Andrew Tollinton, CEO of SIRV was invited by to answer the question: Will risk management drive AI adoption?

Full conference recording; starts with Andrew Tollinton addressing the university and attendees online. 

Intro

In June 2024, Andrew Tollinton, CEO of SIRV, joined the University of Warsaw and Uniwersytet SWPS to explore a simple question with complex consequences. Will risk management drive AI adoption, or will something more human move faster. This article summarises Andrew’s talk and sets out what we are seeing in the field.

What we mean by AI and risk

To keep this discussion practical we focus on narrow, task specific AI rather than general intelligence.
By risk management, we mean the process of identifying, assessing and controlling threats across five themes: strategic, financial, legal, reputational and operational. SIRV works principally in operational risk – power outages, supply interruptions and security incidents.

Fear is powerful but it is not risk

Behavioural science reminds us that people move away from fear, isolation and pain, and towards hope, social acceptance and pleasure. Of these motivators, fear is often the loudest. Yet fear is emotional while risk is logical. In public life, fear can overwhelm probability driven decision making, which explains why investment can cluster around low probability threats while higher frequency harms receive less attention.

A near future shaped by mediated choices

One plausible path is assistant led safety. Wearable or ambient AI guides individuals through the built environment, consuming local feeds such as CCTV, incident logs and open data to recommend safer routes and actions. The enabling steps are already here or arriving fast:

• Growing data availability, sometimes at the expense of privacy

• AI that can read and write APIs so systems interoperate in real time

Devices like pendant microphones or screenless assistants hint at this mediated future, where AI sits between people and place. Whether people want that level of control is an open question. Uncertainty, risk and skill are part of what make experience feel alive.

Safety cases and autonomous vehicles

Autonomous vehicles are often sold on safety rather than convenience. Philosophical arguments about agency compete with statistical claims about reduced collisions. The pattern is familiar. In the face of strong safety cases, regulation tends to follow.

What we are seeing at SIRV

Our London based team works with global brands to bring AI into risk management. Since the arrival of general purpose AI tools, project conversations have changed. What was once a red flag is now a budget line. To keep projects grounded we use a simple three level model:

• Describe – what is happening, where and when

• Predict – what might happen next

• Prescribe – what action should we take

Value and complexity increase as you move up the stack. The challenge is not only technical. It is organisational.

Case study – workforce deployment and survivor bias

A client asked whether AI could improve the deployment of staff across a large urban area. The starting point was incident data, from antisocial behaviour to violent crime. Incident data is useful but it carries survivor bias. If teams are deployed in the same hot spots, reports reinforce the same pattern. To counter this we requested complementary datasets already held in the organisation. Access friction was the main blocker rather than modelling. The lesson is simple. Better data beats more model.

Highlights from the conference

Emotion and rationality
Excitement around AI is understandable, but risk management remains a rational discipline.

Security practice
Assumptions from the past do not always carry forward. The last two years have challenged ideas of truth and verification.

Future of work
For students and early career professionals, opportunities are growing. The need is for motivated people who understand real organisational needs.

Other perspectives shared

• Understanding emotions can improve risk decisions and resilience

• People often rely on emotion when estimating risk

• Staff will use AI tools regardless of policy. Better to control use and extend existing policies rather than write new ones from scratch. Many existing security controls still apply

• Criminal focus will shift to AI models as soon as those models become decision critical

Where this leaves AI adoption

Many are anxious about the path ahead. Our view is pragmatic. Diffusion beats invention. The next breakthrough matters less than how far current tools spread through society and operations. Crises accelerate adoption. The UK COVID app under delivered, but a future public health crisis could normalise personal assistants that persist after the crisis passes. The question is not whether risk management can use AI. It is how much we trade for speed and certainty.

Key takeaways

• Fear moves faster than formal risk, so design controls that keep decisions disciplined

• Use describe, predict, prescribe to scope value and complexity

• Challenge survivor bias with broader internal datasets

• Plan for adoption during crises, not only in steady state

FAQs

Q1. What does SIRV mean by operational risk in AI projects
Operational risk covers the events that disrupt day to day operations, such as outages, supply interruptions and security incidents. AI can help describe events faster, predict patterns and prescribe actions.

Q2. Why does survivor bias matter for incident led deployment
If teams only patrol where incidents were previously recorded, reporting skews to the same areas. The result is over allocation to known hot spots and blind spots elsewhere.

Q3. What kinds of data improve predictions beyond incident logs
Access control data, maintenance tickets, footfall, environmental sensors and customer reports. Often these exist inside the organisation but sit in separate systems.

Q4. How do you phase AI capability without overreach
Use describe, predict, prescribe. Ship describe first, validate, then add prediction. Prescriptions come last and only where operational ownership is clear.

Q5. Will privacy concerns block assistant led safety
Adoption depends on trust, clear consent and value. In crises, people accept more data sharing. Outside crises, controls and transparency matter.

Q6. How do you measure success in risk management AI
Time to detection, precision and recall on incident classification, lead time on predictions, and real world outcomes such as response time or harm reduction.

Q7. Where should a security team start
Start with a narrow use case tied to an operational KPI. Audit available datasets, remove survivor bias where possible, and prototype a describe level service.

Q8. Does AI replace human judgement in risk
No. AI augments situational awareness and consistency. Human judgement remains essential for trade offs, duty of care and accountability.