Risk Management in the AI Era: A Playbook for Leaders
A Guide for Risk, Compliance, Legal and Governance Leaders Building AI-Enabled Operating Models
-
September 09, 2026
Downloads
Download Playbook
-
Developed by FTI Consulting in collaboration with the Risk Management Institute of Australasia (‘RMIA’), this playbook is designed to empower risk leaders to accelerate their transition to an AI-enabled operating model. It is written for Chief Risk Officers (‘CRO’), Chief Compliance Officers (‘CCO’), General Counsel (‘GC’), Chief Audit Executives (‘CAE’) and Chief Information Security Officers (‘CISO’).
Leaders need to act now to both seize the opportunity and avoid the compounding impacts of inaction. This playbook aims to give leaders the confidence to move faster on AI, realise the benefits while managing the risks and meeting the obligations.
The playbook is structured around six questions, each building on the last, from the case for acting, through to what to do in your first thirty days. These questions include:
- Why you need to act now?
- Who needs to take action?
- Where should action be taken?
- How do you build an AI-enabled operating model?
- What actions do you need to take?
- When do you take action?
Why You Need to Act Now
AI is enabling risk technology to enter a new generation of capability. In the 2000s GRC systems gave the profession its system of record. By the 2010s Integrated risk management solutions became systems of insight. What is arriving now is a system of action and adaptation, which is enabled by agentic AI that can autonomously reason, act and adapt within delegated authority. The future of work is a symbiotic relationship between Agentic AI and humans. Agentic AI to Agentic AI relationships will increasingly enable humans to be more productive and insightful, whilst delivering greater resilience and agility to the organisations they serve.
That is a step change, not a gradual progression. As a result, four things are happening at once: AI is shifting from experimentation to scale, adoption is spreading across the organisation, the external environment is becoming AI-enabled, and governance and accountability expectations are rising with it. Acting deliberately means shaping how AI enters your organisation while you still can, delay does not stop the shift, it just means inheriting someone else's design. As the leader in your organisation you have the most to gain, and lose, from seizing the opportunity AI presents.
Who Needs to Take Action
AI solutions are enabling new ways of working across the three lines of defence and at the Board. The first line (ownership) moves from executing controls to supervising AI-enabled execution. The second line (oversight) moves from periodic oversight to continuous challenge. The third line (assurance) moves from retrospective assurance to pre-deployment assurance, testing AI before it goes live rather than reviewing it afterwards. Accountability stays human throughout, the model modernises without weakening the accountability that underpins it.
The impact looks different depending on your role. A CRO, CCO, GC, CAE, CISO and the board each have different priorities and concerns when weighing the benefits, risks, obligations and costs. The playbook looks at the issue from each perspective, helping to show what matters most to each and where priorities may differ.
Figure 1: An Illustration Balancing the Benefits, Risks, Obligations and Costs of AI
Where AI Is Creating Value
The nature of the work changes in three ways: from periodic to continuous, from sampling to full-population testing, and from manual relay to agent-run with human confirmation. What began as a handful of automation opportunities in the 2000s has expanded into hundreds of AI-enabled use cases across risk, compliance, legal, audit and governance.
Figure 2: An Illustration of the Rapid Growth of AI-Enabled Use Cases
The playbook works through twelve examples in detail, from regulatory change management, to continuous controls monitoring, financial crime investigations and AI risk management itself. Each example sets out the role of AI, how it works in practice, the technology required, and the benefit, risk and obligation it carries.
How to Build It
An AI-enabled operating model is built through a sequence of steps. Set your ambition, assess where you are, determine priorities, validate requirements, then commence delivery. Each step produces something the next one needs, and governance, value realisation and change management run across all five.
Figure 3: A Five-Step Process To Build an AI-Enabled Operating Model
Two maturity models support the assessment. The first scores organisational capability, whilst the second scores people capability by role level, so the gap between what the function is designed to do and what its people can actually do becomes visible.
What Actions to Take
Standing up a program means building the roadmap and investment case, establishing delivery and governance, enabling culture and adoption, then piloting, learning and scaling.
The playbook includes an illustrative 12-month roadmap that sequences use cases alongside the enabling work across the operating model — because the two have to move together. Decision gates replace a single go-live, so risk is managed as the program scales rather than at the end.
When to Take Action
You do not need a fully formed program to begin. The playbook sets out a 30-day starting point: engage in the first ten days to build alignment, understand in the second ten to establish your baseline, and focus in the final ten to identify where AI can create the most value. After thirty days, you have leadership alignment, a clear view of your starting point, prioritised opportunity areas, two or three candidate use cases and a mandate for formal discovery.
The lessons from organisations already on this path are consistent: do not go it alone, engage the board and executives early, start with value rather than architecture, use the capability you already have, and make it safe to learn.
Download the Risk Management in the AI Era: A Playbook for Leaders or reach out to FTI Consulting to gain greater confidence in building an AI-enabled operating model.
Thank you to the RMIA for collaborating with FTI Consulting on this pioneering playbook.
Related Insights
Related Information
Published
September 09, 2026
Key Contacts
Senior Managing Director
Senior Managing Director, Head of Risk Advisory, Australia