Two papers that go together. The first sets out the governance chain, a method for tracing every obligation to the evidence that proves it is met. The second describes what comes after: a knowledge graph of the whole risk and control environment, kept current by AI under human accountability.
Tracing operational risk from regulation to evidence
Every obligation needs a path to the ground. Each piece of that path usually exists, but a different team owns each one and nobody owns the path. The paper defines the eight links, traces TD Bank, Capital One and CrowdStrike through them, draws all sixteen operational risk types as one graph, and shows how to start with three extracts most firms already have.
An AI-driven model for managing operational risk
The structures operational risk relies on were built for a world where risks stayed in their lanes. This paper sets out what replaces them: chains as the foundation, a knowledge graph as the firm's risk memory, AI agents doing the work in between, and people accountable for every judgment. Attention follows concentration, not the organization chart.