Board-level risk advice for a world knocked off its axis by AI, led personally by Richard Anderson.
St Paul's from the Millennium Bridge
One looks closely at the AI exposures your board is taking on. The other tests whether the risk management underneath is ready for what comes next, from AI or anything else. Both are led by me, from the first conversation to the final board session.
For boards making AI decisions that matter
Are we taking on AI exposure faster than we can understand it, challenge it and keep control of it?
A thematic, board-level review of AI uncertainty, dependency and control, built around three questions: what do we actually know, do the right conversations happen, and what could we not undo?
For boards that want to know where they stand
Does our risk management work in practice, or only on paper?
An independent assessment across eleven categories, from risk culture and appetite to how risk is managed with suppliers and partners, scored against evidence and repeated to show progress.
To me it’s all about delivering a highly personal service. At AndersonRisk I am not building a big, global consulting practice. I’m not leveraging juniors, and I’m not fixated on utilisation rates or timesheets.
I work with boards that see risk as a boardroom topic, and who value a service delivered by me, sometimes alongside one or two trusted people I have worked with for years. The questions that interest me need conversations with the board, the executive and people further into the organisation, where discussion matters more than quantification, and the nuances of governance matter more than numbers and spreadsheets.
I also advise boards on strategic risk and board-level risk governance.
I encourage my clients to view risk through a completely different lens. Rather than start with risk registers and other backward-looking tools, we look at risk through a set of finely balanced considerations. This often leads to the discovery of significant risks which were not even previously in view.
From clients and colleagues over many years of board-level risk and governance work.
“Your work with us on risk culture has made a real difference… Risk is definitely part of the conversation in a way it wasn’t before.”
“He interviewed a range of people from directors to junior staff and his approach meant that he engaged at all levels. His findings ranged widely across the business, but they were linked to the strategy of the organisation.”
“Richard changed the way that I manage my business!”
“Richard helped us to take an academic concept, understand it and apply it to our business in a way that ensured we took our business forward and without distracting us from our plans.”
“He has a great talent for challenging the assumptions but always with humour and charm, making every session I have attended both educational and entertaining.”
I advise boards on risk: whether their risk management works in practice, and the judgements and dependencies that AI is adding to it, which technical assurance alone cannot resolve.
I am not an AI engineer. My perspective comes from two places. As a non-executive director, I have been part of boardroom discussions about AI and AI risk, including how it fits within the board’s risk appetite. And I have built with it: at RiskMetrica, my co-founder has led the technical development while I have worked on turning ideas about risk into technology a business can use, and at DigiCheques we have tested strategy through conversations across several AI models. That experience has changed the questions I ask: at what point does a useful capability become a dependency, who understands it well enough to challenge it, and does the board know what it would take to change course?
I am an experienced board chair, committee chair and non-executive director, with a background as a Chartered Accountant and risk consultant. My board work has been largely in payments, fintech and banking, often in regulated and critical-infrastructure organisations going through major change, working closely with regulators and government.
I was a partner at Coopers & Lybrand and then PwC from 1993 to 2001, and led the strategic risk practice in EMEA. I chaired the Institute of Risk Management from 2011 to 2014, the Pay.UK Risk Committee from 2018 to 2021, and Banking Competition Remedies from 2020 to 2023.
I wrote a 2009 report for the OECD on risk management and corporate governance in banks, and was principal author of the Institute of Risk Management’s guidance on risk appetite and tolerance (2011), and co-authored its guidance on risk in the extended enterprise (2014). My work on risk appetite and risk culture has taken me to conferences from the UAE to Colombia, including twice to the Institute of Internal Auditors’ International Conference. I have worked with large global corporations, small start-ups, INGOs and not-for-profit organisations, in the UK and across many countries.
I write about risk appetite, uncertainty and AI on Substack, and talk with people who think hard about risk on The Risk Appetite Podcast.
I am a co-founder of RiskMetrica, home of the Risk Intelligence Operating System (RIOS), for organisations that want continuing insight into their risks rather than a single review.
If you are wondering whether your board has a clear view of its AI risks, or whether its risk management would hold up when the ground shifts, I would be glad to talk it through, with no commitment on either side.
Or start on your own: the Seven Questions take about two minutes, and Risk Maturity for AI about five. Your results appear on screen straight away, and nothing you answer is stored.