A security leader presents a heat map with six AI systems marked red. The board asks how much red is acceptable and what it costs to fix. Nobody can answer, so the decision is deferred.
Colour ratings do not carry a unit. Two reds can differ by orders of magnitude, and a control's value cannot be judged when the starting point is a colour. Over-precise numbers are the opposite failure: a single exact figure with no stated assumptions invites distrust the first time someone asks where it came from.
RAMP's Valora engine expresses each AI system's risk in dollars, before and after planned controls, using an established quantitative risk approach. Results are shown as ranges, tied to the assumptions behind them, and routed to the CFO for validation before they appear in the board briefing. The inputs and workings are kept with the record for audit.
Before and after controls
Ranges and assumptions, not false precision
A figure the CFO has reviewed and can explain is worth more than a more precise one nobody trusts.
Where it goes
Frequently asked questions
- Why express AI risk in dollars?
- Dollars let the board and CFO compare AI risk with other business risks and with the cost of controls, which a high-medium-low rating cannot do.
- Are dollar risk figures exact?
- No. They are estimates with stated assumptions, shown as ranges, and they should be validated by finance before the board relies on them.
Pick the three AI systems that matter most, estimate their risk before and after controls as a range, and have finance review the basis. That is a better board conversation than another heat map.