Risk Management
Risk methodology, enterprise AI risk register, risk treatment and risk-to-control mapping.
For fill-in versions aimed at GCC use, see T01 AI Use-Case Intake and Risk Tiering, T02 AI Impact Assessment and T12 AI Risk Register (4x4). For EU use, see T01 AI System Classification and T02 Impact Assessment (FRIA and DPIA Combined).
To decide which risks apply to a use case, use the AI Use-Case Risk Triage. To follow a risk through to its controls and test cases, use the Risk, Control and Test Traceability page. To see how the risks map to the FINOS AI Governance Framework, see the FINOS crosswalk.
Pages in This Section
AI Risk MethodologyDefine the rating method for assessing AI risks consistently across AI platforms, custom AI applications and agentic AI workflows.
Enterprise AI Risk RegisterProvide a sample enterprise AI risk register covering AI usage, development, applications, agents, auditability, sovereignty…
AI Risk Treatment PlanDefine how AI risks are treated through phased visibility, controls, runtime protection, agent governance and continuous compliance.
AI Risk to Control MappingMap AI risks to control objectives and evidence so teams can test and audit implementation consistently.
AI Risk Review TemplateProvide a reusable intake and risk review template for new AI tools, AI applications, AI vendors and agentic AI workflows.
AI Use-Case Risk TriageYes/No questions that decide which risks in the register apply to an AI use case, to use alongside the T01 intake form that sets the tier.
Risk, Control and Test TraceabilityEvery risk in the register traced to the control objectives that treat it and the test cases that exercise them, with the controls that have no test case yet.