Fee
Register to see indicative feesConfirmed in writing after scoping01 / Assessment · Standard
AI Risk Assessment
Your risk register has nothing on it about AI, and someone has now asked why.
AssessAssessment
Typical duration
3 to 5 weeksDepends on the number of AI systems assessedPrimary artefact
Rated AI risk registerPlus 2 moreWho leads it
Steve SharmaFounder & Principal04 / What this is
What AI Risk Assessment is
A focused assessment that identifies the risks your specific AI use creates, rates them against your existing risk appetite, and assigns each an owner.
And what this service produces
It produces a register that integrates with the risk process you already run, rather than a parallel AI risk artefact that nobody maintains.
05 / Who it is for
Built for a real assurance trigger, not a badge project.
01
This fits when
- A functioning risk process has a gap where AI should be.
- Risk and audit functions have been asked to cover AI.
- You are preparing for a board or audit committee question.
- You need the risk position without the full readiness assessment.
02
The usual trigger
- Internal audit flagged AI as an unassessed risk area.
- An insurer or regulator has asked.
- The risk register is being refreshed and AI has no entries.
- A board paper is due.
06 / The obligation
Why AI risk resists the register you already have
Most enterprise risk registers assume risks are reasonably stable and reasonably knowable. AI breaks both assumptions: the systems change under you when a vendor updates a model, and the failure modes are frequently emergent rather than designed.
A one-off assessment ages fast
The practical consequence is that a one-off AI risk assessment ages faster than anything else on the register.
The method matters more than the output
What you need is a repeatable assessment process, applied once as a worked example, rather than a static list that will be wrong in two quarters.
Likelihood and impact resist AI
There is a second problem, and it is the one that stops AI risks from being treated. Most registers rate by likelihood and impact, and AI failure modes resist both: the likelihood is unknowable because the systems are new, and the impact depends on how far the output travels before a human checks it.
Rate exposure and reversibility
Rating an AI risk against a scale built for operational and financial risk tends to produce a middling score that nobody acts on. We rate against exposure and reversibility instead, which produces a ranking a risk committee can actually sequence work from.
We build the method and run it once. The register is the by-product; the repeatable process is the deliverable that still has value in a year.
07 / What you receive
Three artefacts. Each one yours to keep.
- 01
Rated AI risk register
Each risk, its rating against your existing appetite, the control state, and a named owner.
RegisterIntegrates with your risk system - 02
Repeatable assessment method
The process your team runs on the next system, documented and worked through once.
Method documentRisk owner - 03
Board and audit committee summary
The position, the material risks and the ask, in the format your committee expects.
Summary paperCommittee-ready
08 / Scope
The whole system is visible before work begins.
Risk identification
- AI systems and use cases catalogued
- Failure modes per system
- Third-party and vendor model risks
Rating
- Assessment against your existing appetite
- Impact and likelihood, with the basis stated
- Control effectiveness review
Ownership
- Risk owners assigned and confirmed
- Escalation thresholds
- Reporting cadence
Method
- Repeatable process documented
- Assessment templates
- Trigger conditions for re-assessment
09 / Included / not included
A useful boundary is part of the deliverable.
Included
- Risk identification across AI systems and vendors
- Rating against your existing appetite
- Risk ownership and escalation
- A documented, repeatable method
Not included
- Remediation: We identify and rate. Treating the risks is separate work.
- Full readiness assessment: This covers risk only: not governance maturity, technical controls or data exposure.
- Model evaluation: Bias, accuracy and performance testing is a data science engagement.
10 / How we do it
A traceable path from scope to evidence.
Identification
Systems catalogued, failure modes identified per use case.
Rating and control review
Rated against your existing appetite, with control effectiveness tested rather than assumed.
Ownership and method
Owners confirmed, thresholds set, and the repeatable method documented.
Mapped againstISO/IEC 23894NIST AI RMFISO/IEC 42001
11 / Timeline
3 to 5 weeks of work.
Elapsed time and customer effort are separated because they are not the same number.
Week 1
Identification
Systems and failure modes identified.
Customer effort
One 2-hour workshop, plus access to the existing risk register.
Weeks 2 to 3
Rating and control review
Risks rated against your appetite, with control effectiveness reviewed.
Customer effort
3-5 interviews at 45 minutes.
Weeks 4 to 5
Ownership, method and committee paper
Owners confirmed, the method documented and the committee paper prepared. Expect roughly 8-10 hours of your team's time across the engagement.
Customer effort
Owner confirmation, roughly 3 hours across the phase.
Our work: 3 to 5 weeks
12 / Scope check
Test whether AI Risk Assessment
is the right next move.
We will cover likely scope, cost and fit.
Book a confidential strategy sessionWith Steve Sharma, who would lead.13 / Who leads the engagement
Named lead. Direct assessment.
Your risk assessment lead
Steve Sharma
Founder & Principal
Runs the identification workshop and the control effectiveness review personally.
ASD-endorsed IRAP AssessorCISSPCREST
Every engagement has a named lead. Where a second executive or specialist is needed, they are named in the proposal and subject to client approval.
Review leadership record14 / Why Cybersecurity Link
Three decisions.
Accountability.
It integrates with the risk process you have.
A parallel AI risk register is one nobody maintains. Ours is built to land in your existing system.
The method outlives the register.
The register ages in months; the repeatable process does not. That is why it is a deliverable rather than an appendix.
Scope and fee confirmed before we start.
Scope and exclusions are confirmed in writing before any work begins.
15 / The boundary
What this engagement does not claim.
Treatment
This assessment identifies and rates risks. It does not treat them.
Treating the risks is separate work.
Operations
We are not a managed security service.
We do not run your SOC or monitor your environment.
Coverage
This is not a full readiness assessment.
It covers risk, not governance maturity or technical controls.
Frameworks
One method, mapped across three references.
The work maps to ISO/IEC 23894, the NIST AI RMF and ISO/IEC 42001.
What moves the fee
Per AI system assessed beyond six.
Where risk appetite statements already exist.
A fixed fee for the standard scopeRated register, method and committee paperScope confirmed in writing before we start
18 / How this fits
Where this sits in the wider programme.
19 / When this is not right
Sometimes the best recommendation is a smaller service, or a later date.
01
You need the full picture rather than the risk position.
The readiness assessment covers governance, exposure and controls too.
02
You have no functioning risk process to land this in.
Governance design has to come first, or the register has nowhere to live.
03
The concern is a specific system rather than the portfolio.
Red teaming or architecture review is more useful.
20 / FAQ
The questions that change the decision.
This covers risk only. The readiness assessment also covers governance maturity, data exposure and technical controls, and produces a scored position rather than a register. If you have a working risk process and just need AI on it, this is cheaper and faster.
That is the design intent. We rate against your appetite statements and produce it in your format. A parallel AI register is one nobody maintains.
More often than the rest of your register, because AI estates change monthly. We set trigger conditions rather than a fixed annual cycle, which is usually the more useful answer.
Some of them, as separate scoped work. Others belong with your own team or a different provider, and we will say which.
21 / Next move
If AI Risk Assessment is what you need, the next step is a conversation about scope.
45 minutes, with the executive who would lead it: what your scope actually looks like, and whether this is the right service for you at all.