AI Auditing
AI Risk & Control Matrix
Free AI risk and control matrix (RACM) in Excel: 92 AI risks with suggested controls and audit tests, for internal audit, risk and compliance teams.
1. Overview
Version 2.1: 92 AI risks across 14 domains, each with a suggested control, the evidence to ask for and tests of control design and operation. Download the matrix: it is free, and we will email it to you straight away.
What is an AI risk and control matrix?
A risk and control matrix (RACM) lists what can go wrong, the control that should stop it, and how you test whether that control works. Auditors have used them for decades for finance and IT. Ours does the same job for AI: 92 risks, from governance and data to generative AI and AI agents, each with a suggested control and the tests to check it.
Built for:
Internal auditors who need testable controls
Risk and compliance teams who need a defensible view of AI risk
Executives who want assurance that AI isn't a black box
Why have we done this?
Over the years, we have had a lot of exposure to a lot of frameworks.
Most of them are useless.
The typical governance framework tells you that AI has risks. It uses words like "responsible", "ethical" and "trustworthy" without ever explaining what they mean in practice. It gives you principles when you need procedures. It sounds impressive in a board presentation and falls apart the moment someone asks, "So what do we actually do?"
This matrix exists to change that. Each risk tells you what can go wrong, what a good control looks like, when the risk applies, what evidence to ask for and how to test it.
It is not perfect. It is not comprehensive. It reflects our experience, which means it has blind spots. Some controls will not fit your context. Some risks will not apply to you. Some of our reading of the regulations may differ from your lawyers'.
There may also be the odd error.
Sorry.
But it is a starting point that helps you do something, rather than another set of principles to file away, or something you need an expensive specialist just to read. In our experience, most IT auditors can run with most of this without specialist support.
(If you do want support, we would be happy to help. Please shout 😀)
It is released under the Apache 2.0 licence. Take it, use it, adapt it, build on it. If you find problems or have improvements, tell us at hello@bloch.ai.
What's new in version 2.1
Version 1.0 came out in November 2024. A lot has happened since, not least AI agents. Version 2.1:
92 risks across 14 domains, up from 84 across 12.
A new Agentic AI domain: agents with too much authority, tool-call errors, agent identity and access, prompt injection through content the agent reads, runaway multi-agent loops, and agent actions you cannot trace.
A new Risk and impact assessment domain: whether AI risks are assessed consistently, reassessed after change, accepted by someone with the authority to do so, and whether impacts on vulnerable people are considered before go-live.
Test procedures for every risk: evidence to request, a design test and an operating test.
A working assessment: scope sheet, assessment sheet and action log, so you can run the review in the workbook, not just read it.
A sources register with links to the laws, regulations, standards and guidance behind the risks, and columns to record which apply to you.
New risks including AI-enabled fraud and impersonation, workforce impact, automation bias, and people treating AI as if it were human.
Plainer, testable controls, written in the present tense so you can compare them directly with what you find.
Two things from 1.0 have gone, deliberately. We replaced the Y/P/N deployment flags with a "When it applies" note on each risk, because the honest answer was usually "it depends". And the per-risk citations across four jurisdictions are replaced by the sources register, because a citation that is out of date in six months does more harm than good. Check the source, then record the specific requirement yourself.
2. Quick start
Get going in ten minutes
You do not need to read it all before it becomes useful.
Download it and read the Cover tab. It tells you what each tab is for and how to use it. Excel means you can filter, sort, highlight and add columns. In our experience, this is how frameworks actually get used.
Agree on your scope. Complete the Scope tab: which AI system or process, why you are reviewing it, for what period, and who will rely on the answer. Most AI reviews go wrong here, not later.
Work out how you deploy AI. This matters more than most people realise. Are you calling APIs from OpenAI, Anthropic or Google? Are you running open-source models on your own servers? Fine-tuning or building your own? The risks differ a lot. Each risk's "When it applies" note tells you how.
Pick your starting point. If you are an auditor, start with the domain that matches your engagement. Not sure where to start? Start with Governance. If you are in risk management, start with whatever keeps you awake at night. Worried about bias? Ethics and outcomes. Rolling out agents? Agentic AI. Nervous about that generative AI pilot? Generative AI.
You don't have to audit all of these. You don't need to boil the ocean.
Compare the suggested control with reality. For each risk that matters, read the suggested control. It describes what good may look like. We are not saying this is what you must do, but it's better to know what good looks like before looking at what your organisation actually has. The gap is either a finding, a risk acceptance or a remediation project. Or, for us, a better control we will gladly add to the matrix. Thank you.
Test it. The Test Procedures tab gives you the evidence to request and how to test design and operation. Set your own period and sample.
