Risk & Resilience
ColdAI's risk and resilience work gives leadership one view of the risks that can stop the business: cyber, operational, regulatory, third-party, strategic and AI. We assess and quantify exposure, design a framework that fits your risk appetite and obligations, build the monitoring and response capability to run it, and test it through exercises and simulations, so that resilience is something you have practiced rather than something you have written down.
In depth
Go deeper into risk and resilience methods
Five practical guides to the methods and rules behind an integrated risk program, each usable by your own team.
- 01Deep diveCyber risk quantification with FAIRHow to quantify cyber risk with FAIR: scope a scenario, gather calibrated ranges, run a Monte Carlo model and present a loss exceedance curve to the board.
- 02ProcessThird-party risk management lifecycleThe third-party risk management process from inventory and tiering through due diligence, contracts, monitoring and exit, mapped to DORA, NIS2 and US guidance.
- 03Regulation explainerNIS2 compliance guideDoes NIS2 apply to you? The scope test, essential versus important entities, Article 21 measures, Article 23 reporting deadlines and a gap-assessment sequence.
- 04ChecklistAI incident response plan checklistA checklist for an AI incident response plan: incident types, severity, detection signals, AI-specific containment, evidence to keep and notification duties.
- 05GuideHow to run a cyber tabletop exerciseA facilitator's guide to tabletop exercises: objectives, participants, timed injects, regulatory clocks, the hot wash and a tracked after-action report.
How We Help
ColdAI's risk and resilience capability combines advanced analytics with deep domain expertise to help organizations understand their full risk landscape. We build integrated risk management frameworks that go beyond compliance to create genuine competitive advantage through superior risk intelligence and organizational resilience.
Our Approach
We approach risk management as a strategic capability — not just a compliance function — integrating risk intelligence into decision-making across the organization.
Risk Assessment
Comprehensive assessment of your risk landscape across cyber, operational, regulatory, strategic, and emerging technology dimensions — quantifying exposure and identifying critical gaps.
Framework Design
Design integrated risk management frameworks that align with your risk appetite, regulatory requirements, and strategic objectives — balancing protection with organizational agility.
Capability Building
Build the tools, processes, and organizational capabilities needed to manage risk effectively — including monitoring systems, response protocols, and governance structures.
Resilience Testing
Test organizational resilience through scenario exercises, crisis simulations, and red team assessments — continuously strengthening your ability to withstand and recover from disruption.
Our Offerings
Cyber Risk Management
Comprehensive cyber risk programs including threat assessment, security architecture review, incident response planning, and continuous monitoring.
Enterprise Risk Management
Design and implementation of integrated ERM frameworks that provide leadership with clear visibility into organizational risk exposure and mitigation effectiveness.
Regulatory Compliance
Compliance program design for emerging technology regulations including AI governance, data protection, digital assets, and cross-border requirements.
Business Continuity
Business continuity planning and crisis management programs that ensure organizational resilience through disruption scenarios.
Third-Party Risk
Comprehensive third-party risk management including vendor assessment, supply chain resilience analysis, and continuous monitoring of critical dependencies.
AI Risk & Safety
Specialized risk assessment for AI systems including model risk management, bias testing, safety evaluation, and regulatory compliance for AI deployments.
Six risk domains, one picture for leadership
Most organizations already manage risk, just in separate rooms. Security reports vulnerabilities to the CISO, compliance tracks regulatory change, procurement assesses suppliers, finance models market risk and a newer AI governance group reviews models. Each view is reasonable on its own. The trouble is that real disruptions cross every boundary: a ransomware attack on a supplier is a cyber, third-party, operational and regulatory event at once, and nobody owns the whole of it.
An integrated approach does not mean one giant register. It means a shared risk taxonomy, a common way of rating and, where it matters, quantifying exposure, a risk appetite that leadership has actually agreed, and escalation routes that bring cross-domain events to the people who can decide. Specialist teams keep their depth; the framework connects them.
This page sets out how we approach that framework and when to start where. The in-depth guides below cover the specialist methods: putting cyber risk in financial terms, running third-party risk from onboarding to exit, meeting NIS2, preparing for AI incidents and rehearsing decisions through tabletop exercises.
Risk appetite at the center, six domains around it
- Risk appetite and governance
The board-agreed limits, escalation routes and committee structure that every domain reports into.
- Cyber
Threats to the confidentiality, integrity and availability of systems and data.
- Operational
Failures of processes, people, facilities and technology that interrupt critical services.
- Regulatory
Obligations under cybersecurity, data protection, AI and sector rules, and the cost of missing them.
- Third-party
Dependence on suppliers, cloud and AI providers, and their own subcontractors.
- Strategic
Shifts in markets, technology and geopolitics that undermine the plan itself.
- AI
Model error, bias, data exposure and autonomous actions in AI systems you build or buy.
COSO ERM or ISO 31000: choosing the backbone for an ERM framework
Both are credible foundations. The better fit depends on who will use the framework and what it must connect to.
| Question | COSO ERM | ISO 31000 | Using both |
|---|---|---|---|
| What it is | A framework that integrates risk with strategy setting and performance management2 | International guidelines setting out principles, a framework and a risk management process3 | ISO 31000 process vocabulary inside a COSO-style governance structure |
| Natural home | Organizations whose internal control and audit already speak COSO | International groups and public bodies that prefer ISO-aligned management systems | Groups with both listed-company governance and ISO-certified operations |
| Strength | Ties risk to strategy, objectives and board oversight | Short, generic and adaptable to any sector or size | Board language from one, practical process from the other |
| Watch out for | Can become a documentation exercise detached from decisions | Guidance rather than requirements, so it is not certifiable on its own | Two vocabularies unless terms are mapped once and enforced |
Neither framework tells you how to quantify a specific risk or meet a specific regulation. That is what the specialist methods below add.
