AI governance: risk registers, evidence and human accountability

id,hazard,stage,likelihood,impact,controls,evidence,owner,residual,review,status,approver
R01,Draft promises a wrong repair date,model,5,3,Officer checks each draft;Dates from policy table,QA sample Sep;Test TP-2,Repairs Manager,6,2026-12-01,open,
R02,Hidden instructions in a tenant message,prompts,3,3,No send or edit rights;Officer checks each draft,Access review AR-7;QA sample Sep,Digital Services Manager,6,2026-11-15,open,
R03,Dangerous defect not flagged urgent,use,3,5,Keyword triage first;Officer checks each draft,Test TT-3;QA sample Sep,Repairs Manager,10,2026-10-15,open,Director of Housing
R04,Drafts sent unchanged without reading,use,4,4,Monthly sample;Unchanged rate to board,TBC,Customer Services Manager,9,2026-10-01,open,
R05,Supplier changes model without notice,supplier,3,3,Notice clause;Regression test,Contract s4;Test TP-2,,6,2026-08-31,open,
R02,Policy knowledge out of date,drift,3,6,Owner signs off updates,Change log CL-12,Repairs Manager,6,2026-10-30,open,
R06,Supplier outage,supplier,3,2,Manual templates,Test BC-2,Digital Services Manager,4,2026-06-30,closed,

"""check_register.py: check the form of an AI risk register. It only reads."""
import csv
import sys
from datetime import date

APPETITE = 8  # invented: a residual score above 8 needs a named approver
TODAY = date(2026, 9, 26)  # fixed so the output repeats; use date.today() for real
COLUMNS = ["id", "hazard", "stage", "likelihood", "impact", "controls", "evidence",
           "owner", "residual", "review", "status", "approver"]


def items(cell):
    """Split 'a;b' into items; blanks and placeholders such as TBC do not count."""
    parts = [p.strip() for p in cell.split(";")]
    return [p for p in parts if p.lower() not in ("", "tbc", "none")]


def check(rows):
    problems, seen = [], set()
    for row in rows:
        rid = row["id"]
        if None in row or None in row.values():  # extra or missing values
            problems.append((rid, "wrong number of values"))
            continue
        if rid in seen:
            problems.append((rid, "duplicate id"))
        seen.add(rid)
        try:
            lik, imp = int(row["likelihood"]), int(row["impact"])
            res, due = int(row["residual"]), date.fromisoformat(row["review"])
        except ValueError:
            problems.append((rid, "unreadable score or date"))
            continue
        # scores 1 to 5; residual cannot exceed inherent (likelihood x impact)
        if not (1 <= lik <= 5 and 1 <= imp <= 5 and 1 <= res <= lik * imp):
            problems.append((rid, "score out of range"))
        if not row["owner"].strip():
            problems.append((rid, "no owner"))
        if len(items(row["evidence"])) < len(items(row["controls"])):
            problems.append((rid, "a control has no evidence"))
        if res > APPETITE and not row["approver"].strip():
            problems.append((rid, f"residual {res} above appetite, no approver"))
        if row["status"] == "open" and due < TODAY:
            problems.append((rid, f"review overdue since {due}"))
    return problems


if __name__ == "__main__":
    with open(sys.argv[1], newline="", encoding="utf-8-sig") as f:
        reader = csv.DictReader(f)
        if reader.fieldnames != COLUMNS:
            sys.exit("First line must be: " + ",".join(COLUMNS))
        rows = list(reader)
    problems = check(rows)
    for rid, message in problems:
        print(f"{rid}: {message}")
    print(f"{len(rows)} risks checked, {len(problems)} problem(s)")
    sys.exit(1 if problems else 0)

python check_register.py register.csv
R04: a control has no evidence
R04: residual 9 above appetite, no approver
R05: no owner
R05: review overdue since 2026-08-31
R02: duplicate id
R02: score out of range
7 risks checked, 6 problem(s)

"""test_check_register.py: a clean row passes; each planted mistake is caught."""
import unittest

from check_register import check

CLEAN = {"id": "T1", "likelihood": "3", "impact": "3", "residual": "6",
         "owner": "Owner", "controls": "Check", "evidence": "Log", "approver": "",
         "review": "2026-12-01", "status": "open"}
MISTAKES = {"impact": "7", "owner": "", "evidence": "TBC", "residual": "9",
            "review": "2026-09-01", "status": None}  # None: missing value


class CheckTests(unittest.TestCase):
    def test_clean_row_passes(self):
        self.assertEqual(check([CLEAN]), [])

    def test_each_mistake_is_caught(self):
        for field, bad in MISTAKES.items():
            with self.subTest(field=field):
                self.assertEqual(len(check([dict(CLEAN, **{field: bad})])), 1)
        self.assertEqual(check([CLEAN, CLEAN]), [("T1", "duplicate id")])


if __name__ == "__main__":
    unittest.main()

python -m unittest
..
----------------------------------------------------------------------
Ran 2 tests in 0.000s

OK