Risk sensing and emerging risk
AI can monitor and synthesise internal and external signals relevant to:
- operational risk;
- regulatory change;
- third-party risk;
- market or geopolitical developments;
- conduct;
- cyber and technology risk;
- model and AI risk.
The purpose is to surface potential exposure earlier for professional review, not automatically determine materiality.
Risk assessment
Risk assessments often require information from policies, incidents, controls, business activities and previous reviews.
AI can help prepare:
- inherent-risk analysis;
- control mapping;
- residual-risk assessment;
- scenario summaries;
- comparable incidents;
- supporting evidence.
Risk owners and the independent risk function remain responsible for challenge and approval.
Control monitoring and testing
Controls generate large volumes of evidence that may be difficult to review consistently.
AI can support:
- evidence collection;
- control-performance review;
- exception identification;
- testing preparation;
- issue classification;
- recurring-failure analysis.
Where automated monitoring is appropriate, thresholds, source data and false-positive/false-negative risk must be governed.
Regulatory obligations and compliance monitoring
AI can help map regulation to internal obligations, policies, controls and business processes.
Applications include:
- regulatory inventories;
- obligation extraction;
- regulatory change assessment;
- policy mapping;
- compliance monitoring;
- surveillance support;
- evidence preparation.
Legal and Compliance remain responsible for interpretation and material regulatory conclusions.
Incidents, investigations and remediation
AI can organise case information, timelines, communications, previous incidents and control history.
It can support:
- incident triage;
- investigation planning;
- root-cause analysis;
- issue classification;
- remediation tracking;
- management reporting.
Sensitive investigations require strict access, confidentiality and evidentiary controls.
AI and model risk
As AI becomes part of business workflows, Risk and Compliance need a clear view of:
- use cases;
- model or agent purpose;
- data;
- decision impact;
- autonomy;
- evaluation;
- monitoring;
- change control;
- human oversight.
AI governance should be integrated with the broader risk and control environment rather than managed as a disconnected policy exercise.
