Join the waitlist
Glossary/IT and data

NIST AI Risk Management Framework

The NIST AI Risk Management Framework 1.0, released January 26, 2023, is a voluntary framework for managing AI risks through four functions: Govern, Map, Measure and Manage.

CORAA TeamUpdated November 5, 2026

Definition

NIST released the AI Risk Management Framework (AI RMF 1.0) on January 26, 2023. It is voluntary and is meant to help organizations that design, develop, deploy or use AI systems manage risks to people and organizations. The core has four functions: Govern, Map, Measure and Manage. NIST published a Generative AI Profile (NIST AI 600-1) on July 26, 2024, to apply the framework to generative AI.

Why it matters in an audit or review

Clients that use AI in financial reporting, such as for estimates or fraud detection, raise questions about governance and model reliability. Audit teams meet the framework when a client cites it as the basis of its AI governance. It is not an audit standard, so evaluating the client's use of AI still follows AU-C 315 and the standards on evidence.

Example

Illustrative: a client uses a model to estimate credit losses. The auditor asks how the model is governed, who validates it and how performance is measured, and relates the answers to the client's stated alignment with the AI RMF.

Common mistakes

  • Treating the framework as a certification.
  • Accepting an AI output as audit evidence without testing the data and the model's reliability.

Sources

Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error

Standards

NIST AI RMF 1.0

Related terms

  • Cybersecurity risk
    Cybersecurity risk in an audit is the chance that a breach, ransomware attack or system failure affects financial records, controls, going concern, or disclosures. It is assessed as part of IT and fraud risk.
  • Internal audit
    Internal audit is an independent, objective function inside an organization that gives the board and management assurance and advice on governance, risk management and control, guided by the IIA's Global Internal Audit Standards.
  • NIST Cybersecurity Framework
    The NIST Cybersecurity Framework is a voluntary framework for managing cybersecurity risk. Version 2.0, released February 26, 2024, organizes outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
  • Audit data analytics
    Audit data analytics is the use of automated tools and techniques to analyze whole populations of data for risk assessment, testing and anomaly detection, rather than relying only on samples.

Go deeper

All glossary terms →

For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required