← Back to Concept Contrast

Concept Contrast Fable

The process of assessing risk and the ledger that records it

Conclusion first:Risk assessment is the process of going to the site, measuring data, and judging severity; the risk register is the ledger that records those results. The most insidious pitfall in AI governance is treating a completed register as proof that assessment is already done.

Risk assessment is the process of going to the site, measuring data, and judging severity; the risk register is the ledger that records those results. The most insidious pitfall in AI governance is treating a completed register as proof that assessment is already done.

Fable

The River Officer and the Register Copyist

Every year before the flood season, Qinghe Prefecture inspected the dikes. The river official took craftsmen along the banks to examine soil color, cracks, old repairs, and village locations, judging which spots were most dangerous by likelihood and consequence. The east dike's cracks were shallow but near the granary; the west dike was old but the current was slow. The judgment did not depend on crack size alone.

After the first year's inspection, the river official spoke for half a day in the hall, and everyone nodded. But three months later, when the clerk was replaced, no one remembered who was responsible for reinforcing the east dike, when it was to be rechecked, or how high the water gauge had risen after the last rain. The assessment had been done, but the risk was like words scattered in the wind.

In the middle of the rainy season, the river patrol reported seepage on the east dike. The magistrate's office rummaged through boxes looking for old judgments and found only a few sheets of rough paper. Only then did the magistrate lose his temper: knowing there is danger is one thing; registering danger as something trackable is another.

In the second year, the river official still inspected the dikes first, assessed severity, and set priorities. This is the judgment process. After the inspection, the clerk wrote each risk into the ledger: location, cause, possible consequences, current level, owner, mitigation measures, review date, and latest status. Whenever there was heavy rain, the water gauge crossed the line, or repairs were completed, the ledger had to be updated.

Once the west embankment’s level dropped, not because no one feared it anymore, but because the new drainage ditch had been completed; the east embankment’s level rose because upstream heavy rain and the newly built granary simultaneously increased the consequences. The register made changes visible, rather than forcing everyone to guess from scratch when they met again.

The new scribe later accompanied the river official on levee inspections, listening to the judgments while recording each danger in a ledger: location, cause, possible consequences, responsible person, countermeasures, and review date. The ledger did not replace the inspections; it made the inspector's judgments traceable.

The county magistrate later reviewed the ledger every month, not to admire the neat handwriting, but to see whether the previous judgment had been handled. If the east embankment had been reinforced, the status was changed in the ledger; if danger rose after new rain, it was reassessed. The embankment patrol provided judgment, and the ledger kept that judgment from being forgotten.

The county magistrate later kept the two tools separate: patrolling the dike was to see the risk clearly, and the risk ledger was to keep what had been seen from being lost, to ensure someone was responsible for it, and to make sure it would be updated. Without patrolling the dike, the ledger is just copying old words; without the ledger, patrolling the dike is just a clever conversation.

Risk assessment

The process of identifying, analyzing, and evaluating risk, including determining risk sources, likelihood, impact level, and priority, and requiring judgment based on current data.

Risk Register

A ledger documenting all identified risks, recording risk description, level, owner, response measures, and status—a living document that requires ongoing maintenance.

Story Mapping

  • Going down to the river channel to measure depth and check cracks: field investigation and data collection in risk assessment
  • The river official's ledger: risk register, recording assessment results
  • Copying old records: equating register maintenance with completed evaluation
  • Bind evaluation date and evaluator: register entries must be linked to the latest evaluation evidence
  • Water conservancy intelligent systems: automated risk discovery requires accompanying manual or rule-based assessment and confirmation

Translating into AI risk governance

When building an AI risk register, first define the evaluation trigger conditions (model version change, data source change, compliance requirement update, incident review), then require each risk entry to be linked to at least one recent, traceable evaluation activity. The register is the container; evaluation is the act of filling it with evidence.

京ICP备2026014272号