AI Risk Management
Writing a risk down does nothing to the risk.
What is AI risk management?
AI risk management means maintaining a short register of the AI risks that genuinely matter, each with a named person responsible, a way to detect it occurring, and a review that actually happens.
Most AI risk registers fail in the same three ways. They are too long to review, everything in them is rated medium, and the owner column says IT rather than a person. All three make the document unusable as a management tool.
Length is the one to fix first. A register with forty entries does not get reviewed, so nothing in it is managed. Six entries somebody actually looks at monthly will protect an organisation better than forty that nobody opens.
The rating question worth asking is not how severe something is in the abstract. It is whether you would have to explain it publicly, whether it would stop you operating, and whether you would even know it had happened.
Why we will shorten your register
Duara maintains AI risk registers for organisations in Kenya, kept short enough that they are actually used.
We will cut your register, and you may disagree with what we remove. A long register feels thorough and functions as a place risks go to be forgotten, which is worse than a short one that gets read.
Who this is for
- You assessed AI risk once and moved on
- AI use is spreading across departments
- Nobody owns AI risk specifically
- Your register has never been reviewed since it was written
Industries we serve
- Banking and financial services
- Insurance
- Healthcare
- Telecommunications
- Public sector
- Any organisation with a board asking questions
Problems this solves
These are the reasons risk registers exist without managing anything.
- Too long to review. A register nobody opens manages nothing, and length is the single most reliable predictor of whether it gets opened.
- Everything rated medium. A rating that applies to every entry conveys no information and provides no basis for deciding what to deal with first.
- Owned by a department. A risk assigned to IT or to operations is unowned, because departments do not attend meetings or answer questions.
- Risks nobody could detect. An entry with no way of knowing whether it has happened is not managed at any rating you give it.
What we deliver
A short register of risks that matter, each with a named owner, a detection method, an escalation threshold, and scheduled reviews that take place.
A register short enough to be reviewed
A named person against each risk
A way to detect each risk occurring
Escalation thresholds rather than judgement calls
Scheduled review dates
A record of new AI tools entering use
Features
- Deliberately short. Six entries somebody reads monthly protect you better than forty nobody opens, which is the trade most registers get backwards.
- Named owners. A person rather than a department, because departments do not attend reviews or answer for anything.
- Detection before rating. A risk you could not notice occurring is unmanaged whatever severity you assign it, so detection is settled first.
- Thresholds not judgement. A written trigger for escalation, since without one people wait to see whether it gets worse and it does.
- New tools tracked. Usage spreads between reviews, and a register describing last year systems is describing somebody else organisation.
Benefits
- The register gets used. Short enough to review means the reviews happen, which is the only thing separating management from documentation.
- Somebody answers for each risk. A named owner produces action in a way that a department name never has.
- You find out when it happens. Detection methods turn a risk from something you fear into something you would notice.
- Board questions have answers. A maintained register lets you say what you are doing about AI risk without assembling it the night before.
What a register has to contain
- A named owner. One person, not a department, since only people can be asked what they did about something.
- A detection method. How you would know it had happened, which most registers never record.
- An escalation threshold. The written point at which somebody senior is told, rather than a judgement made under pressure.
- A review date. Scheduled rather than intended, because intended reviews do not occur.
- A public exposure test. Whether you would have to explain this outside the organisation, which sorts risks better than severity scales.
- A tool inventory. What is actually in use, since AI adoption spreads faster than registers get updated.
Detection is the field most registers omit and the one that decides whether anything is genuinely managed. If you could not tell whether a risk had occurred, everything else in the row is decoration.
How the process works, step by step
Setting up a register takes two to three weeks. Maintaining it is the part that matters and the part organisations underestimate.
-
Step 1
Free position call
We look at what exists, including registers written during a project and never reopened.
-
Step 2
Risks cut to what matters
The list shortened deliberately, since a register that cannot be reviewed manages nothing in it.
-
Step 3
Owners named individually
A person against each entry, agreed with them rather than assigned in their absence.
