Risk Management Fundamentals: Foundations for AI

Let's start with two truths.

First: risk is the possibility of something going wrong. Not the certainty, the possibility. That distinction matters because it means we're always working with probabilities, not guarantees.

Second: risk can never be zero. The goal of risk management is never to eliminate risk entirely. That's impossible. The goal is to reduce risk to an acceptable level, the level your organization has defined as its risk appetite.

Understanding those two truths sets the right expectations for what a GRC program can and cannot do.

Now, how do you measure risk? There are two primary approaches.

Qualitative risk analysis uses subjective ratings, High, Medium, Low, based on expert judgment. It's fast, accessible, and widely used. The downside is that it's prone to human bias. What one person calls "High" another might call "Medium." Without a consistent standard, comparisons are unreliable.

Quantitative risk analysis uses numerical values to express probability and impact. The output looks like: "There is a 25% probability of a breach in the next five years with an impact of $5M." That's far more actionable than "High risk." It enables real comparisons, informs insurance decisions, and communicates clearly to leadership. The challenge is that it requires sufficient data and analytical expertise.

Once a risk is identified and measured, there are four ways to respond:

Avoidance: simply not engaging in the risky activity. Most often used when the likelihood and impact of a risk are both high.

Reduction: implementing controls to lower the likelihood or impact of a risk. The most common response in practice.

Transfer: shifting the risk to another party, typically through insurance. Cyber liability insurance is the classic example.

Acceptance: acknowledging the risk and choosing not to act, usually because the mitigation cost exceeds the potential impact. Accepted risks must be tracked and reviewed regularly, not left to sit indefinitely.

One more principle worth naming: the risk-based approach. Not all risks deserve equal attention. High-risk situations warrant high investment of time and resources. Low-risk situations warrant less. This sounds obvious, but GRC teams, especially those that are new or under-resourced, often get pulled into treating every risk with the same urgency. That's not just inefficient; it's counterproductive.

Apply these fundamentals consistently to AI risk, and you'll have a program that's focused, proportionate, and defensible.