Session 11 · ERQI Global Virtual Risk Summit
AI-ready risk networks: why semantics must come before automation
Marco Nutini & Graeme Keith
Overview
Marco Nutini and Graeme Keith argue that an organization should settle what its risk terms mean before it lets AI agents act on risk data. Their proposed structure is a risk network: a knowledge graph built around decisions, in which risks sit alongside assumptions, objectives and indicators, and the meaning of each term and relationship is fixed in advance. Without that, they say, automation inherits the field's ambiguity.
Session 11 recording, ERQI Global Virtual Risk Summit 2026
From registers to networks
Nutini starts by moving risk off center stage. Decisions are at the center, and the decision at hand determines which assessment and which indicators matter. Today's matrices, spreadsheets and relational GRC tools list risks one by one, mostly qualitatively, on a calendar. A risk network instead places risks in a graph with decisions, assumptions and objectives, uses scores sound enough for automated use, and escalates on events rather than committee cycles.
His example is credit management, where an operational decision (grant credit or not), a managerial decision (adjust the criteria) and a policy decision (set strategy) are already connected, but information reaches them late and broken. Delinquency rate is a risk indicator, monitoring client payments is a control, and a decision updates the credit simulation. A taxonomy is the hierarchy of terms. An ontology adds the relationships, such as "risk indicator informs decision." The knowledge graph is what goes into production and guides the language model.
Why semantics come first
An agent with data access but no semantic control, Nutini argues, will not know which policy, criteria or portfolio a question refers to. Risk language makes this worse: the word is used for sources, conditions, events and effects, and COSO, ISO 31000 and FAIR draw the lines differently. A survey he ran in waves with ERQI's supervision showed the spread. On how risk relates to uncertainty, the largest group said uncertainty causes risk, following ISO 31000, while others called them correlated but separate, cited Knight, or treated them as synonyms. On risk appetite, 41% matched the COSO definition and 18% said they do not use the term.
Keith recognized the pattern from consulting. Registers often hold loss events, open issues or control failures, none of which he would call risks. If a model sees three meanings of risk, he said, a risk-based decision becomes a roll of the dice.
Where the two differ
Keith wants the math to define the ontology. Nutini works from ontology to math, and noted that mathematics is one field where ontology must be precise. Keith added that an ontology the AI can use has to stay close to natural language, which creates tension. His case for the graph is that AI is semantic and relational, while risk management has to be quantitative and causal; fixing the entities and relationships lets the model carry fixed mathematical relationships and spend a limited context window on what matters for the decision. Moderator Andrew Shea said he had first hoped for one unified ontology and now saw that as naive.
“Risk is not the center of the universe.”
Marco Nutini, on building risk networks around decisions
Key takeaways
1
Normalize semantics before automating
Convene people from different functions and agree on basic terms. Automating first means automating ambiguity.
Watch at 30:122
Start with one decision hotspot
Map a single decision, such as credit or an inventory early warning system, and let the organization's core ontology grow from it.
Watch at 31:153
Map terms rather than homogenize them
People can keep their own words if everyone agrees what each one means.
Watch at 42:374
Surface divergence with the people involved
Nutini suggests an internal survey or workshop. Keith suggests asking people to explain their terms, or writing the equations down.
Watch at 53:155
Use the graph to make AI quantitative and causal
Fixing the entities and the relationships between them fixes the structure the model reasons over.
Watch at 50:49
