A risk team's drill should test oversight, not operations: can the second line spot that an agent acted within bounds that were themselves wrong, insist on a pause to draft-only, classify the event, challenge the first line's account, and report it upward with evidence? A 90-minute tabletop built around a mistyped limit rehearses all of that.
What is the risk team's job in an agent incident?
The risk team rarely owns the queue an agent works in. Operations, credit or payments own it. The risk manager's job is different: confirm the incident is contained, judge its severity against the organisation's risk appetite, make sure the cause is understood rather than assumed, and decide what goes to the risk committee and, where required, to a supervisor.
That makes the drill unusual. Most of the clicking is done by others. The risk team practises asking the right questions in the right order, reading the record for itself, and refusing to accept "the agent malfunctioned" as a root cause.
The chief risk officer or head of operational risk owns the drill. A risk manager facilitates. Two or three risk analysts take part, with a first-line manager from the affected business playing their real role. The compliance team drill covers the regulatory reporting angle in more detail; this one is about oversight and challenge.
The scenario
Monday, 09:30. A monthly monitoring report lands on the risk team's desk. It shows that a limit-increase agent in the cards business granted about 400 credit limit increases last week, against a usual 40. Every increase was allowed. Every verdict is valid.
The cards in the drill reveal the cause one at a time. Ten days ago, a business user changed the customer's own limit for automatic increases from 500 to 5,000. The change was filed in the record with a name and a time. It had no second approver, because changes to that limit did not require one. The agent's certificate was current; the agent did exactly what its bounds allowed.
The drill step by step
- Person (facilitator): hands over the monitoring report and starts the clock.
- Person (risk analyst): reads the verdicts in the record, not the summary. The question is which bound decided each increase. Here the minimum chain names the business's own limit, every time.
- Person (risk manager): asks the first line to pause the agent to draft-only. The risk team should not hold the switch itself, but it should confirm the pause happened. Agent, depth 2: from now on, every increase is drafted and held for a credit officer.
- Person (first-line manager): restores the intended limit with a second approver present, and files it.
- Person (risk analyst): sizes the exposure from the record: how many increases above 500, the total extra credit made available, and how much has been drawn.
- Person (risk manager): classifies the event against the operational risk taxonomy and the risk appetite statement, and opens a loss event if the business records near misses as well as losses.
- Person (risk manager): challenges the root cause. The agent behaved correctly. The control that failed was a single-person change to a limit with direct credit impact.
- Person (chief risk officer): decides on reporting to the risk committee, the board and any supervisor, and records the decision with reasons.
- Person (facilitator): runs the debrief and lists control changes, each with an owner.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Detection | Has granted increases within a wrong limit | 3 | Reading the monitoring report |
| Verdict review | Nothing new | 3 | Reading which bound decided |
| Pause | Drafts every increase for approval | Dropped to 2 | Asking for and confirming the pause |
| Fix the limit | Applies the restored limit | 2 | Change with a second approver |
| Sizing | Nothing | 2 | Exposure from the record |
| Classify and report | Nothing | 2 | Severity, appetite, reporting |
What does this drill teach that others do not?
It teaches the risk team to look past the agent. In a governed system, most incidents will not be an agent breaking its bounds; they will be bounds set wrongly by people. A risk team trained only to ask "did the model fail?" will miss them. The question is always which of the five bounds decided, and who set it.
It also tests whether the risk team can read the record directly. If risk analysts depend on the first line to pull evidence, the second line is not independent. Each analyst should be able to filter verdicts by agent, date and deciding bound without help.
Finally, it rehearses the uncomfortable conversation. The business user who mistyped the limit did nothing outside their rights. The finding is about the design of the control, and the drill should practise saying so without blame.
Which controls does the drill test, and what evidence do they leave?
Monitoring. Evidence: the report, who received it, and when they acted.
The pause. Evidence: the limit change in the append-only record, with the first-line manager's name and time.
Limit change control. Evidence: the original single-person change and the corrected change with two names.
Classification. Evidence: the event entry in the risk register and the reasoning for its severity.
Reporting decision. Evidence: the minute of who decided what to report, to whom, and why.
What should the risk manager measure?
- Time from the monitoring report to a confirmed pause.
- Days between the bad limit change and its detection, which says more about monitoring than about the agent.
- Whether every analyst could read the deciding bound from the record unaided.
- How many limits with direct financial impact still allow single-person changes.
Where do risk team drills go wrong?
Accepting the first explanation. "The agent went wrong" sounds plausible and ends the conversation. Make the drill impossible to finish without naming the bound and the person who set it.
Owning the fix. The risk team should insist on the pause and the control change, not perform them. If risk analysts make the change, nobody is left to challenge it.
Forgetting appetite. The question for the committee is not only what happened but whether exposure stayed inside appetite. Practise stating that in one sentence.
A drill for another team, such as the procurement team drill, makes a useful second scenario for the risk team to observe and challenge. The AI agent incident drill script template gives a format for the cards, and training teams for AI agents shows where the second line sits in a training plan.
Where the Academy fits
Risk managers who oversee several agents across regulated business lines are the audience for Pryme Intelligence Academy's Architect track, which ends in a board review with two Pryme assessors. Analysts who need to read the record and the decision chain fluently can start with Foundations, which covers the decision chain, depth and certification.
Questions people ask
Should the risk team have the power to pause an agent?
Many organisations give the second line the right to require a pause, with the first line performing it. That keeps independence while making sure a pause cannot be refused.
Is an incident with no loss still reportable?
Internally, usually yes, as a near miss. External reporting depends on the rules that apply to you, so the reporting decision and its reasoning should be recorded either way.
What makes a good scenario for risk teams?
One where every verdict is valid and the fault lies in a bound people set. That is the case risk teams are least practised at spotting.