Module 3: Governance & Risk Management · BoK III.A
Aligning risk strategies
Last reviewed:
New AI risk processes must slot into existing risk machinery. Determine whether AI increases existing risks or introduces new ones, decide who is ultimately responsible, and capture it all in a preliminary analysis report → if strategies don't intersect, gaps get exploited.
New AI risk processes must slot into the risk machinery the organisation already runs. Misaligned strategies leave exploitable gaps.
- Understand the existing risk programmes and what they mitigate
- Determine whether planned AI use increases existing risks or introduces new ones, and whether programmes need adjusting
- An organisation may run operational, security, privacy and business risk strategies each with an AI component, or one separate, holistic AI risk management strategy
- If strategies do not intersect, gaps may be exploited
- Conduct a risk analysis and determine contributing factors
- Determine which risks can be mitigated
- Establish who is ultimately responsible for risks, mitigation and any system failures after implementation
- Capture it all in a preliminary analysis report → fold into the data management plan, privacy impact assessments or authority-to-operate process
Keep going - free
Every study note on this site is free. So are these: