Likelihood and Impact Analysis for AI Risk

Why This Topic Matters
Likelihood and impact analysis is the analytical core of AI risk management. Once an organization has identified AI-related threats and vulnerabilities (such as data poisoning, model inversion, prompt injection, biased outputs, model drift, or supply-chain compromise of pre-trained models), it must decide which ones deserve attention and resources. Likelihood and impact analysis converts a long list of possible AI failures into a prioritized set of risks that leadership can act on. For the ISACA Advanced in AI Security Management (AAISM) exam, this concept sits inside the AI Risk Management for Security domain and underpins later activities such as risk evaluation, risk response selection, control design, and risk reporting. If you misjudge likelihood or impact, every downstream decision—accept, mitigate, transfer, or avoid—will be flawed.

What It Is
Likelihood and impact analysis is the structured process of estimating two dimensions of an identified AI risk:
• Likelihood – the probability or frequency that a threat event will occur and successfully exploit an AI system vulnerability within a defined time frame.
• Impact – the magnitude of harm or consequence to the organization (and to affected individuals or society) if the event occurs.
These two dimensions are combined to derive a risk level or risk rating, usually expressed as Risk = Likelihood × Impact (qualitatively or quantitatively). This aligns with ISACA's broader risk frameworks (Risk IT, COBIT) as well as external references such as the NIST AI Risk Management Framework (Map and Measure functions), ISO/IEC 23894 (AI risk management guidance), and ISO 31000.

Key Terms You Should Know
• Inherent risk – risk level before any controls are considered.
• Residual risk – risk remaining after controls are applied.
• Risk appetite / tolerance – the amount of risk the organization is willing to accept; used to decide whether a rated risk is acceptable.
• Qualitative analysis – uses ordinal scales (Low / Medium / High, 1–5) and heat maps.
• Quantitative analysis – uses numeric values such as Annualized Loss Expectancy (ALE = SLE × ARO), Monte Carlo simulation, or FAIR (Factor Analysis of Information Risk).
• Semi-quantitative analysis – assigns numbers to qualitative bands to enable ranking.
• Risk register – the record where each AI risk, its likelihood, impact, rating, owner, and response are documented.

How It Works – The Process
1. Establish context and scales. Define the AI system boundary (training data, model, pipeline, deployment interface, third-party components) and agree on likelihood and impact scales approved by governance. Scales must be consistent across the enterprise so AI risks can be compared with other IT and business risks.

2. Assess likelihood. Consider factors unique to AI:
• Exposure of the model (public API vs. internal use).
• Attractiveness of the system to adversaries and value of the data.
• Known attack techniques and their maturity (e.g., MITRE ATLAS tactics).
• Existing control strength (input validation, access control, monitoring, adversarial training).
• Historical incidents, threat intelligence, and red-team findings.
• Rate of change in data or environment (higher drift means higher likelihood of performance failure).
• Human factors such as over-reliance on AI outputs or weak oversight.

3. Assess impact. AI impact is multidimensional. Typical categories include:
• Confidentiality – leakage of training data, PII, or proprietary model weights.
• Integrity – manipulated or poisoned outputs leading to wrong decisions.
• Availability – denial-of-service against inference endpoints or resource exhaustion.
• Safety and physical harm – especially for autonomous or cyber-physical systems.
• Fairness, ethical, and societal harm – discriminatory outcomes affecting individuals or groups.
• Legal, regulatory, and compliance – violations of the EU AI Act, GDPR, sector regulations.
• Financial – direct loss, fines, remediation cost.
• Reputational – loss of trust in the organization's AI.
Impact should be assessed as the worst credible outcome for the chosen scenario, and the highest-scoring category usually drives the overall impact rating.

4. Combine into a risk rating. Plot each risk on a matrix (heat map). For example, a 5×5 matrix produces a score of 1–25 and maps to Low, Medium, High, or Critical bands. Quantitative programs produce expected monetary loss ranges instead.

5. Compare against risk appetite and prioritize. Risks above tolerance require a response; risks within tolerance may be accepted with monitoring. The output feeds risk evaluation and treatment.

