​

Risks

Use the Risks workspace to identify, assess, treat, accept, and manage risks associated with an AI system.

​

When to use it

Use this workspace when you need to:

• record an identified AI governance risk;
• document the basis of a risk assessment;
• record inherent likelihood and impact;
• define a risk treatment decision;
• record formal risk acceptance where required;
• review previously recorded risks;
• update or retire a risk record.

​

What to enter

​

Risk definition

Record:

• Risk title — a concise name for the risk.
• Risk status — the current lifecycle status of the risk.
• Risk statement — describe the risk event and potential impact.
• Risk owner — identify the applicable governance responsibility.
• Risk category — classify the type or category of risk.
• Consequences — record potential consequences.
• Potential harms — record potential harms associated with the risk.

​

Risk assessment

Record:

• Assessment ID — identifier for the assessment.
• Assessment date — date of the assessment.
• Assessment type — for example initial, periodic, triggered, post-incident, post-change, reassessment, or retirement.
• Assessment result — record the assessment outcome.

​

Inherent risk rating

Record:

• Likelihood and likelihood level.
• Impact and impact level.
• Risk level.
• The workspace calculates the recorded score from likelihood and impact.

The rating should be supported by the organization’s defined risk assessment method.

​

Risk treatment

Record:

• Treatment decision — such as avoid, reduce, mitigate, transfer, restrict, accept, suspend, or retire.
• Treatment status.
• Treatment objective.
• Treatment rationale.

The treatment record should explain how the organization intends to manage the identified risk.

​

Risk acceptance

Use Formal risk acceptance required when the risk requires an explicit acceptance decision. Where applicable, record:

• Acceptance ID.
• Acceptance status.
• Acceptance authority.
• Effective date.
• Expiry date.
• Acceptance rationale.

Risk acceptance should be made by an appropriately authorized person or role according to the organization’s governance arrangements.

​

What the result means

A saved risk becomes a governance record associated with the AI system. The record provides traceability between: risk → assessment → rating → treatment → acceptance The record does not by itself establish legal compliance, certification, accreditation, or conformity assessment.

​

Reviewing existing risks

The Risk History section lists previously recorded risks for the AI system. For each record you can:

• View Details to inspect the complete governance record;
• Edit Details to update the record;
• delete a record when appropriate under your organization’s record-management rules.

​

What comes next

Risk records can inform:

• control selection and assessment;
• risk treatment activities;
• formal risk acceptance;
• governance review and approval;
• monitoring;
• reassessment after changes, incidents, or other triggers.

​

Framework reference

For the governance model behind this workspace, see the AIGO Framework guidance on AI Risk Management and the corresponding risk-management procedures and schemas.