Severity

Why It Matters

Without severity classification, all controls receive equal attention. A control protecting against reputational annoyance receives the same governance investment as a control protecting the organisation’s banking licence. This is not governance. This is a flat list with no prioritisation logic.

Severity provides the calibration mechanism. It tells the organisation where to invest disproportionately. A Severity 5 control (existential) demands continuous monitoring, redundant mechanisms, regular testing, and board-level visibility. A Severity 1 control (localised) may require only periodic review. Without this differentiation, organisations either over-invest in low-severity controls (governance theatre) or under-invest in high-severity controls (actual risk).

The critical design decision in the AI Enterprise Control Index is that severity measures impact, not risk. Risk combines likelihood and impact. Severity isolates impact. This prevents organisations from deprioritising catastrophic failures simply because they seem improbable. A Severity 5 control failure that is unlikely is still a Severity 5 control failure. The consequences do not care about the probability estimate that preceded them.

The Stress Test

Your risk register contains 200 AI controls. All are classified as Severity 3 (“Significant”). The board asks how many controls protect against existential risks. You cannot answer, because the severity assessment did not differentiate. You know 200 controls exist. You do not know which ones matter most. When budget cuts require reducing control investment by 30%, you have no rational basis for deciding which controls to deprioritise.

A flat severity distribution is not a governance decision. It is the absence of one.

In the Wild

How to Govern It

Severity determines investment. Get it wrong, and you protect the wrong things.

Within the AI Enterprise Control Index, severity classification drives governance intensity:

• Severity 5 — Existential — Continuous monitoring, redundant controls, board-level visibility, quarterly testing. Evidence must be current within 30 days. Controls at this level protect the organisation’s right to operate.
• Severity 4 — Critical — Automated monitoring, executive-level visibility, semi-annual testing. Evidence must be current within 90 days. Controls at this level protect against material regulatory or financial harm.
• Severity 3 — Significant — Regular monitoring, management-level visibility, annual testing. Evidence must be current within 180 days. Controls at this level address measurable but remediable harm.
• Severity 2 — Contained — Periodic review, team-level visibility. Evidence must be current within 365 days. Controls at this level address localised impact.
• Severity 1 — Localised — Annual review. Evidence documented at creation. Controls at this level address minor, easily remediated issues.

When It's Relevant

Severity classification is relevant at two moments: when controls are first designed, and when incidents occur. At design time, severity determines the governance investment. At incident time, severity determines the response. A Severity 5 incident triggers the crisis management protocol. A Severity 2 incident triggers the standard remediation workflow. Without pre-classified severity, every incident triggers the same response, which means either over-reacting to minor issues or under-reacting to existential ones.

Severity classification becomes critical when:

• The organisation must prioritise control investment across a large portfolio
• Budget constraints require differentiated governance intensity
• Incident response procedures need pre-defined escalation paths
• The board needs to understand which controls protect against existential threats
• Regulators ask how the organisation differentiates control investment by impact

Related Terms