Module 19 Lesson 1: AI Risk Management
Managing the chaos. Learn how to build a formal Risk Management Framework specifically for AI, based on NIST and ISO standards.
Module 19 Lesson 1: Building an AI risk management framework
AI is a "High Velocity" risk. Traditional risk management (updating a spreadsheet once a year) cannot keep up. You need a System.
1. The NIST AI RMF (Risk Management Framework)
The NIST AI RMF is the "Bible" of AI governance. It breaks risk management into four functions:
- GOVERN: Build a team (Security, Legal, Engineering) and set the culture of safety.
- MAP: Identify where AI is being used in your company (e.g., "HR Chatbot," "Sales Predictor").
- MEASURE: Test the models. (Are they biased? Are they vulnerable to injection?).
- MANAGE: Apply the controls. (Add the guardrails, set the quotas).
2. Qualitative vs. Quantitative Risk
- Qualitative: "This AI might offend a customer." (High/Medium/Low impact).
- Quantitative: "There is a 10% chance per month of a $50,000 token-drain attack." (Calculating the Dollar value).
- In AI GRC, you need Both. You must protect the brand and the bottom line.
3. The "Risk Tiering" System
Not all AI is equal.
- Tier 1 (Internal Productivity): Writing emails. (Low Risk).
- Tier 2 (External Customer Facing): Support bots. (Medium Risk).
- Tier 3 (Automated Decision Making): Hiring, Loans, Medical. (High Risk).
- Best Practice: You should have different approval processes for each tier.
4. Establishing a "Golden Image"
A major GRC rule is Control. You should provide your employees with a "Golden List" of approved AI models and tools. If an employee uses an unapproved "Shadow AI" (like a random Chrome extension), it is a GRC Violation.
Exercise: The Risk Officer
- Why is "MAP" the hardest part of the NIST framework for a large company?
- You are auditing a "Finance AI." What is its "Risk Tier" and why?
- What is the difference between "Risk Tolerance" (what you are willing to lose) and "Risk Appetite" (what you are willing to try)?
- Research: What is "ISO/IEC 42001" and how does it relate to AI management systems?
Summary
Risk management is the Compass of AI security. It tells you which attacks matter and where to spend your budget. Without a framework, you are just "guessing" at security.
Next Lesson: Ethics and audits: AI ethics and bias auditing.