AI functional risk assessment
Connect a specific failure to its consequences, controls, tests and residual-risk decision.
Adapt this worksheet to your applicable procedures, intended use and requirements. Fictional examples are teaching material, not execution evidence.
Field instructions
- Requirement or function: Identify the specific intended behavior and stable requirement ID.
- Failure and cause: Describe a missed, wrong, unauthorized or unavailable behavior and credible contributing factors.
- Consequence and severity: Trace the process effect and apply the organization’s severity rubric.
- Existing control: Identify the control that interrupts the failure, including its owner.
- Control evidence: Link tests or other evidence showing the control works.
- Remaining gap: Record uncertainty, failed criteria and unresolved controls.
- Residual-risk decision: State accept, restrict, defer or other locally defined disposition with rationale.
- Owner and trigger: Identify who acts and which change or result triggers reassessment.
Completed fictional example
Fictional risk rows from PRA-01. No universal numerical risk score is implied.
| Risk / requirement | Failure and consequence | Control and evidence | Residual decision |
|---|---|---|---|
| R-01 / REQ-01 | AI omits critical alarm challenge; protocol coverage could be inadequate | Full required review and T-01/T-03 evaluation; two AI critical misses and one final assisted critical miss | Expanded reliance withheld; DEV-01/02 open |
| R-02 / REQ-02 | Unsupported requirement misdirects review | Approved-source verification; T-02 identifies six false AI findings, T-03 leaves two accepted | DEV-03 open; improve and retest |
| R-04 / REQ-04 | Unauthorized action or source disclosure | Permission boundaries; T-04 blocks six of six planned attempts | Supported only for tested scope; retain technical restrictions |
Blank worksheet
System / record ID: ____________________
Prepared by / date: ____________________
Required review / approval under local procedure: ____________________
| Field | Your entry |
|---|---|
| Requirement or function | ____________________ |
| Failure and cause | ____________________ |
| Consequence and severity | ____________________ |
| Existing control | ____________________ |
| Control evidence | ____________________ |
| Remaining gap | ____________________ |
| Residual-risk decision | ____________________ |
| Owner and trigger | ____________________ |
Blank results or assessment rows
| Risk / requirement | Failure and consequence | Control and evidence | Residual decision |
|---|---|---|---|
| ____________________ | ____________________ | ____________________ | ____________________ |
| ____________________ | ____________________ | ____________________ | ____________________ |
| ____________________ | ____________________ | ____________________ | ____________________ |