AI Risk to Control Mapping
Purpose: Map AI risks to control objectives and evidence so teams can test and audit implementation consistently.
Audience: Security engineering, audit, GRC, vendor evaluation teams.
| Risk ID | Primary Controls | Control IDs | Evidence Required | FINOS AIGF Cross-Reference | Match |
|---|---|---|---|---|---|
| AI-R01 | Prompt inspection; file upload protection; classification-aware enforcement | AI-CTRL-002, AI-CTRL-003, AI-CTRL-010, AI-CTRL-017 | Prompt logs; upload block logs; data classification policy; SOC alerts | AIR-RC-001 | Partial |
| AI-R02 | AI discovery; application risk classification; policy enforcement | AI-CTRL-001, AI-CTRL-010, AI-CTRL-011, AI-CTRL-012, AI-CTRL-037, AI-CTRL-044 | AI inventory; shadow AI reports; user activity dashboard | None seen | None seen |
| AI-R03 | Sensitive data detection; redaction; block/warn policy | AI-CTRL-002, AI-CTRL-003, AI-CTRL-010, AI-CTRL-012, AI-CTRL-013, AI-CTRL-017, AI-CTRL-021 | DLP events; AI prompt detections; policy screenshots | AIR-RC-001 | Partial |
| AI-R04 | IDE discovery; source code protection; secret detection | AI-CTRL-004 | IDE inventory; secret detection log; developer policy evidence | AIR-RC-001 | Partial |
| AI-R05 | Prompt injection detection; runtime inspection; RAG validation | AI-CTRL-005, AI-CTRL-019, AI-CTRL-020, AI-CTRL-021, AI-CTRL-026, AI-CTRL-033, AI-CTRL-034 | Red team report; runtime logs; guardrail evidence | AIR-SEC-010 | Direct |
| AI-R06 | Output inspection; retrieval governance; source-document logging | AI-CTRL-005, AI-CTRL-016, AI-CTRL-017, AI-CTRL-018, AI-CTRL-020 | Response logs; retrieval logs; permission validation evidence | AIR-SEC-002 | Partial |
| AI-R07 | Agent identity; tool governance; approvals; action logging | AI-CTRL-006, AI-CTRL-015, AI-CTRL-016, AI-CTRL-022, AI-CTRL-023, AI-CTRL-024, AI-CTRL-025, AI-CTRL-026, AI-CTRL-027, AI-CTRL-033, AI-CTRL-034, AI-CTRL-045 | Agent registry; API/tool matrix; approval logs; SIEM events | AIR-SEC-024 | Partial |
| AI-R08 | AI asset inventory; model inventory; plugin governance; dependency scanning; least-privilege workload identities | AI-CTRL-014, AI-CTRL-016, AI-CTRL-019, AI-CTRL-024, AI-CTRL-028, AI-CTRL-029, AI-CTRL-030, AI-CTRL-031, AI-CTRL-032, AI-CTRL-033 | AI BOM; model registry; vulnerability reports | AIR-SEC-008; AIR-SEC-009; AIR-SEC-026 | Partial |
| AI-R09 | Audit logging; SIEM integration; retention controls | AI-CTRL-008, AI-CTRL-009, AI-CTRL-035, AI-CTRL-038, AI-CTRL-043 | Exportable audit records; SIEM event IDs; retention policy | None seen as a risk; FINOS addresses it through detective mitigations such as AIR-DET-004 and AIR-DET-021 | None seen |
| AI-R10 | Residency; retention; training exclusion; admin access logging | AI-CTRL-007, AI-CTRL-013, AI-CTRL-014, AI-CTRL-032, AI-CTRL-042, AI-CTRL-043 | Vendor documentation; DPA clauses; residency attestation; admin logs | AIR-RC-001 | Partial |
| AI-R11 | Cost attribution; budgets, quotas and rate limits; spend anomaly detection; agent task limits | AI-CTRL-025, AI-CTRL-036 | Cost attribution reports; budget and quota configuration; anomaly alerts; key revocation records | None seen as a risk; related mitigation AIR-DET-009 | None seen |
| AI-R12 | Grounding and citation verification; topic restriction; harmful content filtering; factuality evaluation | AI-CTRL-039, AI-CTRL-041, AI-CTRL-042, AI-CTRL-045 | Grounding test results; topic policy; content filter results; factuality baseline | AIR-OP-004 | Direct |
| AI-R13 | Defined fail modes; resilient failover; continuity and exit planning; control health monitoring | AI-CTRL-040 | Fail-mode test results; failover and restore tests; continuity and exit plans; health alerts | AIR-OP-007 | Direct |
