Copy these fields into your register
| Field | What to record |
|---|---|
| Risk ID | A stable reference for this scenario |
| Use and boundary | Workflow, purpose, systems and version examined |
| Scenario | What could happen and what might cause it |
| Affected parties | People, operations, information or assets exposed |
| Consequence | The material effect, including quality and service |
| Evidence and uncertainty | What is observed, inferred or unverified |
| Existing controls | Measures actually implemented and tested |
| Remaining exposure | What the controls do not resolve |
| Accountable owner | Person responsible for the operating risk |
| Action and owner | Treatment or evidence work, with responsibility |
| Decision authority | Who can approve, accept or escalate |
| Review trigger | Date, change or event requiring reassessment |
| Status | Open, being treated, accepted within authority, or closed with basis |
Use your approved likelihood and consequence scales where appropriate. Do not invent numerical precision when evidence is limited.
An illustrative entry
Use: an internal assistant summarises an approved non-sensitive procedure set.
Scenario: an outdated document is retrieved and its instruction is presented as current.
Consequence: staff follow the wrong process, creating rework and delay.
Evidence: conflicting document versions were identified in a test set.
Treatment: establish an authoritative source, remove superseded copies from retrieval, assign an update owner and test handling of uncertainty.
This is a hypothetical example. It does not prescribe the controls required for every organisation or show that a live system is safe.
Keep the register connected to operation
Link material entries to approval, change and incident processes. A control recorded but not used should not be treated as effective.
Where a new model, source, tool or permission changes the scenario, reassess it. Retain the reasoning behind closed or accepted risks so a later reviewer can understand the decision.
Download the template, populate it with your AI systems, and bring it to your next board meeting. If you can't fill in every row, that gap is your risk. Book a governance diagnostic to close it.
Discuss your AI problemRelated Topics
Explore This Pillar
Go deeper with the matching master pillar and the most relevant supporting topics for this page.