NIST AI RMF mapping
The governance questions in GAAPx are informed by the NIST AI Risk Management Framework. This page shows which framework function each question sits under. The mapping is at function level only: Govern, Map, Measure and Manage.
Draft wording
The question wording is draft and will be refined. The question ids stay fixed once published, so a reworded question keeps its id.
The eight questions
Each function has an Intent question (written down) and a Tested question (evidence it works). A must-have item is a question that must be answered Yes. If it is not, the level is AI on hold. See governance and AI risk.
| Id | NIST function | Level | Required gate | Plain meaning |
|---|---|---|---|---|
| gov.govern.owner.intent | Govern | Intent | Yes | A named person is responsible for approving how AI is used in finance. One owner or approver, not a committee. |
| gov.govern.owner.tested | Govern | Tested | No | You can show that this person approved or refused an AI use in the last year. A sign-off, ticket or email is enough. |
| gov.map.inventory.intent | Map | Intent | No | There is a list of where AI is used in finance and what data it sees. A simple list is fine. |
| gov.map.inventory.tested | Map | Tested | No | You have checked that list against what people really use, for example by asking the team or checking tool accounts. |
| gov.measure.checks.intent | Measure | Intent | No | You have defined how AI output is checked for errors and quality, for example a sample review or a tie-out to the ledger. |
| gov.measure.checks.tested | Measure | Tested | No | You have run those checks and kept results you could show to an auditor. |
| gov.manage.stop.intent | Manage | Intent | Yes | There is a way to roll back or stop AI work, and a trail of what it did. Either an audit trail or a stop path counts. |
| gov.manage.stop.tested | Manage | Tested | No | You have used the monitoring or the stop path, even as a test. A drill counts. |
How answers count
- Answers are Yes, Partly, No or Not sure.
- Not sure counts as not met.
- Partly does not meet a required gate.
- Governance never feeds the GAAPx Score and carries no weights.
What this is not
What this is not
- It is not a NIST certification.
- It makes no claim of alignment, compliance or endorsement.
- It does not use NIST subcategory identifiers. The mapping stops at the four functions.
- It does not replace a legal, audit or risk review.
The wording is "informed by the NIST AI Risk Management Framework".