Table of Contents
Introduction to the agentic workflow risk assessment
This page supports Webinar 3 of the Institute of Risk Management’s seven-part series on agentic risk management: Pre-Deployment Agentic Risk Management, presented by Agentic Risks on 8 October 2026.
The webinar asks practical questions: how do you identify the risks in an agentic workflow before deployment, and which controls and key risk indicators (KRIs) must be ready before the agent goes live?
The summary below captures the key points rather than replaying every slide. Use the webinar video and presentation for the demo scenario, detailed tables, and supporting sources.
Executive Summary
Why perform an agentic workflow risk assessment?
Unstructured agent-building is a costly and risky choice, increasing the chance of overlooked risks, security incidents, and scrambled remediation when external stakeholders ask questions.
This is because agentic workflows create new risks that you will need to control and monitor in novel ways.
In this webinar, we demonstrate the specific ways the risk assessment process needs to evolve for the agentic era, and how to design and operationalise effective agentic KRIs.
These are important topics because an agent is only low risk when both its task risk is low and its risk controls are strong.
Adopt these techniques to give structure to your agentic transformation, prevent risk, and ensure trustworthy monitoring.
Unstructured Agent-Building is a Costly and Risky Choice
According to Deloitte (December 2025), only 11% of firms have successfully operationalised agentic AI, with unstructured experimentation increasing the chance of overlooked risks, security incidents, and scrambled remediation when external stakeholders ask questions.
Its main finding was that the technology works; the gap is organisational readiness to govern, constrain, and test agents. See slide 8.
“Agentic AI is like electricity – huge benefits, just put some rubber around it before you run it into someone’s house.”
Input factor 1: Agentic Workflows Differ
Agentic workflows differ from traditional workflows by being able to operate self-directed across multiple systems – receiving a goal, iterating independently, and delivering an active outcome – rather than executing a fixed, user-directed process that returns a passive output.
Throughout the webinar, we compared a non-agentic trade validation process that follows a linear approach to flag potential errors against an agentic workflow that solves the problem iteratively, not only flagging errors but also proposing corrections and learning for the future. See slide 10.
Risk management should be systematic, though, so we developed this comparison with a model of 10 dimensions where agentic workflows differ and, therefore, where potential exists for new uncertainties that risk managers should identify. The differences include scope of action, decision authority, system access, predictability, error propagation, and accountability. See slide 11 for all 10 and their implications for risk identification.
Input factor 2: Not All AI is Equal
Recently, a study asked mainstream LLMs nonsensical questions, such as, “How will switching from tabs to spaces affect our customer retention rate?” In response, many LLMs played along, while some refused to be drawn into giving non-factual responses. The implication is that model and platform selection is a non-trivial decision in which risk managers should have an influence.
Input factor 3: Not All Design and Training is Equal
In an analysis by Agentic Risks, we gave two agents the task of responding to the same email from a prospective client who had expressed interest in meeting but noted that her mother had just passed away.
- Our well-designed agent offered its condolences and noted the client could re-engage “whenever you’re ready.”
- The poorly-designed agent “really appreciated” her interest, would “love to tell you more about our services,” offering a “15-20-minute call this week.”
Key factors we changed in the designs and training were the model’s recency, the presence of guardrails (e.g. confidence levels and escalations), temperature settings, and the volume of training data.
Pre-Deployment Agentic Workflow Risk Assessment (7 Steps)
The Pre-Deployment Agentic Risk Assessment for medium- and high-risk agents follows 7 clear steps.
Four of its steps follow a standard risk assessment process – echoing the point about ‘evolution, not revolution’, but agentic AI makes three steps novel:
- Agentic Risk Identification – how can you identify an unfamiliar risk?
- Agentic Control Design – how can you ensure appropriate controls when some of them are also unfamiliar?
- Key Risk Indicator Design – how can you know your KRI requirements will be feasible?
Novel Aspect 1: Risk Identification
Risk managers should examine the four sources of risk from Webinar 2’s working-dog analogy (slide 12):
The Workflow and Tasks – use the 10 dimensions of how agentic workflows differ to map the workflow to inherent risk signals.
