily an ordered set of steps."
• A generative AI profile. NIST AI 600-1 applies the framework to generative AI and names 12 risks, from confabulation to information security.
• A revision is under way. NIST's page says "The AI RMF 1.0 is being revised as part of the White House AI Action Plan."
• Not named by ISACA. The AAIA's outline lists topics, including "Leading Practices, Ethics, Regulations, and Standards for AI", but no specific framework.

Why an AI auditor needs it

ISACA's outline tells you what the AAIA examines: three domains, 17 topics and 23 tasks, most of them beginning "Evaluate". It does not tell you what to evaluate against. That is the auditor's oldest problem: a finding is the gap between what is and what should be, and the standard for what should be has to come from somewhere the organization accepts.

For AI, that somewhere is often the NIST AI RMF. It is free, it is written for organizations "of all sizes and in all sectors", and it is general enough to fit any AI system. Its basics, its characteristics and its structure are covered in our NIST AI RMF guide for AAISM candidates, written for security managers, and our NIST AI RMF guide for the AIGP, written for governance professionals. This guide takes the auditor's angle and does not repeat them.

From a voluntary framework to audit criteria

NIST is clear that the framework imposes nothing on its own: "The Framework is intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic". An auditor therefore cannot hold an organization to it just because it exists. What changes that is adoption. When a board-approved policy says the organization manages AI risk in line with the RMF, or a contract promises it, the framework becomes the organization's own stated standard, and a gap against it is a finding.

Adoption also has a scope, which the auditor has to establish before testing. NIST expects organizations to adopt the framework selectively: "Some organizations may choose to select from among the categories and subcategories; others may choose and have the capacity to apply all categories and subcategories." So the first question is not whether the organization follows the RMF, but which parts of it the organization committed to, and for which systems. A claim of alignment with no record of which outcomes were adopted is itself worth reporting, because it cannot be tested.

Profiles are where that scope often lives. NIST describes "AI RMF use-case profiles" as "implementations of the AI RMF functions, categories, and subcategories for a specific setting or application based on the requirements, risk tolerance, and resources of the Framework user". An organization that has written a profile for, say, its hiring tools has written down its criteria, which makes the auditor's job easier.

The four functions as a map of evidence

NIST organizes the framework's outcomes into four functions. "Governance is designed to be a cross-cutting function to inform and be infused throughout the other three functions", and NIST notes that after Govern, most users start with Map and continue to Measure or Manage. Read from the auditor's side, each function points to a different kind of evidence. The descriptions below are NIST's; the evidence to ask for is our suggestion.

Govern

Govern is the culture, policy and accountability layer that the other functions rest on. Evidence to ask for: the AI policy and who approved it, named roles and accountability for AI risk, the inventory of AI systems in scope, training records, and the policies that cover third-party models and data.

Map

"The MAP function establishes the context to frame risks related to an AI system." This is the function most often thin in practice, because it is documentation of purpose rather than technology. Evidence to ask for: each system's documented purpose and intended users, the setting it runs in, who it could affect and how, and the assumptions and limits its builders recorded. Without this context, the tests in Measure have nothing to be judged against.

Measure

NIST's Measure function analyzes and tracks the risks that Map identified, and it is direct about timing: "AI systems should be tested before their deployment and regularly while in operation." It also speaks to independence, which an auditor will recognize: "Processes for independent review can improve the effectiveness of testing and can mitigate internal biases and potential conflicts of interest." Evidence to ask for: test plans and results before release, the metrics tracked in production, and who reviewed them.

Manage

Manage is where risks are prioritized and acted on. "Risk treatment comprises plans to respond to, recover from, and communicate about incidents or events." Evidence to ask for: the decisions taken on identified risks, monitoring after deployment, incident records and the communication that followed them.

One caution from NIST shapes how to use all four: the actions in the framework "do not constitute a checklist". An auditor using the RMF as criteria tests whether the outcomes the organization committed to are achieved, not whether every listed action was performed.

The seven characteristics as a test of balance

NIST lists what it means by trustworthy: "Characteristics of trustworthy AI systems include: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed." For an auditor, the useful point is that these characteristics pull against each other, so an organization has to decide how to balance them for each system, and that decision should be documented. A model tuned only for accuracy, with no recorded view on explainability or fairness, has not been managed against the framework it claims, whatever its accuracy.

The generative AI profile

NIST AI 600-1 applies the framework to generative AI. NIST describes the RMF it builds on as released in January 2023 and "intended for voluntary use", and the profile keeps the same four functions while adding suggested actions for generative systems. Its core contribution for an auditor is a list of 12 risks that generative AI creates or makes worse:

1. CBRN information or capabilities
2. Confabulation
3. Dangerous, violent, or hateful content
4. Data privacy
5. Environmental impacts
6. Harmful bias or homogenization
7. Human-AI configuration
8. Information integrity
9. Information security
10. Intellectual property
11. Obscene, degrading, and/or abusive content
12. Value chain and component integration

Not every risk applies to every system, and that is the auditor's first use of the list: as a prompt to ask which of the 12 the organization considered for a given system, and why it set others aside. A customer-facing assistant raises confabulation and information integrity at once; a system built on a vendor's foundation model raises value chain and component integration; any system that reads untrusted input raises information security. Our OWASP guide for AAISM candidates covers the security side in depth.

What is changing

NIST's AI RMF page now carries a notice: "The AI RMF 1.0 is being revised as part of the White House AI Action Plan." The framework in force is still AI RMF 1.0, released in January 2023, and the generative AI profile still builds on it. For an auditor, the practical step is to name the edition. A finding judged against the NIST AI RMF in general is weaker than one judged against a named edition, AI RMF 1.0 of January 2023, because a revision can move the criteria, and an organization that adopted the framework may need to decide whether its commitment follows the new edition.

How the RMF meets the AAIA's outline

ISACA's outline does not map its tasks to any framework, but the fit is close, and the mapping below is ours. Tasks such as evaluating "the organization's AI policies and procedures, including compliance with legal and regulatory requirements" and "whether the organization has defined ownership of AI-related risk, controls, procedures, decisions, and standards" sit naturally under Govern. Evaluating "the impact of AI solutions on system interactions, environment, and humans" is Map's territory. Measure covers "the monitoring and reporting of metrics (e.g., KPIs, KRIs) specific to AI", and Manage "the organization's problem and incident management programs specific to AI".

That is why the RMF is useful exam preparation even though the exam never names it: it gives you a structure for the judgments the tasks ask you to make.

How the RMF shows up in a question

AAIA questions rarely ask you to recite a framework. They ask you to recognize what is missing, from the auditor's chair:

Where to start

Frameworks are easier to learn in use than in the abstract. Our AAIA lessons on AI risk management, governance, standards and audit planning use the RMF where it helps, and each lesson's questions test the judgment rather than the vocabulary. A free account opens AI models and requirements in full, lessons, questions and flashcards, so you can see how the course handles frameworks before paying; full access is a single payment with nothing to renew. For what the outline covers topic by topic, see the AAIA exam content outline explained.