AI Risk Management · Topic 1 of 4
AI Risk Assessment, Impact Assessment and Treatment
Assessing AI risk within enterprise risk management: risk tiers, impact assessments, thresholds, treatment, residual risk and reassessment triggers.
- 6 min
- Includes a diagram
- AI risk is assessed inside enterprise risk management with the same method and register.
- Tier use cases so effort matches risk.
- Impact assessments look at effects on people and are done before deployment.
What it is
AI risk assessment applies the familiar risk process to AI systems: identify what could go wrong, judge likelihood and impact, compare the result with the organization's appetite, and decide on treatment. What changes is the source of risk. AI systems learn from data, behave probabilistically, can act autonomously and can harm people who are not users.
AI impact assessment looks outward: who could be affected by the AI system and how. Thresholds turn appetite into measurable limits, and treatment brings risk back within them.
How it works
What makes AI risk different
| Factor | Why it raises risk |
|---|---|
| Data dependence | Biased, poisoned or low-quality data produces flawed models |
| Opacity | Hard to explain why a model gave an output |
| Probabilistic behaviour | The same input can give different outputs; errors are not always reproducible |
| Autonomy | Agents that act without human review magnify errors |
| Scale | One flawed model affects every decision it makes |
| Drift | Performance degrades as the world changes |
| Third-party dependence | Models, data and services come from outside |
| New attack techniques | Prompt injection, poisoning, model extraction |
Fitting AI into enterprise risk
AI risk is not a separate silo. It is assessed with the organization's enterprise risk management method so it can be compared, aggregated and reported with other risks.
AI risks appear in the enterprise risk register with owners, ratings and treatment decisions. ISO/IEC 23894 gives guidance on adapting the ISO 31000 process for this, and the NIST AI RMF Map and Measure functions support the same work.
The security manager also looks at aggregate risk. Twenty low-risk uses of the same external model add up to a concentration risk if that model fails or is compromised.
Risk tiering of use cases
Most organizations tier AI use cases so effort matches risk. Tiering considers the decision's effect on people, safety, legal classification, data sensitivity, autonomy, scale and whether the output is customer-facing. Higher tiers require deeper assessment, more testing, stronger human oversight and committee approval.
AI impact assessments
| Assessment | Focus |
|---|---|
| AI system impact assessment | Effects on individuals, groups and society: fairness, safety, rights, well-being; required within ISO/IEC 42001, with guidance in ISO/IEC 42005 |
| Data protection impact assessment (DPIA) | Risks to individuals from processing personal data, under GDPR and similar laws |
| Fundamental rights impact assessment | Required of certain deployers of high-risk AI under the EU AI Act |
These overlap, so many organizations run one combined assessment that meets each requirement. Impact assessments are done before deployment and repeated when the system or its use changes.
Thresholds
Risk appetite is a statement; thresholds make it testable. Examples:
- Minimum accuracy or maximum error rate for the intended use.
- Maximum difference in outcomes between groups for a fairness metric.
- Maximum rate of harmful or policy-violating outputs in red team evaluation.
- Limits on autonomy, such as no unreviewed actions above a monetary value.
- No use of restricted data in prompts to external models.
Thresholds are agreed with the business owner, approved within governance, and checked both at release and during operation.
Treatment options
| Option | AI example |
|---|---|
| Mitigate | Add guardrails, human review, permission-aware retrieval, retraining with better data |
| Transfer or share | Contract terms with vendors, AI liability insurance; accountability stays with the organization |
| Avoid | Do not deploy the use case, or remove a high-risk feature |
| Accept | Business owner accepts residual risk within appetite, documented and reviewed |
Residual risk is what remains after treatment. It is accepted by the risk owner, and if it exceeds appetite it is escalated to senior management.
When to reassess
AI risk changes faster than most risk. Triggers for reassessment include a new model version from a vendor, retraining, a new data source, a change in intended use or user group, drift beyond threshold, a new attack technique, new regulation, a vendor change, an incident, and audit findings. Monitoring these internal and external factors is part of the risk process, not an extra.
A worked example
HR wants to use a model to rank job applicants. The security manager facilitates an impact assessment with HR, legal and privacy. The use is high-risk under the EU AI Act and processes personal data, so a combined impact assessment and DPIA are completed.
Thresholds are set for selection-rate differences between groups and for accuracy. Testing shows the model exceeds the fairness threshold.
The treatment is retraining with rebalanced data, plus mandatory recruiter review of every ranking. HR, as risk owner, accepts the documented residual risk.
How the exam asks about this
- "What should be done FIRST before deploying an AI system that makes decisions about people?" An impact assessment.
- "A vendor releases a new version of the model the organization uses. What should the security manager do?" Reassess the risk and retest against thresholds before adopting it.
- "Who should accept residual AI risk?" The business owner of the AI use case, within approved appetite.
What to remember for the exam
- AI risk is assessed inside enterprise risk management with the same method and register.
- Tier use cases so effort matches risk.
- Impact assessments look at effects on people and are done before deployment.
- Thresholds make risk appetite measurable for AI.
- Model updates, new data, drift, new threats and new laws all trigger reassessment.
Transferring AI risk to a vendor or insurer does not transfer accountability. The organization still answers for harm its AI causes.
Common mistakes
Assessing once at launch. AI changes through retraining, vendor updates and drift, so risk must be reassessed when triggers occur.
Assessing each use case in isolation. Many systems can depend on one model or provider, creating concentration risk that only an aggregate view shows.
Setting thresholds after testing. Thresholds agreed after seeing results tend to fit the results. Set them first.
Check yourself
What is the purpose of an AI impact assessment?
To identify how an AI system could affect individuals, groups and society, such as fairness, safety and rights, before it is deployed.
Give three triggers for reassessing AI risk.
Any three of a new model version, retraining, a new data source, a change in use, drift, a new threat, new regulation, a vendor change or an incident.
Why set measurable thresholds for AI risk?
They make risk appetite testable, so models can be checked against clear limits at release and during operation.
Topic 1 of 4 in AI Risk Management
Test yourself on AI Risk Management
The full ISACA AAISM question bank has 747 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.