AI Governance and Risk · Topic 3 of 6
AI Risk Management
Auditing AI risk management: AI risk categories, impact assessments, risk appetite and treatment, vendor and supply chain risk, and reassessment triggers.
- 5 min
- AI risk assessment looks at the organization; impact assessment looks at people and society.
- Assessments come before deployment and are repeated on change.
- Risk tiering drives control depth; under-tiering undermines everything after it.
What it is
AI risk management is how the organization identifies, assesses, treats and monitors the risks that AI creates, and fits them into enterprise risk management. AI adds risks that ordinary IT risk registers miss: biased outcomes, unexplainable decisions, model drift, fabricated output and harm to people outside the organization.
The auditor evaluates whether the process exists, is applied to every AI system in proportion to its risk, and leads to real decisions. The question is not "is there a risk register" but "did the risk assessment change what the organization did".
How it works
AI risk categories
| Category | Examples |
|---|---|
| Performance | Inaccuracy, drift, fabricated output, poor results on some groups |
| Fairness | Bias that disadvantages protected or vulnerable groups |
| Transparency | Decisions that cannot be explained to customers or regulators |
| Security | Poisoning, prompt injection, model theft, data leakage |
| Privacy | Personal data used without lawful basis, inferred or exposed |
| Legal and compliance | Breach of AI, privacy, consumer or sector law |
| Third party | Vendor model changes, outages, unknown training data |
| Operational | Over-reliance, loss of skills, no fallback if the model fails |
| Reputational | Public harm from a visible AI failure |
Risk assessment and impact assessment
An AI risk assessment rates likelihood and impact on the organization. An AI impact assessment looks outward: the effects on individuals, groups and society, such as discrimination or loss of access to a service. ISO/IEC 42001 requires an AI system impact assessment, and ISO/IEC 42005 (published May 2025) gives guidance on how to carry one out.
The auditor checks that assessments are done before deployment, by people with the right mix of skills, with input from affected business areas, and are repeated when the system changes. A privacy impact assessment may also be needed when personal data is involved.
Risk appetite and tiering
The board's risk appetite should say what kinds of AI use are acceptable. Many organizations translate this into risk tiers: a low-tier chatbot answering public questions needs light controls, while a high-tier model deciding on credit needs validation, oversight, monitoring and frequent review.
| Tier | Typical controls the auditor expects |
|---|---|
| Low | Registration, owner, acceptable use rules |
| Medium | Plus testing before release, monitoring, periodic review |
| High | Plus independent validation, impact assessment, human oversight, senior approval, frequent revalidation |
The auditor samples systems and checks the tier was assigned correctly. Under-tiering is a serious finding, because every later control depends on it.
Risk treatment and acceptance
Treatment options are the familiar ones: mitigate with controls, transfer in part through contracts or insurance, avoid by not using AI for that purpose, or accept. Residual risk must be accepted by the business owner within their authority, and escalated when it exceeds appetite.
Evidence of good treatment is a risk register entry with an owner, chosen treatment, control references, due dates and signed acceptance for what remains.
Vendor and supply chain risk
Most AI includes third-party parts: foundation models, cloud AI services, pretrained models, datasets, open source libraries and annotation services. The auditor evaluates whether the vendor management program covers these AI-specific concerns.
| Area | What the auditor looks for |
|---|---|
| Due diligence | Vendor's AI governance, testing evidence, training data sources, certifications |
| Contract | Use of customer data for training, data location, notice of model changes, incident notification, audit rights |
| Assurance | Independent reports, such as attestation or ISO/IEC 42001 certification, and their scope |
| Monitoring | Ongoing performance checks, review of vendor changes |
| Exit | Ability to retrieve data and switch models |
A vendor's assurance report only helps if its scope covers the AI service the organization actually uses.
Reassessment triggers
AI risk changes faster than most IT risk. Reassessment should be triggered by a model update or retraining, new data sources, a new use or user group, drift or incidents, vendor model changes, and new regulation.
A worked example
A bank's high-tier lending model was assessed two years ago. Since then it was retrained twice and extended to small-business loans. The risk register still shows the original rating.
The auditor reports that reassessment triggers are not operating. The model has changed in use and in data, so the impact and risk ratings may no longer be valid. The recommendation is to define triggers in the risk procedure and reassess this model now.
How the exam asks about this
- "What should the auditor verify FIRST when reviewing controls over a high-risk AI system?" That the system's risk was assessed and the tier was assigned correctly.
- "Who should accept residual risk from an AI system?" The business owner, within the appetite set by senior management.
- "A vendor provides an assurance report for its AI platform. What should the auditor check FIRST?" That the report's scope covers the services and period the organization relies on.
What to remember for the exam
- AI risk assessment looks at the organization; impact assessment looks at people and society.
- Assessments come before deployment and are repeated on change.
- Risk tiering drives control depth; under-tiering undermines everything after it.
- The business owner accepts residual AI risk, not IT or audit.
- Vendor contracts must address training on customer data, model change notice and audit rights.
A risk assessment completed after go-live is not a preventive control. If the decision to deploy came first, the assessment did not inform it.
Common mistakes
Copying the IT risk register. It misses fairness, explainability, drift and harm to people outside the organization.
Relying on a vendor certificate without reading its scope. It may cover a different service, region or period.
Treating assessment as one-off. Retraining, new data and new uses all change the risk.
Check yourself
What is the difference between an AI risk assessment and an AI impact assessment?
A risk assessment rates the risk to the organization; an impact assessment examines effects on individuals, groups and society.
Why is correct risk tiering so important to the auditor?
The tier decides which controls are required, so a wrongly low tier means validation, oversight and monitoring may be missing.
Name three events that should trigger reassessment of AI risk.
Retraining or updating the model, a new use or data source, and a significant incident or drift, as well as vendor changes or new regulation.
Topic 3 of 6 in AI Governance and Risk
Test yourself on AI Governance and Risk
The full ISACA AAIA question bank has 750 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.