What is the first step in the AI Risk Management Life Cycle?

• A. IT Risk Identification
• B. System Deployment
• C. Penetration Testing
• D. Incident Escalation

Answer: (A)

Identifying IT risks is the starting point because you can’t manage what you haven’t discovered. In AI risk management, the first step is to catalog the assets, data, models, and systems involved, and to map out what could go wrong with them. This means considering data quality and privacy, training and deployment pipelines, model performance and drift, potential adversarial inputs, governance and compliance requirements, and the stakeholders who rely on the AI system. By identifying these risks upfront, you establish the scope and the specific risk factors you’ll later assess, quantify, and prioritize.

Once you know what could fail or be misused, you can move on to assessing likelihood and impact, determining controls, and planning monitoring and response. Deployment, testing (like penetration testing), and incident escalation are activities that occur after you’ve established the risk landscape and know what needs protection; they depend on having identified and understood the risks.