Exposure

Why the word is not risk

Directors hear risk as a register. The register has been seen, its entries are rated, and the ratings have not changed materially since the last meeting. The word invites recognition rather than inquiry.

Exposure asks a different question. Not what risks have been identified, but what is the worst realistic outcome, how would the organization arrive at it, and what stands in the way. That framing is harder to answer with a document, because it requires a sequence rather than a statement.

The distinction is visible in the artifacts. A risk register entry reads that there is a risk of incorrect output leading to customer detriment, rated medium. A failure path reads that the model's confidence scores are not calibrated for the population that grew fastest last year, that the review queue is sampled at five percent, that sampling is random rather than weighted toward low confidence, and that the first external signal would be a complaint. The second can be argued with. The first cannot, which is why it survives.

The human in the loop

EXP-4 exists because a claim of human oversight does not establish that the people involved can detect errors and act on them.

A person is a control where three conditions hold. They must be able to detect that the output is wrong, which requires access to the information the system used and a basis for independent judgment. They must have time to do so, which requires a volume of decisions compatible with genuine review. And they must be able to act, which requires authority to override and an absence of pressure to approve.

Where any of the three fails, the person is present but the control is not. A reviewer approving four hundred items a shift is producing a record of review, not review. A reviewer who sees only the recommendation and not the basis for it cannot detect an error. A reviewer whose performance is measured on throughput has an incentive not to look.

None of this is an argument against human oversight. It is an argument for establishing that the oversight claimed is oversight in fact, because a control that exists on the diagram and not in the operation leaves the exposure untreated while recording it as managed.

Autonomy is capability, not intention

The autonomy assessment required by EXP-4 records what a system is able to do without approval, not what it is expected to do.

This distinction matters because AI systems are frequently granted broad permissions for operational convenience and then described by their intended use. A system with write access to a customer record system is described as updating contact details. The exposure is determined by the permission, not by the description, and the gap between the two is where incidents occur.

Agentic systems make this acute, because the intended use is defined in natural language rather than in code. A system instructed to resolve customer queries and granted the permissions needed to resolve them can take any action those permissions allow, in pursuit of an objective that was stated loosely.

Aggregation

EXP-5 addresses the exposure that individual assessment cannot see.

Twenty systems each classified as low risk, all of which call the same vendor model, do not constitute twenty independent low risks. They constitute one dependency with twenty points of consequence. If that model is withdrawn, repriced, materially changed, or becomes unavailable, all twenty are affected simultaneously, and the organization discovers its concentration during the incident rather than before it.

The same applies to data sources and to vendors. Concentration is invisible in per-system assessment by construction, because each assessment is scoped to one system, and it is therefore only found by looking across the portfolio deliberately.