AAIR lesson 9: AI risk treatment, controls

Treating an AI risk means comparing its rating with the organisation’s risk tolerance and then choosing one of four responses: mitigate, transfer, avoid or accept. What remains afterwards is residual risk, and it has to be monitored. Two points matter more than the list itself. The decision belongs to the person who owns the risk, not to the risk function, and a control only counts once there is evidence that it works.

Appetite, tolerance and the decision

Risk appetite is the broad amount and type of risk an organisation is willing to pursue to meet its objectives, set by the board or senior management. Risk tolerance is the acceptable variation around a particular objective or risk, usually stated as a measurable limit. Appetite is the statement (“low appetite for harm to customers from automated decisions”); tolerance is the line (“no more than 1 in 1,000 loan decisions reversed on appeal”).

The figure below shows the flow. A rated scenario is compared with tolerance. If it is within tolerance, acceptance is possible. If it is outside, one of the other responses must bring it back or the activity must stop.

The four responses applied to AI

Transfer has limits worth remembering. Insurance or a contract can move some of a financial loss, but accountability for a harmful decision toward customers, regulators or affected people stays with the organisation that deployed the system. Acceptance, on the other hand, is a legitimate outcome when it is documented, owned by someone with the authority to accept it, and within tolerance.

Evaluating, selecting and validating controls

Three activities are easy to blur.

• Evaluation: does this control address the cause or consequence of the scenario? A filter for offensive language does not address leakage of contract data.
• Selection: is it proportionate? Cost, practicality and the size of the risk reduction are weighed. Control types are covered in security control categories.
• Validation: is there evidence that it operates as intended? For AI this means testing, for instance sending known attack prompts through a filter or measuring a human review step to see whether reviewers actually override wrong outputs.

A control with no validation evidence is an intention. Validation should be repeated when the model, the data or the provider changes, because the evidence may no longer hold.

Worked example: a 500-person lender

A 500-person lender uses a model to pre-score loan applications. A scenario from the assessment states that the model may systematically give lower scores to one age group, leading to unfair decisions and regulatory exposure. The inherent rating is high; tolerance for unfair decisions is set low.

The risk owner, the head of consumer lending, considers options. Avoidance would lose a large efficiency gain, and insurance would not address harm to applicants. Mitigation is chosen: bias testing across age bands before each release, a human decision on every refusal, and a monthly fairness metric. The risk function evaluates the controls against the scenario, checks they are proportionate, and asks for validation evidence: the test results and a sample showing reviewers do overturn flawed scores. The residual rating falls to medium, still slightly above tolerance, so the owner accepts a short remediation plan with a deadline instead of accepting the gap indefinitely.

Putting AI risks into the register

AI risks should enter the existing enterprise risk register and control taxonomy, not a separate parallel list. That keeps one view of risk for the board and lets AI scenarios be compared with other risks. A useful entry has an owner, the scenario text, the inherent rating, the chosen treatment, the controls with their validation status, the residual rating, and a review date.

Easy to confuse

• Appetite vs tolerance: broad willingness versus a measurable limit.
• Inherent vs residual: before versus after controls; residual is what gets compared with tolerance.
• Transfer vs avoid: transfer shares the loss and keeps the activity; avoid ends the activity.

Key points

• Compare the rating with tolerance, then choose to mitigate, transfer, avoid or accept.
• The risk owner decides; the risk function advises and challenges.
• Accountability for harmful automated decisions cannot be transferred away.
• Evaluate, select and validate are three separate steps; validation needs evidence.
• Add AI risks to the existing register and revisit when the model, data or provider changes.

Check yourself

This lesson covers subtopics 3B and 3C of Domain 3, AI Risk Program Management (42%), and the recap page AI risk programme management summarises treatment and controls alongside the rest of the domain.