AI System Resources Management Procedure

Document control

Document ID: B-004

Author(s): GRC & Compliance Team

Version: 1.0

Date: 09-Nov-2026

Disclaimer:

This controlled document is intended for authorized SecureXcel use. It may not be reproduced, distributed, quoted, or disclosed outside its approved audience without prior authorization from the document owner.

Document Details

Revision History

1. INTRODUCTION

1.1 Purpose (B.3.1 Objective)

The core purpose of this procedure is to establish clear accountability within the organization to uphold its responsible approach for the implementation, operation, and management of AI systems. This is achieved by:

1. 1. Defining and allocating specific AI-related roles and responsibilities (Control A.3.2).
2. 2. Establishing a robust, confidential mechanism for reporting concerns about any AI system throughout its life cycle (Control A.3.3).

1.2 Scope

This procedure applies comprehensively to:

The entire organizational structure responsible for developing, providing, procuring, or using AI systems within the defined scope of the AIMS.

1. 1. All employees, contractors, and other vendors working under the organization’s control (including suppliers and partners where contractually applicable).
2. 2. All stages of the AI System Life Cycle (from conception and design through decommissioning).

1.3 Objectives

The primary objectives are to ensure:

1. 1. Accountability (B.3.1): Roles and responsibilities are defined and allocated to ensure accountability for all relevant areas (e.g., risk management, human oversight, data quality).
2. 2. Statutory Compliance (5.3): Board assigns and communicates the responsibility for AIMS conformance and performance reporting.
3. 3. Risk Mitigation: The roles defined are adequately resourced with the necessary competence (7.2) to mitigate identified AI risks.
4. 4. Effective Reporting (A.3.3): A confidential and accessible process exists to escalate concerns, ensuring effective protection from reprisals (B.3.3 f).

2. ROLES, RESPONSIBILITIES, AND AUTHORITIES

3. PROCEDURE FOR DEFINING AI ROLES AND RESPONSIBILITIES

This phase ensures that organizational accountability is clearly defined and allocated according to the risks posed by AI systems (B.3.2).

3.1 Identify Necessary AI Function Areas

The AI Policy Owner shall conduct a foundational analysis to identify all necessary function areas that require defined roles and responsibilities. This step ensures that all relevant areas from B.3.2 are covered:

1. 1. Governance & Oversight: Risk Management, AI System Impact Assessments (A.5), Security, Safety, Privacy.
2. 2. Technical Life Cycle: Development, Testing/Verification, Deployment, Performance Monitoring (A.6.2.6), Data Quality Management (A.7).
3. 3. Operational: Human Oversight (B.9.3), Supplier/Customer Relationships (A.10).
4. 4. Compliance: Legal conformance, Concern Reporting (A.3.3).

3.2 Define AI Roles and Allocate Responsibilities (Control A.3.2)

Based on the function areas (5.1), the AI Policy Owner shall define the specific roles and responsibilities.

1. 1. Draft Role Definitions: Draft detailed responsibilities for key roles, such as AI System Owner, Data Scientist, AI Auditor, AI Ethics Reviewer, and Ethics & Concerns Officer.
2. 2. RACI Allocation: Utilize the RACI (Responsible, Accountable, Consulted, Informed) framework (Appendix A) to map responsibilities for critical AI processes (e.g., AI Risk Assessment, Impact Assessment, Model Deployment). The 'Accountable' designation shall ensure accountability is assigned to the appropriate level (B.3.2).
3. 3. Responsibility Granularity: Ensure responsibilities are defined at the level appropriate for the individuals to perform their duties (B.3.2). For example, the AI System Owner is Accountable for safety, but the AI Tester is Responsible for verifying safety requirements.

3.3 Formal Approval and Communication (Clause 5.3)

1. 1. Internal Review: The draft Roles Matrix (Appendix A) and associated job descriptions shall be reviewed and approved by the AI Policy Owner and HR to ensure they align with existing organizational structure and labor laws.
2. 2. Strategic Validation: The matrix for High-Risk AI Systems shall be validated by the AIGC Committee to ensure the accountability structure is sufficient for the risk exposure.
3. 3. Board Approval: The final Roles Matrix and definitions are submitted to Board for final approval as mandated by Clause 5.3.
4. 4. Communication: All defined roles and responsibilities shall be formally communicated within the organization, including through updated job descriptions, training sessions, and the internal AIMS documentation portal (5.3).

4. PROCEDURE FOR REPORTING AND RESOLVING CONCERNS

This phase ensures a formal and effective process for reporting concerns about AI systems throughout their life cycle, maintaining confidentiality and integrity (Control A.3.3).

4.1 Establish Reporting Mechanism (Control A.3.3)

The Ethics & Concerns Officer (B.3.3 c) shall ensure the following reporting mechanisms are established and promoted to all employees and contractors (B.3.3 b):

1. 1. Confidential Line: A dedicated phone line or secure online form managed by the Ethics & Concerns Office, offering options for confidentiality or anonymity, or both (B.3.3 a).
2. 2. Direct Channels: Direct reporting options to line management, the AI Policy Owner, the AI System Owner, or HR for non-anonymous concerns.
3. 3. Accessibility: The mechanism shall be easily available and proactively promoted to all relevant personnel, including clear communication of protection from reprisals (B.3.3 f).

