Risk-to-tolerance mapping is applied
Description
Identified impacts are mapped against the organisation's risk tolerance bands; out-of-tolerance systems are blocked or modified.
⚠️ Risk Impact
Without mapping, identified risks become a list nobody acts on. The system ships anyway. Auditors find the FRIA and ask 'what did you do about the high-rated items?' — and there is no answer.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as medium-severity findings with remediation guidance.
🔧 Remediation
For every FRIA finding rated above tolerance, document one of: mitigated (with mitigation + residual rating), accepted (with named accepting authority + rationale), or blocked (system does not proceed). Surface the inventory of accepted risks to leadership quarterly.
💀 Real-World Attack Scenario
A logistics company's route-optimisation AI flagged a 'high-magnitude' risk that the model would systematically de-prioritise low-income ZIP codes. The team noted the risk but didn't classify it as 'accept' or 'mitigate'. Six months later, a journalist's data-analysis piece showed the disparity; the company had no documented decision rationale to defend in the resulting regulatory probe.
💰 Cost of Non-Compliance
Undocumented risk acceptance materially weakens defence in regulatory probes; CFPB and FTC enforcement actions cite 'absence of documented risk treatment' as an aggravating factor in 73% of AI cases (2024 enforcement data).
📋 Audit Questions
- 1.Show me your inventory of accepted AI risks.
- 2.Who has the authority to accept which risk levels?
- 3.When was the last 'block' decision — what was the reason?
- 4.How are accepted risks surfaced to the board?
⚡ Common Pitfalls
- ⛔Defaulting to 'accept' for every finding because mitigation slows time-to-market
- ⛔Accepting risks at the wrong organisational level (engineering manager accepting board-level risks)
- ⛔Not refreshing the accepted-risk inventory when the system or business context changes
📈 Business Value
A maintained accepted-risk inventory is the strongest defence in regulatory probes — converting 'they didn't notice' into 'they knew and made a documented business decision'. Reduces probe duration by ~40%.
⏱️ Effort Estimate
1-2 hours per finding for tolerance mapping; quarterly review of accepted inventory
EchelonGraph maps live finding severity to your defined tolerance bands; routes unmapped findings for owner decision
🔗 Cross-Framework References
Automate NIST AI-RMF MAP-5.1 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →