By Sophia Lim, Part-time Lecturer, Introduction to Quantitative Risk Management, Enterprise Risk Management, Columbia University; Supervising Examiner, Federal Reserve Bank of New York
On October 15, 2026, the Financial Stability Board (FSB) published its final Sound Practices for Responsible Adoption of Artificial Intelligence. The report sets out 12 non-binding practices covering governance, accountability, performance monitoring, human oversight and third-party risk.
The key question is: How do firms know their AI controls actually work?
From principles to evidence
The FSB’s practices raise practical questions:
- Materiality: Which AI uses and potential failures could have significant consequences?
- Performance: Does the system remain reliable as conditions change?
- Human oversight: Can reviewers identify errors, override AI-supported decisions and correct problems promptly?
- Concentration: How much risk comes from shared models, data, infrastructure or providers?
- Control effectiveness: What evidence shows that controls reduce risk?
AI makes these questions harder to answer. Generative systems may not have a single correct answer. Agentic systems can take multiple connected actions. Strong average performance may hide serious failures, and errors can spread across workflows.
What this means for risk management
As AI systems become more complex, the fundamentals of quantitative risk management become even more important. Risk managers need to understand what drives outcomes, how inputs are transformed into outputs and how those outputs affect decisions and their consequences.
Probability, distributions, correlation, sensitivity analysis and scenario testing help measure uncertainty. We need evidence that controls identify material errors, limit harm and remain effective as conditions change.
But measurement alone is not enough. Understanding cause and effect, dependencies, and how risks propagate through a system is equally important. A completed review shows that a process occurred, not necessarily that risk was reduced.
These are the foundations we explore in Introduction to Quantitative Risk Management at Columbia. AI brings new challenges, but the underlying discipline remains essential: understanding how risks arise, interact and evolve.
Ultimately, effective AI risk management requires more than measuring system performance or confirming that controls are documented. It requires demonstrating that controls operate as intended, meaningfully reduce risk and remain effective as systems and conditions change.
The views and opinions expressed are solely those of the author and do not necessarily reflect the official positions of the Federal Reserve Bank of New York, the Federal Reserve System, Columbia University School of Professional Studies or Columbia University.
About the Program
The Master of Science in Enterprise Risk Management (ERM) program at Columbia University prepares graduates to inform better risk-reward decisions by providing a complete, robust, and integrated picture of both upside and downside volatility across an entire enterprise. For both the full-time and part-time options, students may take all their courses on Columbia’s New York City campus or choose the synchronous online class experience.
The application deadline for the M.S. in Enterprise Risk Management program is May 1. Learn more about the program here.
