Walk Through a Full Risk Review

See a Full Review Modeled

Now watch the whole method run end to end, on a fresh tool.

A neighborhood wellness group, run by volunteers, is deciding whether to recommend a free AI health-advice app to its members. The app answers health questions in plain language, tells you whether a symptom sounds like something to rest on at home or take to a doctor, and stores every question members ask. The group turns to the five steps of a risk review.

Identify. Reading the app’s description, its reviews, and its privacy policy, and trying it out, the group names four risks: the AI could give wrong or unsafe advice, telling someone to stay home when they should see a doctor; its advice may be less accurate for some members than others; the health questions people type are sensitive, and it is unclear how long they are stored or who they are shared with; and the app never explains why it gives a given answer.

Assess and prioritize. The group rates each risk on likelihood and impact, then reads off a priority.

Two risks rise to the top: unsafe advice and the handling of health data. The opacity is constant but low harm on its own, so it waits.

Respond. The group matches a proportionate response to each. It cannot avoid the advice feature, since that is the whole app, and it cannot fully verify the AI’s accuracy, so it reduces the risk with a firm rule: members are told never to rely on the app for anything serious and to confirm any worrying symptom with a real professional. For the health data, the decision about the privacy terms is bigger than any one volunteer, so the group escalates it to the organizer, and reduces the risk in the meantime by using the app’s settings to limit sharing and shorten how long questions are kept. The accuracy-for-some-members risk it reduces by presenting the app as general guidance, never personalized advice. The opacity it simply accepts, because the “confirm anything serious” rule already guards against a bad answer doing real harm.

Justify. The group states its call: use with safeguards. Two recommendation conditions carry it. First, members must be told up front to treat the app as general guidance and to confirm anything serious with a professional. Second, the organizer must review the privacy terms and confirm that data sharing can be limited before the group promotes the app. The residual risk the group knowingly accepts is that, even with the rule in place, a member might still follow a harmless-looking but wrong low-stakes suggestion, such as a home remedy that does not help. They accept it because the impact is limited and the benefit, quick and clear health guidance for people who might otherwise look nothing up at all, is real.

Notice how the group handled what it could not know. It could not audit the AI’s medical accuracy or see inside the company’s data deals. Rather than stall, it stated its assumption out loud, that this is an information tool and not a medical service, and it turned its biggest unknown into a condition: if the organizer finds the privacy terms allow selling health data, the recommendation flips from “use with safeguards” straight to “avoid.” That is a decision made under incomplete information that anyone in the group could stand behind.

That hesitation usually means one risk is doing all the work. Look at your highest-priority risk and ask a single question: is there a condition that would make me comfortable? If you can write one, you have a “use with safeguards” call. If no realistic condition would settle your worry, that is your signal to avoid. The decision was never about all the risks at once; it comes down to whether the worst one can be conditioned away.

Your Turn!

You have watched the method work twice now, on the parents’ grocery-share app and on the wellness group’s health advisor. This time no one walks beside you. This short chapter hands you one compact case, asks you to run a complete risk review on it, and then lets you check your work against a full model solution, with an open invitation to try the same method on a tool of your own.

A small neighborhood savings circle, a group of friends who each pool a little money every month and take turns receiving the pot, is thinking about adopting a free AI budgeting app to manage the group’s shared account. The app connects to that account, uses AI to sort every transaction into categories, flags spending it decides looks unusual, suggests how much each member should contribute, and stores the group’s full transaction history. One member found the app, loves it, and wants everyone to switch this week.

Run a complete risk review and reach a recommendation the whole circle could stand behind. Work only from what anyone could find out: the app’s public description, its reviews, its privacy policy, and how it behaves when you try it.

Produce four things, which together cover the five steps of the method (assess and prioritize are combined into one deliverable here):

• Identify: name at least four risks the app carries, including at least one that is specific to AI and at least one about personal data ;

• Assess and prioritize: rate each risk low, medium, or high on likelihood and on impact, then read off a priority for each; a small table is the clearest way to show this ;

• Respond: choose a proportionate response for each risk that matters, avoid, reduce, accept, or escalate, and say in a line why it fits ;

• Justify: state one recommendation, use, use with safeguards, or avoid, give any conditions it carries, and name one residual risk you knowingly accept and why; if a key fact is missing, say what you assumed.

Take a genuine attempt before you read on. The thinking you do yourself is where the skill actually sticks.

Then check your answer against the model solution found at the end of this chapter.

Let’s Recap!

• A risk review is one repeatable method with five steps in order: identify, assess, prioritize, respond, and justify.

• You weigh every risk by two separate questions, how likely it is and how much harm it would cause, and let both together set its priority.

• You match each risk that matters to a proportionate response, avoid, reduce, accept, or escalate, sized to the harm it threatens.

• A responsible recommendation is a single defensible call, use, use with safeguards, or avoid, that openly names the one residual risk you knowingly accept.

• The same method travels to any digital or AI tool you meet, even when the information is incomplete.

That is the whole method, now in your hands. Take the short quiz following this chapter to help you confirm what has landed and spot anything worth a second look before you carry this skill out into the tools you use every day.

Model Solution

Here is one strong review of the savings-circle app. Yours does not need to match it word for word. What matters is that every risk is weighed on both likelihood and impact, every response fits the risk it answers, and the final call names what the group is choosing to accept.

Identify. From the app’s description, its reviews, its privacy policy, and a quick trial, five risks stand out:

• the AI miscategorizes or misreads transactions and nudges the group toward a bad money decision, such as under-contributing so the pot falls short ;

• the app connects to the shared bank account and passes transaction data to partner services, and it is unclear how long that data is kept or who can reach it ;

• its contribution suggestions may be less fair to members with irregular or low income, consistently asking more of the people who can least afford it ;

• the app never explains why it flags a transaction or sets a contribution, so a mistake is hard to spot and challenge ;

• the whole group’s finances lean on one free app that could change its terms, start charging, or shut down.

Assess and prioritize.

The clear top priority is how the app handles the group’s financial data. The money-advice and fairness risks sit in the middle. Opacity and dependence are real but low on their own.

Respond.

• Data sharing: escalate the privacy-terms decision to whoever manages the group’s account, since it touches everyone’s bank information and is bigger than one member’s call; in the meantime, reduce it by switching off any optional data sharing in the settings ;

• Money-advice error: reduce it with a rule that the app’s contribution figures are only a starting point a person always reviews before anyone pays, never an automatic instruction ;

• Unfair suggestions: reduce it by having the group agree contribution amounts together, using the app’s numbers as a prompt rather than a verdict ;

• Opacity: accept it, because the human-review rule already catches a bad flag before it can do harm ;

• Dependence on one app: accept it for now, since the group can keep its own simple record as a backup and can leave the app easily.

Justify. The recommendation is use with safeguards. Two conditions carry it: the account manager reviews the privacy terms and confirms that data sharing can be limited before the group connects the account, and the app’s contribution figures are always reviewed by a person, never paid automatically. The one residual risk the group knowingly accepts is that the AI may still miscategorize a transaction now and then; they accept it because the human-review rule keeps any single error small, and the benefit, a clear shared picture of the group’s money that no one had before, is real. On the missing information: the privacy policy never said plainly whether transaction data is sold, so the review assumes it might be and turns that unknown into the first condition; if the account manager finds the terms do allow selling financial data, the recommendation flips from “use with safeguards” straight to “avoid.”

That is a compact but complete review: every step present, each response matched to its risk’s priority, and a final call that names both its trade-off and the one risk the group chose to live with. If your review weighed likelihood and impact separately, sized each response to the risk, and named what you accepted, you have run the method well, whatever tool you pointed it at.