What assessment, design, capability building and testing deliver
The four steps of our approach, described by what you hold at the end of each.
Risk Assessment
A cross-domain risk register with consistent ratings, the handful of scenarios that matter most, and financial ranges for those where a funding decision depends on it, using methods such as FAIR cyber risk quantification.
Framework Design
Risk appetite statements leadership can apply, policies, committee terms of reference, and a map of obligations such as NIS2 and supplier rules built into a third-party lifecycle.
Capability Building
The monitoring, response protocols and reporting that make the framework run, including playbooks for new failure types such as an AI incident response plan.
Resilience Testing
Exercises that rehearse decisions, such as a tabletop exercise, alongside crisis simulations and red team assessments, with findings tracked to closure.
Where to start when every risk feels urgent
- If
A regulatory deadline or supervisory review is approaching.
ThenStart with a gap assessment against that obligation, scoped to the services it covers.
A fixed date sets the order of work, and the evidence gathered feeds the wider framework.
- If
The board is asking how much cyber risk the organization carries, or whether a security budget is right.
ThenQuantify the top few scenarios before building anything else.
Financial ranges let leadership compare security spend with other investments and set appetite.
- If
A supplier incident recently disrupted operations.
ThenRe-tier third parties by inherent risk and test exit plans for the critical ones.
The incident shows where dependence was underestimated, and attention is high.
- If
AI systems are moving from pilots into customer-facing or decision-making use.
ThenAdd AI to the risk taxonomy and prepare containment and incident response before launch.
AI failures scale with traffic, so containment levers must exist on day one.
- If
Plans exist but have never been exercised.
ThenRun a tabletop exercise against the current plans before rewriting them.
An exercise shows which parts of the plan fail in practice, so rewriting effort goes where it matters.
Operational resilience and business continuity inside the same framework
Business continuity planning used to start from buildings and systems: what happens if this site or that server is lost. A resilience view starts from the services customers and the market depend on, maps the people, processes, technology, data and suppliers behind each one, and sets how much disruption each service can tolerate before harm becomes unacceptable. Recovery plans then follow from those tolerances rather than from the technology inventory.
Keeping continuity inside the enterprise framework matters because the same dependency appears in several places. A cloud region that hosts three critical services is a cyber risk, a third-party concentration risk and a continuity risk at once; one owner, one rating and one tested recovery plan beats three partial ones. Our business continuity offering covers continuity planning and crisis management programs on this basis.1
Placing AI risk in the enterprise risk taxonomy
AI risk is not a separate universe. Model error is an operational risk, biased decisions are a conduct and legal risk, data exposure through a model is a privacy and cyber risk, and dependence on one model provider is a third-party risk. The practical step is to add AI-specific causes and controls to the existing taxonomy, with an AI owner for each system, rather than running a parallel register that the risk committee never sees.
Our AI risk and safety offering covers model risk management, bias testing, safety evaluation and compliance for AI deployments.1 AI can also strengthen the risk function itself: AI-assisted SOC alert triage and AI supplier risk monitoring are worked use cases for security operations and procurement. Governance of AI across the business sits with our artificial intelligence capability.
When another adviser is the better choice
Frequently asked questions
What is the difference between risk management and resilience?
Risk management identifies, assesses and treats risks so that bad events are less likely or less damaging. Resilience is the ability to keep critical services running, or recover them quickly, when something happens anyway, including events nobody predicted. A mature program needs both: risk management decides where to invest in prevention, and resilience planning and testing make sure the organization can absorb what prevention misses.
Do we need to choose between COSO ERM and ISO 31000?
No. Many organizations use COSO's governance and strategy linkage at board level and ISO 31000's process vocabulary in operational teams. What matters is choosing one set of terms and rating scales, documenting how they map, and applying them consistently. A framework built on either one will still need specialist methods for cyber quantification, regulatory compliance and third-party risk.
Should we write a risk appetite statement before quantifying risk?
Draft one early but expect to revise it. An appetite written without any sense of actual exposure tends to be either meaningless or unachievable. Quantifying a few priority scenarios gives leadership something concrete to react to, which usually produces a sharper appetite statement. The two steps work best as a loop rather than a strict sequence.
How does AI change crisis management for a typical organization?
It shortens the time available to decide and adds new kinds of crisis. Synthetic media can drive a reputational or fraud event within hours, AI systems can fail at scale without any attacker, and autonomous agents can take actions that must be reversed. Crisis plans need AI-specific scenarios, clear authority to switch systems off, and regular exercises that include those events.
Can a risk program be built in stages rather than all at once?
Yes, and it usually should be. Start where pressure or exposure is highest, such as a regulatory deadline, a board question about cyber exposure or a recent supplier failure, and design that work so it fits the eventual framework: shared taxonomy, consistent ratings and one escalation route. Each later stage then extends the same structure instead of creating another silo.
Sources
- Risk and Resilience capability: approach, offerings and insights — ColdAI
- Enterprise Risk Management: Integrating with Strategy and Performance — Committee of Sponsoring Organizations of the Treadway Commission (COSO)
- ISO 31000:2018 Risk management: Guidelines — International Organization for Standardization
Our Insights
Cyber Risk Quantification: Speaking the Language of the Board
Why translating cyber risk into financial terms is essential for effective security investment — and how leading organizations are using quantitative risk models.
Navigating Regulatory Complexity in Emerging Technology
How organizations can build compliance capabilities that keep pace with rapidly evolving regulations across AI, data, digital assets, and cybersecurity.
Crisis Management in an AI-Accelerated World
How AI changes the speed, scale, and nature of organizational crises — and what organizations need to update in their crisis management capabilities.