1
Open the Risk Register and select Add risk
Risk Register is in the left-hand navigation. The Add risk button sits at the top right.To change an existing risk, use the pencil icon on its row, or open the risk and edit it from there. Anyone signed in at your firm can add, edit or remove a risk, not only the owner.For each tool you add, guardbook adds four starter risks with no scores: Data exposure; Hallucination and inaccuracy; Bias; and Limited information about the system. Score and complete those rather than adding duplicates.
2
Title
Required. Name the risk in the terms your firm would use in a meeting, not in the abstract. “Hallucinated valuation figures” is useful. “AI risk” is not.
3
Description
What the risk actually is, and how it would show up in your work. This is the clause 3.3 description, so it is optional in the form but not optional in substance.
4
Category
Free text rather than a fixed list, so pick a small set of category names and reuse them. Hallucination, Data exposure and Bias are reasonable starting points. Consistency here is what makes the register readable a year from now.
5
Status
Required, and defaults to Open.
- Open. Live and being managed.
- Mitigated. Controls are in place and working.
- Accepted. Knowingly carried, usually because the residual score sits within appetite.
- Closed. No longer applicable.
6
Linked tool
Optional, and only shown once your firm has at least one tool on the Tool Register. Link the risk where it belongs to a specific tool. Leave it blank for risks that apply across your AI use generally.
7
Inherent likelihood and impact
Each scored 1 to 5. Inherent means before your controls, the risk as it would be if you did nothing.Score honestly. An inherent score that already looks comfortable usually means the controls have been scored in by mistake.
8
Existing controls
What you already do about it. Supervision arrangements, tool settings, what staff are told not to put into a system, checks before an output is used.
9
Residual likelihood and impact
Each scored 1 to 5. Residual means after the controls above. The gap between inherent and residual is the argument that your controls do something.If they are identical, either the controls are not working or they have not been thought through.
10
Risk response
Avoid, Reduce, Transfer or Accept. These are the usual ways to treat a risk. Accept is a legitimate answer when the residual score is within your firm’s appetite, and it is better recorded than left blank.
11
Additional actions
What you will do next to bring the risk down.
12
Control owner
The person or team responsible. This is free text.
13
Target date
When the additional actions should be done.
14
Add risk
Add risk (or Save changes when editing) saves the risk.