4.2 Receiving, Logging, and Triage

1. 1. Receipt and Logging: The Ethics & Concerns Officer (B.3.3 c) receives the concern, immediately logs it in the Concern Investigation Log (Appendix C), and assigns a unique ID.
2. 2. Confidentiality Preservation: The officer ensures that all identifying details (if provided) are handled strictly according to the confidentiality protocol established by the HR department (B.3.3 g, respecting B.3.3 a).
3. 3. Triage and Classification: The officer classifies the concern based on severity and potential impact (e.g., Minor, Significant, Critical) and determines the appropriate investigation team.
4. 4. Acknowledgment: The reporter (if not anonymous) receives an acknowledgment of receipt within a documented time frame (e.g., 48 hours).

4.3 Investigation and Resolution (B.3.3 c, d)

The Ethics & Concerns Officer shall lead or delegate the investigation, ensuring it is staffed with qualified personnel (B.3.3 c) and follows these steps:

1. 1. Initial Assessment: Determine the scope, collect necessary audit evidence (event logs, design documents, data provenance records), and identify affected parties (A.3.3).
2. 2. Fact Finding: Conduct interviews and analysis. If the concern relates to personnel or reprisal, the Head of HR shall be involved.
3. 3. Determination: Conclude whether the concern is substantiated and identify the root cause (e.g., policy failure, human error, competence gap).
4. 4. Resolution: Define corrective and preventative actions (10.2). If the resolution requires a change to the AI system (e.g., model retraining), the AI System Owner is responsible for implementation.

4.4 Escalation and Management Reporting (B.3.3 e, g)

1. 1. Escalation Thresholds: The organization shall define specific thresholds for when a concern shall be escalated to the AIGC Committee and/or Board (B.3.3 e). Thresholds can include:
   • Concerns classified as Critical Severity.
   • Concerns involving confirmed legal nonconformity.
   • Concerns involving confirmed reprisal against a reporter.
2. 2. Reporting: The Ethics & Concerns Officer provides aggregate reports on concerns (while maintaining confidentiality) to the AIMS Manager for inclusion in the Management Review Inputs (9.3) and provides reports to relevant managers and the AIGC Committee (B.3.3 g).

4.5 Protection from Reprisals (B.3.3 f)

This is a critical control. The organization shall provide for effective protection from reprisals for both the persons concerned with reporting and investigation (B.3.3 f).

1. 1. HR Protocol: HR establishes a zero-tolerance policy against reprisal.
2. 2. Reporter Protection: HR ensures that reporters (anonymous or not) are protected from detrimental actions.
3. 3. Disciplinary Action: Any confirmed case of reprisal will result in immediate disciplinary action up to and including termination, managed by the HR department.

5. PROCESS MAP: CONCERN REPORTING AND RESOLUTION

This flowchart details the steps required for receiving, investigating, and escalating concerns (Section 6).

APPENDIX A: AI ROLES AND RESPONSIBILITIES MATRIX (A.3.2)

This matrix maps accountability (A) for critical AI control topics and processes to ensure accountability is defined throughout the organization (B.3.2).

RACI Key: Responsible, Accountable, Consulted, Informed

APPENDIX B: CONCERN REPORTING CLASSIFICATION CRITERIA (A.3.3)

The Ethics & Concerns Officer uses these criteria during the triage process (Section 6.2) to classify severity and determine investigation staffing and escalation requirements (B.3.3 e).

B.1 Severity Classification Table

B.2 Specific Concern Categories

Concerns shall be categorized to enable accurate reporting and trend analysis (B.3.3 g).

APPENDIX C: CONCERN INVESTIGATION LOG TEMPLATE (A.3.3, 7.5)

This template serves as the documented evidence of results achieved (7.5.1 b) for the Concern Reporting Process. All entries shall be logged and maintained by the Ethics & Concerns Officer (B.3.3 g).

APPENDIX D: PROCEDURE EFFECTIVENESS METRICS (9.1)

The AIMS Manager shall monitor the following Engineering LeadIs, related to B.3 control objectives, and report them during the Management Review (9.3) to assess the effectiveness of this procedure.

6. CONTINUAL IMPROVEMENT OF THE PROCEDURE (10.1)

This procedure itself is subject to continual improvement (10.1). The AI Policy Owner shall recommend updates based on the following:

1. 1. Audit Feedback: Internal or external audit observations related to the efficiency, resource consumption, or adherence to this procedure, particularly the clarity of role definitions or the efficiency of the investigation process.
2. 2. Process Performance: Analysis of the Procedure Effectiveness Metrics (Section 11) where targets are consistently missed (e.g., low Reporting Rate, indicating a failure in trust or promotion).
3. 3. Lessons Learned: Insights gathered from the Nonconformity and Corrective Action process (10.2), particularly relating to systemic failures traceable to ambiguous responsibilities or a failure to report a known concern.
4. 4. ISO 37002 Alignment: Periodic review to ensure alignment with best practice guidelines for whistleblowing management systems.

7. REFERENCES AND DEFINITIONS

7.1 External References

• IS/ISO/IEC 42001:2023 – Information technology – Artificial Intelligence – Management System (AIMS)
  • Clause 5.3 (Roles, responsibilities and authorities)
  • Annex B.3 (Implementation guidance for AI controls - Internal organization)
  • Control A.3.2 (AI roles and responsibilities)
  • Control A.3.3 (Reporting of concerns)
• ISO 37002 (Whistleblowing management systems - Guidelines)
• Relevant Labor Laws and Organizational Codes of Conduct (for protection from reprisals)

7.2 Key Definitions

More in AI lifecycle, suppliers and operations

• AI System Lifecycle Management Procedure
• AI Model Card and User Documentation
• Supplier and Third-Party AI Assessments