Certified AI Executive: Chief Risk Officer

What You Will Be Able to Do

• Explain what AI can and cannot do, test a team's or vendor's claims, and count the true cost of using it
• Choose where AI creates value, build a business case on measured baselines, and move pilots to scale or stop them
• Set accountability, risk controls and compliance for AI using recognized frameworks and regulation
• Lead the organization through AI: operating model, skills, workforce commitments, change and adoption
• Integrate AI into the enterprise risk framework with a clear taxonomy, cascaded appetite limits and key risk indicators
• Run model risk management for AI and generative AI, from inventory and tiering to validation, vendor models and monitoring
• Manage AI vendor and concentration risk, stress test the organization against AI failures, and address fraud, conduct and insurance gaps
• Use AI in the risk function safely, report AI risk to the board with an independent view, and build assurance, loss data and risk culture

Modules

1. Part 1: Executive Core

   Part 1 is the same in every executive certification.

2. 1AI Essentials for Executives

   Leaders do not need to build AI, but they do need to judge it. This module explains the main kinds of AI system, what models can and cannot do, why data sets the limits, how AI costs behave, and the vocabulary and tests a leader needs to question a team or a vendor.

   • Rule-based systems, machine learning, generative AI and AI agents
   • What models do and where they fail: errors, bias, drift and explainability
   • Data, economics and the vocabulary for questioning teams and vendors
   • Spotting hype and testing vendor claims on your own data

   Exercise. List the AI tools and features already in use in your area, including those built into software you buy. For each, note whether it is rule-based, machine learning, generative or an agent, what data it uses, and who reviews its outputs before they are acted on.

3. 2AI Strategy, Value and the Business Case

   AI is worth funding only where it changes a measure that matters. This module covers where AI creates value, how to build and rank a portfolio of use cases, when to build, buy or partner, how to write a business case that counts the full cost and tracks realized benefit, and how to move from proof of concept to scale or stop.

   • Where AI creates value and how to measure it
   • Use-case portfolios: value, feasibility and risk; build, buy or partner
   • The business case: baselines, total cost of ownership, payback and ROI
   • Proof of concept, pilot and scale; why pilots stall; stage gates

   Exercise. Take one AI proposal now under discussion in your organization. Write down its baseline measure, list every cost it will carry over three years (including data work, integration, change, monitoring and review effort), name the owner of each benefit, and set the criteria for the next stage gate.

4. 3AI Governance, Risk and Regulation for Leaders

   AI needs clear owners, a view of what is in use and controls that match the risk. This module covers accountability structures, risk tiering, the main frameworks and standards, how AI and privacy law apply in the US, Canada and the EU/UK, and the confidentiality, security, vendor and incident risks that leaders must manage.

   • Accountability, the AI governance committee, RACI and the three lines
   • AI inventory, risk tiering and risk appetite
   • NIST AI RMF, ISO/IEC 42001, and AI and privacy law across jurisdictions
   • Confidentiality, AI security, vendor risk and incident response

   Exercise. List the AI systems and tools used in your area, including AI features inside software you already buy. For each one, name the business owner, assign a risk tier using the questions in this module, and note one control that is missing.

5. 4Leading People and the Organization Through AI

   AI value depends on how people and work are organized around it. This module covers operating models and leadership roles, AI literacy, workforce impact and honest commitments, change management, shadow AI and acceptable use, and how to measure real adoption and lead by example.

   • Operating models and AI leadership roles
   • AI literacy and workforce impact: tasks, redesign and reskilling
   • Leading change: Kotter's eight steps, involvement and resistance
   • Shadow AI, acceptable use, real adoption and communication

   Exercise. Pick one team that has access to an AI tool. Find out how many people used it in the last week, which tasks they used it for and what stops the others, then agree two changes with the team and measure use again a month later.

6. Part 2: Chief Risk Officer

   Written for chief risk officers.

7. 5AI in Enterprise Risk Management

   The chief risk officer makes sure AI risk is identified, measured and governed inside the enterprise risk framework the board already relies on. This module covers fitting AI into COSO ERM and ISO 31000, building an AI risk taxonomy, turning the board's appetite into limits and key risk indicators, running the three lines when AI is everywhere, and assessing inherent and residual AI risk.

   • Integrating AI into COSO ERM and ISO 31000
   • An AI risk taxonomy that fits the existing register
   • Risk appetite, limits and key risk indicators for AI
   • The three lines and residual risk assessment for AI

   Exercise. Take your current enterprise risk register and tag every risk that AI could cause or worsen. Then pick three AI-related risks, write one key risk indicator for each with a green, amber and red threshold, and name the owner who would act on a red reading.

8. 6Model Risk Management for AI and Generative AI

   Model risk management is the discipline that keeps decisions from resting on models that are wrong or misused. This module explains how AI and generative AI change model risk, what the US, Canadian and UK supervisory regimes expect, and how to run the model inventory, risk tiering, validation and effective challenge, vendor model oversight and ongoing monitoring.

   • How AI and generative AI change model risk
   • US, Canadian and UK model risk expectations
   • Inventory, tiering, validation and effective challenge
   • Vendor models and ongoing monitoring

   Exercise. Pick one generative AI system in use in your organization and write down every component that shapes its output: the foundation model and version, prompts, retrieval sources, guardrails and human review. Then list which of those components would trigger revalidation if it changed.

9. 7Third-Party, Concentration and Emerging AI Risks

   Much of an organization's AI risk sits outside its walls, in vendors, their suppliers and a small number of foundation model and cloud providers. This module covers AI vendor risk from the risk function's seat, concentration in foundation models, scenario analysis and stress testing for AI failures, AI-enabled fraud and conduct and fairness risks, what insurance does and does not cover, and how to spot emerging AI risks early.

   • AI vendor risk and the regulatory view of third parties
   • Foundation model concentration and scenario analysis
   • Fraud, conduct and fairness risks from AI
   • Insurance, risk transfer and emerging risk identification

   Exercise. Choose your three most critical processes that use AI. For each, trace the chain from your organization to the vendor, the vendor's foundation model provider and the cloud it runs on. Then write one severe-but-plausible failure scenario for the weakest link and estimate what a week of disruption would cost.

10. 8The Risk Function, AI and the Board

    The risk function both oversees AI and increasingly uses it. This module covers using AI in risk and compliance work without weakening independence, designing AI risk reporting for the board, organizing independent assurance, collecting AI incident and loss data, building a risk culture in which people raise AI concerns early, and the CRO's own AI agenda and working relationships.

    • Using AI in risk monitoring and compliance
    • AI risk reporting and the CRO's independent view
    • Independent assurance and AI incident and loss data
    • Risk culture and the CRO's AI agenda

    Exercise. Draft the AI section of your next report to the board's risk committee on one page: profile against appetite, the three KRIs that moved most, model risk status, incidents and losses, and your own independent opinion in three sentences. Then list which items you could not fill from existing data.