Framework

AI & Technology Risk Framework™

Govern the risks arising from technology and AI adoption across the enterprise.

Overview

AI and technology risk spans model, data, ethical, operational and concentration risks from technology and AI adoption. This framework governs them with model-risk management and human oversight.

Business problem

Rapid AI and technology adoption introduces model, data and ethical risks faster than governance can keep up, creating exposure and concentration.

Purpose

Govern the risks arising from technology and AI adoption across the enterprise.

Who it's for
  • CIOs/CDOs
  • CROs
  • CISOs
  • Boards
Components
  • AI/tech governance
  • Model risk management
  • Data governance & quality
  • Ethics & bias control
  • Operational & concentration risk
  • Monitoring & assurance
Governance Structure
  • CIO/CDO own; a second-line model-risk function oversees; the board approves the AI governance policy.
Maturity Levels (shared spine)
L1

Fragile

Maturity level 1 of the shared Outliers risk spine — Fragile.

L2

Functional

Maturity level 2 of the shared Outliers risk spine — Functional.

L3

Disciplined

Maturity level 3 of the shared Outliers risk spine — Disciplined.

L4

Strategic

Maturity level 4 of the shared Outliers risk spine — Strategic.

L5

Resilient

Maturity level 5 of the shared Outliers risk spine — Resilient.

Roadmap
Step 01
  • Establish AI/tech governance
Step 02
  • Inventory models and data
Step 03
  • Validate and monitor models
Step 04
  • Embed ethics and human-in-the-loop control
Step 05
  • Assure and report
Deliverables
  • AI governance policy
  • Model inventory & validation pack
  • AI risk register
Policies & documents
  • AI governance policy
  • Model risk management framework
  • Data governance policy
Metrics & KRIs
  • Model inventory coverage
  • Models overdue for validation
  • Data-quality incidents
  • AI ethics issues raised
Board oversight questions
  • What AI and models are in use, and who owns the risk?
  • How do we control model, data and bias risk?
  • Where are we concentrated on a single technology or provider?
  • Is there human oversight of consequential decisions?

Across the ecosystem

Knowledge graph · 3 relations

operationalised by
ResourceAI Governance PolicyResourceModel Risk Management Framework
prioritises (inverse)
IndustryPlaybookTechnology