| AI-R14 | Group-level fairness testing; proxy review; oversight of adverse outcomes | AI-CTRL-033, AI-CTRL-039, AI-CTRL-041, AI-CTRL-045 | Fairness metric definitions; results by group; threshold approvals | AIR-OP-016 | Direct |
| AI-R15 | Decision records; explanation templates; retention | AI-CTRL-008, AI-CTRL-038, AI-CTRL-041 | Decision records; sample reconstructions; retention configuration | AIR-OP-017 | Direct |
| AI-R16 | Model version pinning; regression on change; rollback | AI-CTRL-014, AI-CTRL-031, AI-CTRL-033, AI-CTRL-034, AI-CTRL-040 | Model inventory with versions; regression results; rollback test | AIR-OP-005; AIR-OP-006 | Direct |
| AI-R17 | Quality baselines; freshness limits; drift monitoring | AI-CTRL-017, AI-CTRL-019, AI-CTRL-034 | Baselines; drift alerts and actions; source ownership records | AIR-OP-019 | Direct |
| AI-R18 | Purpose statements; change triggers; use monitoring | AI-CTRL-011, AI-CTRL-012, AI-CTRL-037, AI-CTRL-045 | Approved purpose records; change-trigger logs; reassessment records | AIR-OP-018; AIR-OP-014 | Partial |
| AI-R19 | Oversight design by tier; reviewer authority and training; effectiveness measures | AI-CTRL-012, AI-CTRL-023, AI-CTRL-044, AI-CTRL-045 | Oversight design records; reviewer authority and training records; override metrics | AIR-RC-022 | Partial |
| AI-R20 | Content safety; adversarial testing; public incident response | AI-CTRL-034, AI-CTRL-035, AI-CTRL-039 | Filter results; red team reports; communications playbook | AIR-OP-020 | Direct |
| AI-R21 | Memory integrity; provenance; purge and isolation | AI-CTRL-025, AI-CTRL-026, AI-CTRL-027 | Memory configuration; purge tests; provenance logs | AIR-SEC-027 | Direct |
| AI-R22 | Credential exposure prevention; scoped short-lived tokens; canaries | AI-CTRL-004, AI-CTRL-015, AI-CTRL-016, AI-CTRL-027 | Runtime configuration review; canary alert tests; credential issuance logs | AIR-SEC-029 | Direct |
| AI-R23 | Skill, plugin and MCP governance; AI-BOM | AI-CTRL-024, AI-CTRL-031 | Allowlist; review records; pinning configuration | AIR-SEC-030; AIR-SEC-026 | Direct |
| AI-R24 | Sequence authorisation; tool I/O validation; runtime inspection | AI-CTRL-005, AI-CTRL-020, AI-CTRL-022, AI-CTRL-024 | Tool permission matrix with sequence rules; multi-step test results | AIR-SEC-025 | Direct |
| AI-R25 | Agent trust map; identity; containment; isolation | AI-CTRL-006, AI-CTRL-015, AI-CTRL-025, AI-CTRL-027 | Agent trust map; inter-agent request logs | AIR-OP-028 | Direct |
| AI-R26 | Trace classification; display and logging rules; leakage tests | AI-CTRL-008, AI-CTRL-020 | Classification decision; display configuration; leakage tests | None seen in the FINOS repository | None seen |
| AI-R27 | IP policy; vendor terms review; provenance; output scanning | AI-CTRL-002, AI-CTRL-003, AI-CTRL-012, AI-CTRL-013, AI-CTRL-046 | Policy; vendor terms review; training data provenance; scan results | AIR-RC-023 | Direct |
| AI-R28 | Obligation register; impact assessment; decision records; oversight | AI-CTRL-012, AI-CTRL-013, AI-CTRL-037, AI-CTRL-038, AI-CTRL-042, AI-CTRL-045 | Obligation register; supervision records; impact assessments | AIR-RC-022 | Direct |
How to read the FINOS columns. The cross-reference cites FINOS AI Governance Framework (AIGF) risk identifiers for traceability. Match shows how closely the FINOS risk fits: Direct (same risk), Partial (overlaps part of it) or None seen (no equivalent in the FINOS repository). The matching is this wiki's judgment, made from FINOS titles and the links between FINOS risks and mitigations. The reverse index, from each FINOS risk and mitigation to this wiki, is in the FINOS AI Governance Framework Crosswalk.
Mapping Usage
Use this mapping during solution architecture review, vendor PoC scoring, audit evidence collection and recurring risk review. Each AI project should identify applicable risks and provide the mapped evidence before production approval.