AI Risk Assessment
Every automated decision remains your responsibility. This works out which ones you can safely hand over.
What is AI risk assessment?
An AI risk assessment identifies the ways an automated system could fail in your specific business, weighs the commercial consequence of each failure, and specifies the control required, which may be a human checkpoint, a confidence threshold, a fallback process or a decision not to automate that step.
We work through failure modes that occur in practice rather than in theory. The system being confidently wrong. Being unavailable at the moment you depend on it. Receiving data it was never designed for. Drifting slowly as your business changes around it.
For each we assess what it would cost you rather than how statistically likely it is. A rare failure that loses a major client outranks a frequent one that wastes ten minutes.
The output separates risks you can live with from risks that need a control, and names the control. Not every risk needs mitigating, but each one should be a decision somebody made deliberately.
Why we disclose our own involvement
Duara assesses AI risk for Kenyan organisations from Nairobi, most often for businesses in regulated sectors or those whose insurers have started asking questions about automated decisions.
We assess systems we did not build, and we will say so in the report when we did build something we are assessing. An assessor with no stake in the answer is worth more, and we would rather tell you that than pretend otherwise.
Who this is for
- You are automating decisions affecting customers or money
- You work in health, law or financial services
- An insurer or client has asked how AI decisions are controlled
- A system is already live and nobody assessed it
Industries we serve
- Banking and lending
- Insurance and claims
- Healthcare providers
- Legal services
- Logistics and fleet
- Public sector bodies
Problems this solves
Risk work is usually triggered by an external question rather than an internal one.
- Automated decisions with no defined limit. A system decides things affecting customers and nobody wrote down what it is allowed to decide alone.
- No fallback when the system is down. Staff have no defined process for the hours when the tool is unavailable, so work simply stops.
- Silent drift. A system installed two years ago now sees different data and produces worse results, and nobody is watching for it.
- Insurer or client questions you cannot answer. Somebody asks how automated decisions are controlled and there is no document that answers.
What we deliver
A risk register with the commercial consequence of each failure assessed, the recommended control for each, a fallback process, and an explicit list of steps we advise leaving to people.
A register of identified risks with likely cost attached
Recommended controls, with the ones we consider mandatory marked
A fallback procedure for when the system is unavailable or unsure
The steps we recommend leaving with people
Monitoring thresholds so drift is detected rather than discovered
A document you can hand to an insurer or client
Features
- Consequence before probability. We start from what a failure would cost you, because a rare expensive failure beats a frequent trivial one.
- Failure modes from practice. Confidently wrong, unavailable, fed unfamiliar data, or drifting. These are the four that actually occur.
- Named controls, not principles. Each risk gets a specific control, such as a threshold or a checkpoint, rather than a statement of intent.
- An accept list. Risks we recommend accepting are written down as accepted, so nobody rediscovers them later as oversights.
- Assessment of live systems. We prefer assessing something already running, because the real failure modes are visible rather than hypothetical.
Benefits
- You can answer the insurer. A written register and control set answers the question directly instead of requiring a scramble.
- Failures stop being surprises. Monitoring thresholds mean drift is detected while it is cheap rather than after a complaint.
- Staff know what to do when it breaks. A defined fallback means an outage is an inconvenience rather than a halt.
- Accountability is explicit. Every automated decision has a named limit and a named person behind it.
Technologies we use
- Failure mode analysis. A structured walk through how each system could produce a wrong or unavailable result.
- Threshold design. Confidence levels below which a system must defer to a person rather than proceed.
- Drift monitoring. Measurement of output quality over time so gradual degradation is visible.
- Fallback process design. The manual procedure staff follow when the system cannot be relied on.
- Audit logging review. Whether your systems record enough to reconstruct why a given decision was made.
Risk work inspects systems rather than changing them. Any control we recommend is specified for your team or ours to build separately.
How the process works, step by step
A risk assessment runs two to four weeks depending on how many systems are live and how well documented they are.
-
Step 1
Free risk call
We establish which decisions are automated, who they affect, and whether anyone external has asked about them.
