Docs

Appearance

Risk Manager Path ​

Set up risk quantification as a delegable operating model: shared taxonomy, explicit budgets, and repeatable monetary outputs across AI Systems.

Outcome ​

You leave this path with:

  • a consistent organization risk taxonomy (categories, risks, threat vectors)
  • monetary risk appetite and allocations that enable quantification in AI Systems
  • a portfolio view of exposure that can be reviewed and adjusted over time

Time to first value: 60–120 minutes
Prerequisites: you are an Organization Risk Manager (or Organization Admin)

Path at a glance ​

Step 1: Review the organization risk taxonomy ​

Goal: create a shared language for rollups and budgeting.

Where in Modulos

  • Organization → Risk Management → Category Taxonomy
  • Organization → Risk Management → Risk Taxonomy
  • Organization → Risk Management → Threat Vector Taxonomy

Do this

  • Confirm categories match how leadership wants to see rollups (for example technical, legal, operational).
  • Ensure risk wording is reusable and consistent across AI Systems.
  • Ensure threat vectors are specific enough to quantify and to assign mitigations.

You’re done when

  • AI System teams can reuse the taxonomy without inventing their own definitions

Step 2: Set monetary risk appetite and allocations ​

Goal: turn risk appetite into an operating model with explicit budgets.

Where in Modulos

  • Organization → Risk Management → Risk Limits for total appetite and category allocations
  • Organization → Risk Management → AI System Risk Limits to allocate appetite across AI Systems

Do this

  • Set the total monetary risk appetite for the organization.
  • Allocate appetite across categories.
  • Allocate appetite across AI Systems so AI System teams can quantify within an explicit budget.

You’re done when

  • budgets are consistent and quantification is not blocked by missing allocations

Step 3: Support AI System quantification ​

Goal: help AI System teams produce monetary outputs they can act on.

Where in Modulos

  • AI System → Risks to manage AI System risks and threat selection
  • AI System → Risks → select a risk threat → Quantify to run quantification

Do this

  • Ensure each AI System has an appropriate AI System risk limit.
  • Encourage teams to start with the highest-impact threats and quantify iteratively.
  • Use the organization taxonomy to keep rollups consistent across AI Systems.

You’re done when

  • each active AI System has at least a first-pass quantified threat that contributes to rollups

Step 4: Review portfolio exposure and steer investment ​

Goal: make risk visible and comparable across AI Systems.

Where in Modulos

  • Organization → Risk Management → Risk Overview for portfolio rollups
  • AI System → Risks for exposure and prioritization per AI System

Do this

  • Review category and AI System exposure against budgets.
  • Identify outliers and ask for re-quantification when systems, vendors, or Controls change.
  • Use monetary exposure to prioritize mitigation and investment across teams.

You’re done when

  • the portfolio view is used as a steering signal, not a static dashboard

Next handoff ​

Compliance Lead

Use quantified risk to prioritize the governance backlog and Evidence plan

AI Product Owner

Keep the AI system scope and lifecycle stage current for governance decisions

Internal Audit

Validate that quantified risks and mitigations are backed by Evidence and traceable decisions