Topics

Four fields, one liability.

AI, information security, business continuity and validation have different standards but the same question: how do we know the system does what it should, and how do we prove it? That is why I run all four through one shared risk management. AI management comes first because it is the newest obligation and builds on the other three.

Risk management is the way of working. The topics are the fields.

What can go wrong, how likely is it, how severe would it be, and what can be done about it? I answer that in a way an auditor can recalculate.

  • ICH Q9(R1)
  • ISO 31000
  • BSI 200-3
  • FMEA
Risk matrixInitial risk → Residual risk after treatment. Illustrative only, no client data.LikelihoodImpact

Hover or tap a dot to see an example.

Initial riskResidual risk after treatmentIllustrative only, no client data.
ISO/IEC 42001 · EU AI Act

AI management

The real questionHow much effort is proportionate, and who is accountable for the decision?

How you notice itYou know which AI runs in the company, who is accountable for it and where the limits are. New applications get approved instead of simply appearing.

NIS2 · ISO/IEC 27001 · IEC 62443 · BSI IT-Grundschutz

Risk and information security management

The real questionHow do we, as management, demonstrate that we meet our responsibility?

How you notice itYou see on one page where the company stands and which risks are open. You decide budget and priorities on that basis, not on demand.

ISO 22301 · BSI 200-4

Business continuity and crisis readiness

The real questionHow long can a process be down before it becomes expensive or dangerous, and is there a plan someone can actually follow when it happens?

How you notice itYou know which outage is tolerable for how long. When it happens, a rehearsed chain of decisions runs, not the phone list.

GxP · GAMP 5 · MES

Validation and interim project leadership

The real questionHow do we prove to the inspector that the system reliably does what it should in our environment?

How you notice itYou steer changes to your systems quickly and under control, because it is clear what needs testing and how deeply.

Under the roof

Four management systems, one logic.

Risk is the common language. Below it, every management system has its own standard, its own evidence and, in the end, its own audit. I build them to fit together instead of growing side by side.

How the five steps apply in every field