AI risk register maintained over time
Description
Identified AI risks are tracked in a register with status, owner, mitigation, and residual rating; reviewed quarterly.
⚠️ Risk Impact
Risks identified during design that aren't tracked through deployment disappear into Slack threads and JIRA backlogs. Auditors find them in the FRIA but can't tell what happened next — and neither can you.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as medium-severity findings with remediation guidance.
🔧 Remediation
Maintain a single AI risk register (e.g. JIRA project, Notion DB, or compliance-tool-of-choice). Every FRIA finding becomes a register row. Owner + status + due date + residual rating mandatory.
💀 Real-World Attack Scenario
A fintech identified 'model output is used as input to another model' as a high-risk amplification in their FRIA. The finding was logged in a Confluence page, then forgotten. Eight months later, the upstream model regressed on a specific customer segment; the downstream model amplified the regression; net effect: 23% increased denial rate for that segment. Reg probe followed.
💰 Cost of Non-Compliance
Reg probes citing 'risks identified but not tracked' as aggravating: 73% of CFPB AI enforcement actions 2024.
📋 Audit Questions
- 1.Show me the AI risk register.
- 2.What is the cadence of register review? Who attends?
- 3.How many open risks are >90 days past due-date?
- 4.Show me one risk that moved from 'open' to 'mitigated' — what evidence supports the closure?
⚡ Common Pitfalls
- ⛔Register exists but no one reviews it after the launch sprint
- ⛔Risks logged with no due date or owner — they sit in 'open' indefinitely
- ⛔Closing risks based on 'we made a code change' without verifying the change addressed the underlying concern
📈 Business Value
Maintained AI risk registers turn audits from forensic exercises into evidence walks. Reduces audit duration by ~50% and demonstrates 'reasonable care' in litigation defence.
⏱️ Effort Estimate
1 hour per risk entry; 2 hours quarterly review
EchelonGraph syncs findings into your JIRA/Linear/Notion register; flags stale entries
🔗 Cross-Framework References
Automate NIST AI-RMF MEASURE-3.1 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →