Risk Operating Model

Risk in Modulos is a continuous, monetary governance loop. You define a shared taxonomy and risk budgets at the organization level, then quantify and manage risk threats specific to each AI System over time.

For the conceptual model of why money and how expected loss works, see Risk Quantification.

Where to do what

Modulos splits risk work into two places: organization configuration and execution inside each AI System.

Organization level

Use these views to define the shared structure and budgets used across AI Systems.

What you want to do	Where in Modulos	Output
Define categories for rollups and budgeting	Organization → Risk Management → Category Taxonomy	Category structure
Define reusable risks and link them to categories	Organization → Risk Management → Risk Taxonomy	Risk library
Define reusable threat vectors and keep wording consistent	Organization → Risk Management → Threat Vector Taxonomy	Threat vector library
Set total risk appetite and category allocations	Organization → Risk Management → Risk Limits	Organization appetite and category shares
Allocate appetite across AI Systems	Organization → Risk Management → AI System Risk Limits	AI System risk limits

AI System level

Use these views to apply the taxonomy to a specific AI system or deployment context.

What you want to do	Where in Modulos	Output
Add risks into an AI System scope and select relevant threat vectors	AI System → Risks	AI System risks and risk threats
Quantify a specific threat	AI System → Risks → select a risk threat → Quantify	Quantification run and monetary value
Monitor rollups and compare against limits	AI System → Risks and Organization → Risk Management → Risk Overview	Portfolio and AI System exposure

Who can do what

Permissions are a combination of your organization role and your AI System role.

Organization roles

• Risk Manager can create and edit taxonomy and risk limit configuration.
• Admin and Member can view risk configuration and portfolio views, but typically cannot modify them.

AI System roles

• Owner can manage risks and start quantification runs.
• Editor can create and update AI System risks and threat selections, but cannot start quantification runs.
• Viewer can view risks and results for review and audit purposes.

If you can’t see an AI System’s Risks section, you likely don’t have an AI System role assigned for that AI System.

How risk becomes a portfolio signal

In Modulos, quantification happens at the risk threat level:

• an AI System risk contains one or more risk threats
• each risk threat can have multiple quantification runs with statuses
• only a run with status quantified contributes a monetary value to rollups

Rollups are sums:

• threat → risk → AI System → category → organization

This is why Modulos treats quantification as an ongoing process. You re-run quantification as systems, data, vendors, and Controls change.

Guardrails that block quantification

Quantification is blocked when risk budgets don’t add up consistently. In practice, this means:

• category shares must sum to 100% of total organization risk appetite
• the sum of all AI System risk limits must match total organization risk appetite
• within a category, the sum of individual risk limits should match the AI System’s category budget

These constraints turn risk appetite into a delegable operating model rather than a dashboard number.

123

Risk limits connect monetary appetite to categories and AI Systems so teams can govern with explicit budgets. UI shown in light mode.

1. 1
   Total appetite

   Set the top-level monetary risk budget for the organization.
2. 2
   Category allocation

   Allocate the budget across categories as percentages.
3. 3
   Save changes

   Changes affect whether quantification is allowed.

A practical operating cadence

Most organizations converge on a simple cadence:

• Set up once: taxonomy and appetite configuration
• Per AI System: add the relevant risks, select threats, quantify the top threats
• Continuously: mitigate the highest expected-loss threats through Controls, attach Evidence, and re-quantify after meaningful changes

Related pages

Portfolio Overview

Portfolio rollups, budgets, and the governance loop

Organization Taxonomy

Categories, risks, and threat vectors at the organization level

AI System Risks

Apply the taxonomy to an AI System and manage risk threats

Risk Quantification

Produce monetary outputs from rate and damage assumptions

Quantification Methods

Reference for every available method and its parameters

Acting on Quantified Risk

Compare exposure against limits, mitigate through Controls, and re-quantify