W H ITE P A P E R

Application of Artificial
Intelligence to Risk
Using Machine-Learning to support Enterprise Risk Management
Ideagen | APPLICATION OF ARTIFICIAL INTELLIGENCE TO RISK

Introduction
Ideagen solutions are used for Risk and Control management throughout many different industries; including being applied
for many different approaches to the audit of the identified controls.

Capturing Enterprise Risk and Controls in a central Data Warehouse provides for a consistent reporting of risk and control
within the corporate environment. It is also possible to allow for the enhancement of the data captured in the data
warehouse with data from external sources including other corporate sytems.

The Enterprise Risk data warehouse can therefore act as a mechanism to enable the analysis of risks and controls. With
the application of corporate reporting tools, such as Tableau, it is possible to filter and report over risk data in an interactive
manner.

However, it is possible that risk trends, associations, biases and rules may be hidden in the noise of the data. This is
particularly true if you don’t know what it is that you don’t know. This is where the application of Machine Learning
techniques can provide added value and add new options within the context of Enterprise Risk Management.

This paper considers techniques that can provide automated insights into Risk and Controls using Machine Learning
algorithms including so-called ‘supervised’ techniques, such as:

Decision Trees and Naïve Bayes Logistic Regression

Random Forests

Along with ‘un-supervised’ techniques, such as:

Clustering Algorithms Correlation

Neural networks, Intelligent Agents, Causality, Recommenders and Deep Learning are left for a future paper.

2
Ideagen | APPLICATION OF ARTIFICIAL INTELLIGENCE TO RISK

Supervised Techniques
RISK AND CONTROL ASSESSMENT BIASES
Supervised machine-learning techniques are used to predict the value of a feature. For example, given the Inherent
Risk Likelihood and Impact (and so the Inherent Risk Level) with the Inherent Control assessment and the application
of a supervised learning technique it should be logically possible to predict the likely residual level of risk based on the
inherent and control ratings.

Applying the machine learning techniques across the risk data more generally it is possible to compare the outcome of
the algorithm with the actual assessment of risk, across both the whole business and across individual areas. This can
help identify where risk is:

▪▪ Over-compensated by controls;
▪▪ Under-compensated by controls, or
▪▪ Consistently assessed in a biased direction.
For example, if the algorithm consistently predicts, based on the overall Enterprise Risk Data, that in a given area, the
Residual Risk Assessment should be ‘High’ but it is found to be ‘Low’, further investigation is likely to be required to
determine why this is the case.

Thus, machine learning can be used here to both identify the level of risk that would be predicted for a certain level of
inherent risk and controls, and also to identify any bias in risk and control self-assessments.

IMPROVING PROBABILITIES
Where a quantitative approach to risk is taken the likelihood of the risk can be difficult to estimate, however, by the
application of a simple Machine Learning technique known as ‘Naïve Bayes’ it is possible to update initial risk likelihood
assessments based on data and ongoing risk assessments across the organisation.

Using Naïve Bayes and other related techniques it is therefore possible to identify if there has been an overall change
in the likelihood of a risk and also the appetite for risk that management are exhibiting.

Assignment and Classification

As noted earlier, it is possible to predict the residual level of a risk based on the inherent risk level and the level of
control that has been applied. It is also possible based on the same raw data to predict:

The type of risk expected;

▪▪ The type of Control that may be expected to mitigate a risk;

▪▪ Categories of Risk and Control that may be expected, and
▪▪ Whether a Control is likely to be Key or not.
This may, again, also highlight where there are discrepancies between the forecast and the Risk and Control values,
thus implying that further investigation is required.

CONFUSION MATRICES
Overall, all of the above techniques support both the forecast of a value, such as the level of a Risk, but can also be
used to also identify any biases or inconsistenies in the application of risk management methodology. This is best
achieved by comparing the actual and predicted values:

PREDICTED
HIGH MEDIUM LOW VERY LOW
HIGH 1 1 1
ACTUAL

MEDIUM 6 1 7
LOW 25 23
VERY LOW 1 2 152

3
Ideagen | APPLICATION OF ARTIFICIAL INTELLIGENCE TO RISK

Where actual scores are lower than predicted scores it would appear that there is a bias towards underestimating
the level of risk. Where actual scores are higher than the predicted scores it would appear to indicate a bias towards
overestimating the level of risk.

By identifying confusion matrices which are highly skewed management can get early sight of potential problems and
proactively work on those particular areas. These can be highlighted to management such that any significant deviation
from the expected values is automatically emailed or raised as an Incident for investigation.

In this way supervised machine learning has multiple uses for Risk Management.

Unsupervised Machine Learning

PATTERNS
Machine Learning algorthms are good at finding the Risks and Controls that are ‘closest’ to each other. Effectively
finding clusters of Risks or Controls and grouping them together.

Unlike supervised learning techniques, clustering does not need predict a target value, but instead identifies where
similarities between items exist. It is, therefore, possible to take a new Risk or Control and ask of the data ‘what
Risks/Controls is this most similar to’ and so detect patterns in the data that may not be clear in simple interactive
investigation.

Further, it is possible to apply techniques such as hierarchical clustering and K-Means analysis to identify key groups of
Risks and Controls. Should there be a query or concern regarding a Risk or Control, the data can be queried to identify
other Risks or Controls that may belong to the same cluster.

By identifying clusters in this way it is also possible to view how Risks and Controls relate to each other outside
the documented hierarchy and can help management to identify areas that may benefit from additional focus and
assurance activities.

CORRELATION
Correlation can be used to identify relationships within data that may not otherwise be clear. Whilst correlation does
not imply causation, a high degree of correlation implies there is a strong indication that the items are related to each
other in some way.

Using correlation can then support other machine learning techniques and provide management with additional
information regarding the patterns in the data.

4
Ideagen | APPLICATION OF ARTIFICIAL INTELLIGENCE TO RISK

CONCLUSION
Machine Learning and Artificial Intelligence are terms that are often used interchangeably. This paper has outlined
some simple machine learning techniques that can be applied to risk and control data to help organisations better
manage risk and controls. These techniques represent an initial step towards an Assistive Intelligence view of Risk
Management where AI techniques and technologies enable risk and control owners to manage risk efficiently and
effectively.

The future of Risk Management will include technologies such as chatbots and intelligent agents to interact with
risk and control owners interactively and through intelligent alerting. These will rely upon advanced AI techniques,
including deep learning, to identify when proactive interaction is required. Natural Language techniques will
also be used to allow risk and control owners to interactively query data without needing to learn complex and
specialist query languages.

Finally, the use of a Risk and Control Data Warehouse allows for additional data to be captured that can then be
used in the AI-based analysis of risk and control. Moving the Risk and Control data to the warehouse allows for
these powerful techniques to be applied to the data without affecting the Enterprise Risk Management Solution.

Within Ideagen the research and development (R&D) function is committed to keep Ideagen’s products at the
forefront with regards to techniques of the type outlined above. In addition, R&D strives to make Ideagen a
thoughtleader in these areas allowing the creation of additional capabilities not yet available from other offerings
in the same sector.

5
 You will require d
 ifferent aspects of this solution depending on what
stage you are at on your individual journey to Operational Excellence.

Anticipate
Let Ideagen work with you on each step of your journey.

info@ideagen.com

problems before
+44 (0) 1629 699 100

they emerge

e : info@ideagen.com | w : ideagen.com
Copyright © 2018 Ideagen Plc