That is genuinely it. Ten minutes to get oriented, and you have a structured way to think about AI risk rather than starting from scratch or bringing in a so-called expert from a co-source provider.
3. The 14 AI risk domains
What the matrix covers
1. Governance (11 risks)
The foundation everything else builds on. Strategy, policy, roles, accountability, inventory, audit trails, training, human oversight. Boring but essential.
Organisations that get this wrong tend to get everything else wrong too. If nobody owns AI decisions, if there is no policy, if senior leadership is not engaged, your technical controls are theatre.
These risks apply no matter how you deploy AI. Whether you built it or bought it, someone needs to be accountable for what it does. Be pragmatic, though. Don't let governance stifle innovation; use it to clear the path for safe, managed adoption.
2. Data and privacy (8 risks)
Privacy and data protection, but the AI flavours. Models that memorise training data and spit it back out. Re-identification of "anonymised" data. Staff pasting confidential information into ChatGPT. Personal data used without a lawful basis. Automated decisions without the safeguards the law requires. Your DPO will have plenty to think about.
3. Model and lifecycle management (9 risks)
Don't forget that AI is a mathematical model, despite what many people think. And like any model, it degrades. Data drifts. Systems that worked in testing fail in production. Changes go in untested. Documentation is missing. Nobody plans to switch it off until they have to switch it off urgently. If you are in financial services, this is where model risk management expectations such as PRA SS1/23 live.
4. Security and resilience (6 risks)
Standard security frameworks were not designed for AI. Adversarial inputs that fool models. Prompt injection that hijacks behaviour. Model theft through the API. Incident response your SOC has not planned for. And new in 2.1: deepfake voices and video, and AI-written phishing, that talk staff past your payment and access checks. Few risks, but they are big ones.
5. Ethics and outcomes (12 risks)
Now this is where it gets contentious. The environmental cost of AI workloads. Physical safety when AI influences real-world systems. Financial harm from bad recommendations. Psychological manipulation. Discrimination, both direct and through proxies. Historical bias amplified at scale.
Some people think ethics is fluffy. Regulators increasingly disagree, and we would bet your customers do too.
6. Transparency and explanation (3 risks)
Decisions that cannot be explained to affected people, the regulator asking questions, or those trying to provide assurance. People not told they are dealing with AI or AI-generated content. Required reasons and notices not given. The details vary by use, sector and jurisdiction. The principle doesn't: if you cannot explain how a decision was made, you have a problem.
7. Generative AI (5 risks)
Risks that barely existed five years ago. Models that help someone build a weapon. Hallucinations presented with complete confidence. Citations to non-existent sources. Harmful, illegal or abusive content on demand.
8. Deployment and use (4 risks)
The risks that cause pain in nearly every organisation we work with. Shadow AI adopted across the business without anyone's sanction, sometimes on personal phones. AI costs that grow faster than anyone budgeted. People rubber-stamping whatever the AI says. And people treating a chatbot like a person.
None of it is glamorous. All of it is common.
9. Monitoring and improvement (4 risks)
Governance without monitoring is a pointless waste of time.
Internal audits that don't cover AI.
Management reviews that don't actually review anything.
Incidents closed without anyone learning from them.
Findings left to languish.
If nobody is watching, your controls are theoretical.
10. Procurement and dependencies (3 risks)
Third-party risk, AI style. Not knowing where a model came from or what it can't do. There are lots of great open-source models, but how far can you trust one whose makers haven't said how it was trained? A supply chain concentrated in the hands of a handful of providers. Lock-in that becomes expensive to escape.
11. Legal and regulatory applicability (9 risks)
The specific rules that go beyond general AI governance. Algorithmic trading. Model risk management. US state and local AI laws. Insurance regulators' expectations. Algorithmic collusion on prices. Manipulative techniques and exploiting vulnerable customers. Obligations for AI that the law classifies as high-risk.
12. Systemic and integration effects (4 risks)
If you are a banker, these keep prudential regulators awake at night. Credit-risk model errors that hit the balance sheet. AI meeting legacy systems and failing. Everyone using similar models and moving together. AI that makes a bad market worse. You could argue these are macro concerns, but they start with individual firms making individual decisions.
So make smart ones.
13. Agentic AI (6 risks) — new
AI that doesn't just answer but acts: sends the email, updates the record, makes the payment. Agents given more authority than the task needs. Wrong tool calls. Agents with no identity of their own, borrowing a person's access. Instructions hidden in a web page or document the agent reads. Agents calling agents in loops nobody can stop. Actions nobody can trace back. If you are building agents, our n8n guide shows the guardrails in practice.
14. Risk and impact assessment (8 risks) — new
Whether the organisation assesses AI risk properly. Assessments done once and never repeated. People without the authority to accept risks accept them. Controls nobody has mapped to the systems they protect. Impacts on vulnerable and protected groups not considered before go-live. Foreseeable misuse not thought about.
