Risk Management

Risk assessment discussions happen in meetings and emails with decisions made verbally. Rationale for risk ratings isn't documented so when questioned months later, you can't explain why. Collaboration on risk treatment happens outside the risk register with no audit trail.

Risk scores are numbers in spreadsheets that stakeholders don't understand. You can't visually show risk profile to executives without creating custom charts. Prioritisation isn't clear because high and moderate risks aren't visually distinct.

You assess inherent risk at identification then never reassess after controls are implemented. You can't show that controls actually reduce risk because residual risk isn't measured. Risk registers become static snapshots instead of living views of current risk posture.

Risk identification happens but treatment doesn't. Risks are documented with good intentions but no one is assigned to address them. Treatment plans exist in documents that aren't monitored for completion. You discover untreated risks when incidents occur.

You've documented controls but can't explain which controls address which risks. Risk treatment claims controls exist without proving they're relevant to the risk. Auditors ask "what controls mitigate this risk" and you have to search through control documentation.

Risk assessment is subjective with no consistent methodology for evaluating likelihood and impact. Different assessors rate similar risks differently because scales aren't defined. You can't prioritise risks because there's no quantitative scoring.

AI risks are tracked in spreadsheets alongside operational risks using categories that don't fit AI-specific concerns. You can't filter to see model risks versus data risks versus deployment risks. Risks are documented without linking to the use cases or vendors they affect, losing business context.