Concept Contrast Fable

After something goes wrong and before it goes wrong

Conclusion first:Incident management handles accidents that have already happened; risk management handles identification, mitigation, and preparation before an accident occurs. One looks at response and postmortem, the other at prevention and control; when a vendor says it "has management," you need to ask which part it manages.

Incident management handles accidents that have already happened; risk management handles identification, mitigation, and preparation before an accident occurs. One looks at response and postmortem, the other at prevention and control; when a vendor says it "has management," you need to ask which part it manages.

Fable

The firefighting team and the line inspectors

Liuchuan Town had a fire brigade. When the brass bell rang, the members pushed the water cart and rushed out. They climbed ladders, broke down doors, and rescued people, fast and steady. The townspeople respected them deeply and brought wine and meat at festivals, because every time fire broke out, these people pulled houses back from the edge of ashes.

There were also several line inspectors in town, who usually carried lamps and pliers and checked wires, oil lamps, firewood sheds, and granaries in the alleys. They often knocked on shop doors and said this wire was too old, that pile of hay was too close to the stove. The shopkeepers disliked seeing them, thinking they only found faults and delayed business.

One winter, a rice shop on South Street caught fire. The fire brigade arrived quickly and half the street was saved, but the rice shop still lost a warehouse. The captain patted his chest and said, thank goodness we are well trained. The line inspector, however, pulled out a record from half a month earlier: the line on the rice shop's back wall had already turned black, and firewood was piled in the corner. At the time, the shopkeeper had thought replacing the line was too expensive and did not repair it.

The captain was unhappy to hear this. He felt the fire was already out, so bringing up old scores was pointless. The line inspector was also angry, feeling he had warned them long ago but no one took it seriously. At first the mayor sided with the firefighting team, because firefighting was visible, while line inspection looked like extra spending, and the books always recorded bad things that had not happened.

Later, North Street nearly had another incident. A line inspector found the tavern's attic packed with old oilcloth, forced the manager to clear it out that same day, had the staff move the water vats to the back door, clear away the wooden crates blocking the alley entrance, and leave a night light burning. Three days later, the kitchen next door caught fire. Flames reached the attic opening, but found no oilcloth to burn and were quickly put out. Only then did the townspeople slowly understand that some contributions never turn into the lively clang of a brass bell.

So the mayor separated the two ledgers. The red ledger recorded who reported the fire, who responded, how much was lost, and how the review was conducted. The gray ledger recorded what hazards were usually discovered, which had been fixed, which were still being delayed, how to reduce losses if a fire actually broke out, and also noted who was responsible for the next inspection.

From then on, the fire brigade still trained, and the line patrollers still knocked on doors. The town no longer used firefighting speed to prove the streets were safe, nor used patrol records as a substitute for incident response. After a fire starts, someone must put it out; before a fire starts, someone must also move flammable things farther away and clear the escape routes.

AI incident

Incident events after an AI system has caused or nearly caused harm, loss, violation, or serious bias, with a focus on response, recording, remediation, and retrospective review.

AI risk management

Identify risks before an incident occurs, assess impact, set controls, and continuously reduce the probability and scope of impact.

Story Mapping

Fire brigade → AI incident response mechanism
Bronze bell, waterwheel, rescue → the handling process after an incident occurs
Line patroller → preventive work of AI risk management
Blackened wires and old oilcloth → risks that have not yet erupted but are identifiable
Red ledger → incident records, response, and retrospective
Gray book → risk identification, controls, and open hazards
Firefighting speed cannot prove the streets are safe → having incident management does not mean risk is managed

Applying it to supplier review

When a vendor says it has AI incident management, look at how it detects incidents, escalates, stops losses, notifies customers and conducts postmortems. When a vendor says it has AI risk management, look at how it identifies risks before launch, sets controls, runs red team tests and monitors residual risk. One leans toward post-incident response, the other toward reducing probability and impact beforehand; mature teams usually have both.

AI incident concept AI risk management concept