AI Risk Management: Build a Risk Register Around Real Use Cases

Published by Horus Consultancy · About us

An effective AI risk register describes how a particular AI use could cause harm, who could be affected and what the organization will do about it. Start with the use case and its operating context, rather than a generic list of AI threats.

Describe the decision the AI supports

Record what the system does, who uses it, its intended limits, the information it receives and what happens after an output is produced. Identify whether a person can meaningfully review or reverse the outcome. Include the supplier and any other systems connected to it.

A customer-service assistant drafting a response presents different risks from one that can approve refunds or change account details. The same model can therefore require different controls in different workflows.

Write a specific risk scenario

Instead of “AI may be inaccurate,” write a scenario such as: “The assistant invents an eligibility condition, an employee sends it without verification, and a customer receives incorrect advice.” Identify the cause, the event and the consequence separately. Consider impacts on customers, employees and others, as well as the organization.

Use a practical register structure

• Context: use case, system version, business owner and affected parties.
• Risk: scenario, causes, consequences and assessment rationale.
• Existing controls: what is operating now and the evidence supporting it.
• Action: proposed treatment, owner, due date and test of effectiveness.
• Decision: residual risk, approval authority, review date and change triggers.

Avoid a precise numerical score that the available evidence cannot justify. Explain your assumptions and uncertainty so another reviewer can understand the decision.

Example: a knowledge assistant

Suppose an internal assistant answers questions about operating procedures. One scenario is that it retrieves an obsolete procedure and presents it confidently. Possible responses include restricting its knowledge sources, displaying source dates, testing answers against approved examples and requiring verification before a high-impact action.

These are illustrative controls. Test whether they work in the actual environment, including when a document is missing or contradictory. A warning banner alone may not change user behavior.

Use a framework without turning it into a scoring shortcut

The voluntary NIST AI Risk Management Framework organizes its core around Govern, Map, Measure and Manage. These functions support ongoing work across the AI lifecycle; they are not a one-time sequence. NIST’s AI RMF Playbook offers supporting actions to consider and adapt.

Review risk after deployment

Set review triggers for changes in data, purpose, model, supplier or permissions. Monitor complaints and exceptions as well as technical test results. Give someone authority to limit or stop use when agreed thresholds are exceeded.

Is an AI risk assessment the same as a security assessment?

No. Security is one part of the picture. Depending on the use case, the assessment may also need to address inaccurate outputs, unfair impacts, privacy, human oversight and harmful reliance on the system.

Can one assessment cover every AI tool?

A shared method can make assessments consistent, but the risks and controls still need to reflect each use case. Grouping similar cases can help only when the underlying assumptions genuinely match.

Related guidance

• AI Governance: A Practical Starting Plan for Your Organization
• ISO/IEC 42001 Readiness: From AI Policy to Evidence of Practice
• ISO/IEC 27001 Internal Audit: Preparing Evidence and Closing Gaps
• ISO/IEC 20000-1 Readiness: Connect Service Management to Evidence

Discuss your next step

Horus Consultancy provides IT GRC consulting and internal audit support for organizations in North America and the Gulf, with a physical base in Canada. Explore our services, read our FAQ, or book a call with Islam Elzayat. For professional education, visit Horus Academy.