AI Risk Management: Identification, Assessment and Treatment
Domain 2 - AI Risk Management. The exam tests ISO/IEC 23894 and NIST AI RMF reasoning: how to establish context, identify AI-specific risks, evaluate them against criteria, treat them and monitor residual risk.
Core rules
ISO/IEC 23894 follows the ISO 31000 process: establish context, identify, analyse, evaluate, treat, monitor and review, with communication and consultation throughout. NIST AI RMF organises work into Govern, Map, Measure and Manage. AI risk sources include data quality and provenance, model error, bias, opacity, automation bias, model drift, use-context mismatch and third-party dependencies. Risk criteria and appetite should be set before evaluation, and impact assessment (ISO/IEC 42005) should consider individuals, groups and society, not only the organisation.
Worked example
A recruitment screening tool may disadvantage a protected group. Inherent risk is high: likelihood is plausible because historical hiring data is skewed; impact is severe for candidates and for legal exposure. Controls: diverse validation data, adverse-impact testing, human review of every rejection, and monitoring by demographic segment. Residual risk is accepted with conditions, a named owner and a review date. Reasoning shows treatment matched to the risk source, not a generic checklist.
Traps
Treating the risk register as a one-time document; assessing only technical failures; evaluating risks without agreed criteria; equating compliance with treatment; ignoring third-party model risk; failing to record residual risk acceptance.