4. For internal auditors
Using the matrix to audit AI
Internal audit is increasingly expected to give assurance over AI. That expectation often comes without budget, training, or a methodology. We built this matrix because we kept having the same conversation with audit teams trying to figure out where to start.
Scoping engagements. The 14 domains give you a structure for coverage. You do not need everything in one audit. A governance review looks at domain 1, a data protection audit at domain 2, a model risk review for a bank at domains 3, 11 and 12. What you should not do is assume "AI audit" is one thing. The risks are too diverse, and right now it's a multi-year programme.
Building audit programmes. We do the work for you as a starting point. For each risk, we suggest a control, the evidence to ask for, a design test (is the control designed to address the risk?), and an operating test (did it actually work over the period?). Adapt them to your scope and sample, record the results in the Assessment tab, and log the actions.
Professional scepticism. Your auditees will tell you they "just use APIs," as if that means AI governance doesn't apply. It doesn't work that way. Most governance risks apply regardless of how AI is deployed, and confidential data risks apply especially to API use because your data leaves your environment. Push back on the deployment model as an excuse for narrowing your scope.
Writing findings. "AI governance arrangements are inadequate" is weak. "The firm cannot show how its AI-driven customer communications meet the FCA Consumer Duty consumer understanding outcome" is stronger and harder to argue with. The sources register points you to the rules; check them yourself before you cite them.
Dealing with second line. Your risk and compliance colleagues may be using ISO 42001, the NIST AI RMF, a vendor framework or something home-grown. There is a ton of overlap. You should test the same underlying risks even if the wording differs, and the sources register helps you translate.
Reporting upwards. Audit committees want to understand AI risk without drowning in detail. Report coverage, findings and residual risk by domain. That gives your committee something it can act on.
5. For risk managers
Using the matrix for enterprise risk management
AI risk does not fit neatly into traditional taxonomies. It is partly operational, partly technology, partly conduct, partly strategic. It touches legal, data protection and third-party management. Existing frameworks struggle with it. The matrix gives you a structured way to identify AI risks without rebuilding your whole framework.
Knowing what you have. You cannot assess AI you do not know about. Start with an inventory: what AI exists, who owns it, what it does, what data it uses, what decisions it informs. When someone says they have no AI, walk them through the domains. Third-party APIs? Automated decisions? Predictive models? Chatbots? Copilots? Agents? Often "we don't have AI" means "we don't call it AI".
Working through the risks. Not all 92 will be relevant. A firm with no customer-facing AI has less Consumer Duty exposure. But be honest with yourself:
Shadow AI means risks exist that you have not sanctioned.
Your inventory is probably incomplete.
And just because you don't have to comply with something doesn't mean you shouldn't adopt its good practices and apply them pragmatically. You know it's the right thing to do.
Assessing controls. For each relevant risk, compare what you have with the suggested control and document the gaps. Some gaps will be acceptable within your risk appetite. Others need fixing. The matrix does not tell you which is which. That's your judgement, and the Risk and impact assessment domain helps you make sure the right person makes it.
Integrating with existing frameworks. You already have operational, technology and third-party risk frameworks. These AI risks need to connect to them, not replace them.
Challenging the business. When a business unit proposes an AI initiative, use the matrix to structure the challenge. Which risks does this introduce? What controls are planned? Who is accountable if it goes wrong?
Good luck. Your job is probably the hardest one 🤞
6. For compliance
Using the matrix for AI regulatory compliance
AI regulation is a moving target. New rules keep arriving, existing ones are being reinterpreted, and deadlines move. Keeping track of what applies and showing that you comply is hard.
Finding your obligations. The Sources tab lists the laws, regulations, standards and guidance behind the risks, across the UK, EU, US and Canada, with links. Use its columns to record whether each applies to you and the specific requirement. It is a starting point, not your legal register.
The EU AI Act. If you operate in the EU or serve EU customers, it applies wherever you are based. Prohibited practices and AI literacy duties have applied since February 2025, and duties for general-purpose AI models since August 2025. The Digital Omnibus, in force since July 2026, pushed most high-risk obligations back to December 2027 and AI built into regulated products to August 2028. Transparency duties were not delayed. Dates have already moved once, so check them before you plan around them.
We ❤️ the EU AI Act, because it protects us. Many organisations take the toughest regulation and apply it across their global estate. That's not a bad idea, but expect a bumpy ride: EU AI Act compliance is tough and expensive.
Existing regulation. Most AI obligations today come from existing rules applied to new technology. GDPR and the UK's Data (Use and Access) Act cover automated decisions. Model risk guidance covers AI models: PRA SS1/23 in the UK, and SR 26-2, which replaced SR 11-7, in the US. The Consumer Duty covers AI-driven customer outcomes. Equality law covers AI discrimination. When regulators ask how you govern AI, you can show how your existing framework covers the AI-specific risks.
