For Risk & Compliance
AI risk management for risk and compliance
How the second line runs and challenges AI from the inside. A book, serialised here chapter by chapter.
If you sit in risk or compliance, AI risk management is landing on your desk whether or not you built the AI. The reassuring part is that this is not a new discipline. If your firm already runs model risk management, third-party risk, and technology risk, you have most of what you need. AI stretches each of them rather than replacing them. I wrote Singapore's AI risk management guidelines, the AIRG, and before that led the thematic review of how banks actually manage AI model risk, so I have seen which second lines are real and which are theatre. This is the whole of it, written up as a short book and laid out below.
The book
AI Risk Management for Risk and Compliance
Published here in full, chapter by chapter: how to challenge without building or rubber-stamping, own the inventory and the rating, validate before go-live, watch after, and govern the AI you bought. Read it below. If it is useful, pass it on.
Start here
If you read one thing, read the five questions to ask your first line about AI. They are the whole book in miniature, drawn from the AIRG's oversight areas and read from the second line's seat.
The second line's frame
- Challenge, not build - your value is independent challenge and validation, not building the model and not rubber-stamping it.
- Where AI risk hides from you - the low rating your first line hands you, the inventory gap your net misses, and your own oversight going hollow.
- Proportionality is your throttle - you cannot validate everything, so match your effort to materiality, and audit the ratings before you rely on them.
The areas you run, in detail
- The three lines of defence for AI - your independence, and why you never mark your own homework or theirs.
- The AI inventory and the materiality rating - the two things you own as the control function. The heart of the book.
- Challenging AI before go-live - data, testing, fairness, and the independent validation gate you run.
- Watching AI after go-live - human oversight, drift, and why a retrain comes back to you.
- Third-party AI - most of it you bought, not built. Compensatory testing is your job.
- Building your function - validators who can challenge, sized to the estate, resourced and escalated.
The working reference
The AI risk management build grid condenses the book into the controls to have in place and the evidence to hold, area by area, mapped to the AIRG.
You do not need to invent a framework
Strip the packaging off the main frameworks and they converge on the same areas: inventory, materiality, oversight, lifecycle controls, capability. You already run most of them under model risk, third-party risk, and technology risk. So take a current framework with standing, read it against what you already do, and extend rather than start over. For how the main ones line up, see the AIRG compared to the EU AI Act, NIST, and ISO 42001.
Frequently asked questions
What is the second line's role in AI risk management?
The second line runs and challenges AI from inside the firm: independent challenge and validation, not building the model and not rubber-stamping it.
Is AI risk management a new discipline for risk and compliance?
No. If your firm already runs model risk management, third-party risk and technology risk, you have most of what you need. AI stretches each of them rather than replacing them, so you extend what you do rather than start over.
What does the second line own in AI risk management?
The AI inventory and the materiality rating, as the control function, plus independent challenge and validation before go-live and the monitoring after. You own these, and you do not mark your own homework or the first line's.
What should risk and compliance ask the first line about AI?
Start with the five questions, drawn from the AIRG's oversight areas and read from the second line's seat - the whole book in miniature.
How is the second line's role different from the regulator's?
The second line runs and challenges AI from inside the firm - owning the inventory and materiality, validating before go-live, and watching after. A regulator judges whether that programme is adequate from the outside.
Work with me
I train risk and compliance teams on turning AI risk management into a working system, grounded in the AIRG and AI risk management more broadly. See the courses and workshops, or get in touch.