-
Step 4
Detection and thresholds set
How each risk would be noticed and at what point somebody senior hears about it.
-
Step 5
Reviews scheduled
Dates in calendars rather than an intention to review periodically, which never survives a busy quarter.
Quality assurance and how we work
The commitments attached to a document meant to protect the organisation.
- We shorten registers rather than extend them. A long one feels thorough and works as a place risks go to be forgotten, which serves nobody.
- We say that recording a risk does nothing to it. A register is a management tool rather than a control, and the two get confused constantly.
- We insist on a person for each entry. Departments do not attend reviews, answer questions or take decisions, so a department owner is no owner.
- We will not build something you will not maintain. An abandoned register is worse than none, because it creates a belief that something is being managed.
- We ask what you would have to explain publicly. It is an uncomfortable question and it sorts risks far better than a severity scale does.
Frequently asked questions about AI risk management
What is wrong with our existing register?
Usually three things. Too long to review, everything rated medium, and the owner column naming a department rather than a person.
Why does length matter so much?
Because a register nobody opens manages nothing. Six entries reviewed monthly protect you better than forty that are never read.
What if we genuinely have forty risks?
You may. Managing six of them properly is still better than listing forty and managing none, and the other thirty four do not disappear from view.
Why not assign risks to a department?
Departments do not attend reviews, answer questions or take decisions. Only a person can be asked what they did about something.
What if the owner does not want it?
Then it is not owned. Owners are agreed with the people concerned rather than assigned in their absence, which is why that step exists.
How should risks be rated?
By whether you would have to explain it publicly, whether it would stop you operating, and whether you would notice it happening.
Why is detection so important?
Because a risk you could not tell had occurred is unmanaged at any severity. Everything else in the row is decoration without it.
What is an escalation threshold?
The written point at which somebody senior is told. Without one people wait to see whether it worsens, and it does.
How often should reviews happen?
Often enough to catch new tools entering use. Monthly suits most organisations, and quarterly is usually too slow for this.
Does a register make us compliant?
No. Recording a risk does nothing to the risk. It is a management tool rather than a control, and those get confused constantly.
What AI risks actually matter?
Usually wrong outputs acted on, data going somewhere it should not, and dependence on a system nobody can explain.
How do we track new tools?
A recorded inventory and a review cycle short enough to catch additions, since adoption spreads faster than registers get updated.
Who should own AI risk overall?
Somebody senior enough to stop a project. Ownership without that authority produces reports rather than decisions.
Can this fold into our existing risk process?
Yes, and it usually should. A separate AI risk process becomes a separate thing to ignore.
How long does setting one up take?
Two to three weeks. Maintaining it is the harder part and the one organisations consistently underestimate.
Will you tell us we do not need this?
If your AI use is small and contained, yes. A register for two contained tools is administration rather than management.
What does the board want to see?
That somebody owns it, that reviews happen, and that you would know if something went wrong. Not a long document.
What happens when a risk materialises?
The threshold triggers, the owner acts, and the register records what actually happened, which is how the next entry gets better.
Who sees the register?
Whoever you decide. It contains your assessments of your own weaknesses, so access is usually kept narrow.
What does register work cost?
Setup is modest. Ongoing maintenance is the real figure, quoted separately so you can see both.
Glossary of terms
Risk terms in plain language.
- Risk register
- The list of risks being managed, which only manages what somebody actually reviews.
- Owner
- The named person answerable for a risk, which cannot be a department.
- Detection method
- How you would know a risk had occurred, and the field most registers leave out.
- Escalation threshold
- The written point at which a risk goes to somebody senior, decided before the pressure arrives.
- Review cycle
- Scheduled dates for going through the register, as opposed to an intention to do so.
- Shadow adoption
- AI tools entering use without being recorded, which is how a register goes stale between reviews.
Related services in AI Compliance
Talk to us about AI risk management
Open your risk register and count the entries with a person named against them. That count is your real register.
Start your project