Gathering evidence. The Test procedures tab lists the evidence for each risk: policies, training records, risk and impact assessments, approvals, monitoring outputs. If you cannot produce these things (or something that does the same job) when asked, you have a compliance gap, whether or not the underlying control exists.
The limits. The matrix is not a compliance shield. It reflects our reading of the requirements at the time we wrote it. Regulators and your own firm may read them differently. Your legal team should validate any compliance claim. We don't say we've got this right.
7. Deployment models
How you deploy AI changes the risk
One of the biggest mistakes in AI governance is treating all AI the same, regardless of how you deploy it. A firm calling the OpenAI API faces different risks from one fine-tuning models on its own data. The controls, regulatory exposure, and skills you need differ.
API and SaaS. This is probably you. You use AI through someone else's service. The model is a black box. This is the most common pattern and the most misunderstood. People assume using APIs means they have outsourced AI risk to the vendor. They have not. They have outsourced some technical risk and kept most of the governance, data, ethics and compliance risk. If the vendor's model discriminates, you are still the one deploying a discriminatory system. If staff paste confidential data into it, you own that breach.
On-premises and open source. You run models like Llama or GPT-OSS on infrastructure you control. More control, more responsibility. You own the whole lifecycle, and no vendor gets blamed when the model degrades. Some risks shrink: vendor use of your data is not a concern if the data never leaves.
Fine-tuned and custom. You build or significantly modify models. Everything above applies, plus training data provenance, design choices and development method, and you carry full responsibility. It needs real capability: data scientists, MLOps engineers, model validators. For most people who mean LLMs when they say AI, we recommend writing brilliant prompts before you go anywhere near fine-tuning.
Agents. Whichever of the three you use, giving the model tools and the authority to act adds its own layer. See the Agentic AI domain.
8. Frequently asked questions
Is it really free? Yes. Apache 2.0. Use it, modify it, distribute it, and include it in commercial products. Keep the copyright notice and licence.
Does it cover the EU AI Act, ISO 42001 and the NIST AI RMF? It draws on all three and links to them in the Sources tab. It is not a clause-by-clause mapping, and it does not reproduce any standard.
Is it only for financial services? No. It leans toward financial services and the UK and EU because that's where we have done most of our work, and we tag each risk where it is sector-specific. Most of it applies to any organisation using AI.
Does using it make us compliant? No. It helps you find and test the controls that matter. Compliance is a judgement your organisation and its advisers have to make.
Can we use it for client work? Yes, under the licence terms. We would love to hear how it went.
9. Contributing
Help us make it better
This matrix is open source because, well, we are a bit sick of consultancies charging lots of people for the same thing. Life is better when you work together, right? AI governance should not become a proprietary advantage. The risks are too important, and the knowledge too dispersed, for anyone to get this right alone.
What would help: risks we have missed (there are certainly some, especially outside financial services and the UK and EU); better controls you have seen work; updated references when rules change; corrections; and lessons learned the hard way.
What would not help: vendor products dressed up as controls, generic ethics principles with no operational substance, theoretical risks with no practical relevance, and marketing language.
How to contribute: email hello@bloch.ai. We review everything for accuracy and fit. Not everything will make it in: a focused tool people use beats a comprehensive catalogue nobody reads. We credit contributors in the change log.
10. Download
Get the matrix
Version 2.1 | October 2026
Get the AI Risk and Control Matrix (Excel). Tell us where to send it and we will email it to you straight away.
What's included: 92 risks across 14 domains. A suggested control (when applicable), a suggested owner, and a review trigger for each. Evidence to request, a design test and an operating test for each. A scope sheet, assessment sheet and action log. A register of 23 sources with links. A cover sheet explaining how to use it.
What's coming: refinement based on user feedback, and updates as the rules change.
Licence: Apache 2.0. Attribution required: keep the copyright notice and licence in any redistribution.
Important: This matrix is provided on an "as is" basis, without any representations or warranties of any kind, whether express or implied. It is a general information and reference tool and does not constitute legal, regulatory, accounting, or other professional advice. Our reading of laws and regulations reflects our interpretation at the time of writing and may not reflect current requirements or how they apply to you. You are responsible for your own compliance. If in doubt, take proper legal advice. Standards remain the copyright of their owners; the matrix refers to them but does not reproduce them.
Questions or feedback? hello@bloch.ai · Talk to us
Related: The CEO AI Playbook · Getting started with agentic AI in n8n · Getting started with KNIME
Continue Learning
Explore more guides, tools, and insights to advance your journey and build lasting capability across your business.