ARiMI Learning Series:
AI FOR RISK PROFESSIONALS & LEADERS
This chapter is part of the “AI For Risk Professionals & Leaders” learning series, designed to help risk professionals and leaders engage with AI in ways that complement sound judgment, strategic thinking and ethical practice. Whether you are a certified expert or a curious practitioner, each chapter offers practical guidance to support the confident, clear and responsible use of AI tools in risk management
Artificial Intelligence is becoming part of organisational decision making across every sector. As adoption continues to grow, organisations are strengthening their governance arrangements through policies, oversight structures, risk assessment practices, and recognised standards such as ISO/IEC 42001 and ISO/IEC 23894.
These developments have strengthened the governance of AI. As organisations move beyond establishing governance arrangements, attention is increasingly turning to another important question.
What changes when AI becomes part of organisational activity?
As Artificial Intelligence becomes more widely adopted, its implications extend beyond AI specific risks. Organisations should also consider how AI affects existing Enterprise Risk Management practices.
AI is becoming part of organisational objectives, decision making, operational processes, and governance arrangements. As its use expands, existing risks may change in their likelihood, impact, speed, interconnectedness, or visibility. Existing controls may also require review to determine whether they remain effective when AI becomes part of organisational activities.
The use of AI may also affect organisational accountability. Decisions involving AI often involve multiple stakeholders, including business functions, technology teams, data specialists, vendors, and governance functions. This makes clear roles, responsibilities, and oversight increasingly important.
These changes are reflected through existing Enterprise Risk Management practices. Organisations should consider how AI is represented within existing governance, risk management, accountability, and decision making processes.
Embedding AI into Enterprise Risk Management therefore involves examining where AI influences organisational activities and ensuring those implications are appropriately reflected within existing governance and risk management arrangements.
How should AI be embedded within Enterprise Risk Management?
AI is influencing organisational objectives, decision making, operations, and performance. It therefore needs to be considered within the broader context of how organisations manage uncertainty in pursuit of their objectives.
Enterprise Risk Management provides that context and the structure for translating AI governance into organisational practice. This involves incorporating AI related considerations into existing governance, risk management, and decision making processes, allowing AI to be managed alongside other organisational opportunities and uncertainties.
To support organisations in this next stage of AI adoption, ARiMI has developed the Practice Guide: Embedding AI into Enterprise Risk Management – From Risk Appetite to Practical Integration. The guide provides practical considerations for Boards, senior leaders, Enterprise Risk Management professionals, governance practitioners, internal auditors, and compliance professionals.
ARiMI Practice Guide
Embedding Artificial Intelligence into Enterprise Risk Management begins with the right questions.
Get your complimentary copy today.
Enterprise Risk Management Gives AI Context
The significance of an AI application depends not only on the technology itself, but also on the business activities it supports, the decisions it influences and the potential consequences for the organisation.
An AI application used to automate routine administrative tasks presents a very different level of organisational exposure from one supporting clinical diagnosis, financial approvals or strategic investment decisions. Although the underlying technology may be similar, the organisational context and potential consequences are not.
Enterprise Risk Management links AI to organisational objectives, governance, risk appetite, accountability and decision making. This enables AI related opportunities and uncertainties to be considered alongside other factors that influence organisational performance rather than being assessed in isolation.
From Risk Appetite to Practical Integration
In the previous chapter, Risk Appetite in the Age of AI, ARiMI discussed how organisations determine the level of AI related uncertainty they are prepared to accept while pursuing their objectives.
Risk appetite provides an important foundation for decision making, but it is only one part of the process. Organisations also need to ensure that AI considerations are reflected within governance arrangements, risk assessments, reporting, oversight and assurance activities.
Embedding AI into Enterprise Risk Management enables this transition by incorporating AI considerations into existing Enterprise Risk Management processes instead of managing them through a separate framework.
Practical Integration Begins with Existing Processes
Most organisations already have established Enterprise Risk Management frameworks that support governance and decision making across the enterprise. Embedding AI does not require these frameworks to be replaced. In many cases, the existing methodology remains appropriate. What changes is the range of questions being considered as AI increasingly influences organisational decisions, risks and outcomes.
Rather than introducing separate governance processes, organisations should consider how AI influences existing risks, introduces new sources of uncertainty and affects the achievement of organisational objectives. These considerations can then be incorporated into Enterprise Risk Management processes that are already familiar to management and the Board.
This approach promotes consistency, reduces duplication and supports a more integrated view of organisational performance and organisational risk.
From Governance to Organisational Practice
As organisations become more experienced in the use of AI, attention is naturally shifting from establishing governance principles towards embedding those principles into everyday organisational practice.
This requires Enterprise Risk Management processes to evolve alongside the organisation’s use of AI. Governance, reporting, accountability and oversight should continue to operate through existing Enterprise Risk Management arrangements while reflecting the opportunities and uncertainties introduced by AI.
The ARiMI Practice Guide: Embedding AI into Enterprise Risk Management: From Risk Appetite to Practical Integration expands on these practical considerations and demonstrates how organisations can build upon existing Enterprise Risk Management practices to strengthen AI governance without introducing an entirely new framework.