6. Document, communicate, and review. Record assumptions and rationale in the risk register. AI risks are dynamic—retraining, new data sources, model updates, regulatory changes, and newly discovered attack techniques all require re-assessment. Continuous monitoring of model performance, drift, and security telemetry provides evidence to update likelihood estimates.

AI-Specific Considerations That Differentiate This From Traditional IT Risk
• Probabilistic behavior – model outputs are non-deterministic, so "failure" is a distribution, not a binary event.
• Opacity – limited explainability makes it harder to estimate both likelihood and consequence.
• Data dependency – data quality and provenance strongly influence likelihood of poisoning, bias, and drift.
• Scale and speed – a single flawed model can affect millions of decisions quickly, amplifying impact.
• Third-party and foundation models – inherited vulnerabilities and limited visibility increase uncertainty; supplier assessments are part of likelihood estimation.
• Emergent and cascading effects – an AI failure can propagate into dependent systems and business processes.
• Stakeholder impact – harm to end users, customers, and society must be weighed, not just enterprise loss.

Common Pitfalls
• Treating all AI risks as "High" without analysis, which prevents prioritization.
• Assessing residual risk while believing it is inherent risk (or vice versa).
• Ignoring low-likelihood, catastrophic-impact scenarios (tail risks).
• Using inconsistent scales across teams so AI risks cannot be compared enterprise-wide.
• Performing a one-time assessment and not updating it as models retrain or drift.
• Letting technical teams assess business impact alone—business owners must participate.

Exam Tips: Answering Questions on Likelihood and Impact Analysis for AI Risk
1. Remember the formula and the sequence. Risk is a function of likelihood and impact. Identification comes before analysis; analysis comes before evaluation and response. If a question asks what to do "first" after identifying AI threats, the answer is usually to assess likelihood and impact, not to implement controls.

2. Distinguish likelihood drivers from impact drivers. Exposure, threat capability, vulnerability, and control strength affect likelihood. Data sensitivity, business criticality, number of affected individuals, regulatory exposure, and safety consequences affect impact. Questions often test whether you can categorize a factor correctly.

3. Watch for inherent vs. residual risk wording. If controls are described as already in place, the question is about residual risk. If asked for the risk "before controls," it is inherent risk.

4. Qualitative vs. quantitative. When the scenario lacks reliable data or history (common with new AI systems), qualitative or semi-quantitative analysis is the appropriate choice. When management wants monetary justification or cost-benefit comparison of controls, quantitative methods (ALE, FAIR) are the answer.

5. Prioritize by rating, then by appetite. The highest combined rating gets attention first, but the decision to treat depends on comparison with risk appetite and tolerance—not on the rating alone. The best answer frequently references risk appetite or business objectives.

6. ISACA favors the management and governance perspective. Correct answers typically involve engaging business owners, documenting in the risk register, aligning with enterprise risk frameworks, and reporting to senior management—rather than purely technical fixes.

7. Think multidimensionally about AI impact. If an answer option includes fairness, safety, legal, or societal harm alongside confidentiality, integrity, and availability, it is often the more complete and therefore better choice.

8. Favor continuous reassessment. Any option that treats AI risk analysis as a one-time event is usually wrong. Model retraining, drift, new data sources, and emerging attack techniques all trigger re-analysis.

9. Use elimination. Discard options that skip steps (e.g., jumping to controls), that rely on a single person's opinion rather than a defined methodology, or that ignore business context. Among remaining options, choose the one that is most comprehensive, repeatable, and aligned to the organization's risk framework.

10. Read for the keyword. "Most likely," "probability," "frequency" point to likelihood; "magnitude," "consequence," "severity," "harm" point to impact; "priority," "ranking," "heat map" point to the combined rating.

Quick Review Summary
• Likelihood = how probable; Impact = how severe; Risk rating = their combination.
• AI adds unique likelihood drivers (exposure, data dependency, adversarial ML techniques, third-party models) and unique impact categories (bias, safety, societal, regulatory).
• Use consistent enterprise scales, involve business owners, record results in the risk register, compare against risk appetite, and reassess continuously.
• On the exam, choose answers that follow the proper sequence, reflect governance and business alignment, and recognize the dynamic, multidimensional nature of AI risk.