-
Step 2
System walkthrough
We examine what each system decides, on what data, and what happens when it is uncertain.
-
Step 3
Consequence workshop
We work with your team to price the failures, because you know what losing a given client costs.
-
Step 4
Control specification
We specify the control for each risk and mark the ones we consider mandatory rather than advisable.
-
Step 5
Register handover
You receive the register, the fallback procedures and the monitoring thresholds, in a form you can show externally.
Quality assurance and how we work
What we commit to when assessing risk.
- We price consequence with you, not for you. You know what losing a particular client costs. We supply the structure, you supply the number.
- Mandatory controls are marked as mandatory. We distinguish between what we advise and what we think you must not go live without.
- We declare it if we built the system. Assessing our own work is a conflict and the report states it on the first page.
- Accepted risks are recorded as accepted. Nothing is silently dropped. If you choose to carry a risk, that decision is written down with your name on it.
- The register is written for outside readers. It is drafted so an insurer, client or regulator can follow it without us present.
Frequently asked questions about AI risk assessment
What is an AI risk assessment?
A structured identification of how an automated system could fail in your business, what each failure would cost, and the specific control each risk requires.
We are not regulated. Does this apply?
The legal exposure differs but the commercial exposure does not. A system mishandling customers damages the business regardless of the regulator.
Can you assess a system already in production?
Yes, and we prefer it. On a live system the real failure modes are visible instead of hypothetical.
What failure modes do you actually look for?
Four: confidently wrong output, unavailability at the wrong moment, data the system was never built for, and slow drift as conditions change.
Why price consequence rather than probability?
Because a rare failure that loses a major client matters more than a frequent one that wastes ten minutes.
What is a confidence threshold?
The certainty level below which the system must defer to a person rather than act on its own judgement.
What is model drift?
Gradual degradation as the data a system sees moves away from what it was designed around. It is slow and easy to miss.
Do you fix the risks you find?
We specify the control. Building it can be done by your team, by us, or by another supplier.
Will you assess a system you built?
We can, and the report states the conflict on the first page. For full independence an assessor with no stake is cleaner.
What is a fallback process?
The manual procedure staff follow when the system is down or unsure, so work continues rather than halting.
How long does a risk review take?
Two to four weeks depending on how many systems are live and how well they are documented.
Can we show the report to our insurer?
Yes. It is written so an external reader can follow it without us present.
What if we decide to accept a risk?
That is legitimate, and we record it as an accepted risk with the decision attributed, so it is not later mistaken for an oversight.
Do you assess third party AI tools?
Yes. Tools you bought carry risk you own, even though somebody else built them.
What is the most commonly missed risk?
No fallback. Businesses plan for the system being wrong but not for it being unavailable.
Does this cover data protection risk?
It touches it, but compliance is a separate piece of work with a different scope. We say where the line falls.
Who from our side needs to take part?
Whoever owns the process and whoever would carry the cost of a failure. Both, or the pricing is guesswork.
How often should risks be reassessed?
Quarterly for systems making customer-facing decisions, and immediately after any significant change.
What does a risk review cost?
Scope drives it, meaning how many live systems and how well documented they are. The figure is fixed before we begin.
Can you assess before we build?
Yes, and it is cheaper. Assessing a design lets you change it before the cost of change becomes significant.
Glossary of terms
Risk vocabulary as we use it, without the actuarial framing.
- Failure mode
- A specific way a system can produce a wrong, missing or unusable result.
- Confidence threshold
- The certainty level below which a system must hand a decision to a person rather than act.
- Model drift
- Gradual degradation in results as the data a system sees moves away from what it was built for.
- Fallback process
- The manual procedure staff follow when an automated system is unavailable or unreliable.
- Risk register
- The maintained list of identified risks, their assessed consequence and the control applied to each.
- Accepted risk
- A risk the business has deliberately chosen to carry without mitigation, recorded as such.
Related services in AI Consulting
Talk to us about AI risk assessment
If an insurer or client has already put the question in writing, bring us their exact wording. It usually shapes the entire assessment.
Start your project