The Agent Itself – reviewing the agent’s components, design, and capabilities – surfaces additional risk signals and aligns the risk manager, engineer, and business user on the proposal.
Organisational Ability To Handle The Agent – assess readiness across the prerequisites for agentic AI and use the Enterprise-Wide Agentic AI Risk Control Framework to check your organisation can govern the agent.
External Threats
- Evaluate the compliance requirements across new and existing frameworks (e.g. EU AI Act, DORA, MiFID II, ISO/IEC 42001, and your own AI policy) – each imposing specific obligations that generate additional risk signals for agentic workflows.
- Map the attack surface across five vectors – inputs, internal reasoning, tool use and execution, memory and learning, and human override and escalation paths – to identify every way the agent could come under attack.
See slides 13 to 17 for the demo analysis of each source.
Risk identification feeds two parts of the risk assessment process that are less impacted by agentic AI: 2) risk definition and (for now) 3) risk scoring, which is where risk quantification sits.
In the interests of time, we aggregated the risk signals into 10 risks, calling for 20 KRIs, and continued our demo with a deep-dive into Risk 8, ‘Audit Trail and Explainability’. See slide 18.
Novel Aspect 2: Agentic Control Design
To be confident you can construct a proportionate and best practice risk treatment plan and design agentic AI controls and KRIs, find your risk in the Enterprise-Wide Agentic AI Risk Control Framework and select the controls that are appropriate to your situation.
For example (using v4), a search for ‘explainability’ will take you to Risk 22 on Accountability, Explainability, and Monitoring where you will find a risk definition, a control strategy, and individually-defined best practice controls.
Next, confirm both that a) the engineer can code controls into machine-enforceable AI controls in Step 2.2 (‘build’) and b) the availability of sufficient training data for each risk control. If either is in doubt, change the agent’s design, accept the risk, or pause the initiative.
Lastly, assign ownership and define the confirmatory and adversarial tests you will need to be sure of the controls. See slide 19 for the demo risk treatment plan.
Novel Aspect 3: Key Risk Indicator Design
KRI design for agentic workflows is materially novel because of the autonomous nature of agentic AI, the potential for small behavioural changes to alter a risk profile, and the structure of an agentic workflow influencing how you operationalise your KRIs.
Looking first at design, at Agentic Risks, we use 12 Principles of Effective Agentic KRIs, of which four are novel for agentic AI:
- Review KRIs regularly because thresholds evolve as agents learn.
- Track your organisation’s ability as ‘agent handlers’, not just the agent’s behaviour.
- Monitor prohibited behaviours as well as permitted ones, linking to our definition of autonomy as a ‘freedom coin’.
- Explainability: ensure every output is traceable to source, version, and human reviewer.
After this, the next part of the KRI design process is like non-agentic techniques that are already widely adopted:
- Define and justify the measures for monitoring the risk profile and operational performance of autonomous AI agents.
- Assign owners and define monitoring frequency.
- Settings: tolerance threshold (early warning), appetite limit, action plan if crossed, response times, and escalation path.
See slide 21 for the four demo KRIs for Risk 8.
On your own with an LLM, you will need 24-48 hours to complete a Pre-Deployment Agentic Risk Assessment. But the value comes from involving your colleagues to gain a collective understanding of the risks they will need to own.
In our experience, this takes 5 to 10 business days for a high-risk agent, depending on the workflow’s complexity, the ability to overlap with platform selection, and the maturity of the organisation’s agentic capability.
Effective agentic risk management requires multi-layer monitoring
An agent is low-risk only when its inherent task risk is low and its controls are strong. Weak controls give an agent room to drift, so monitoring through KRIs is a vital control. See slide 24.
To operationalise your KRIs, you will need to account for the three-layer structure of an agentic workflow – model, orchestration, and application – in which each layer can see risk signals that the others cannot.
To avoid noise, blind spots, or a false sense of security, map your KRI source data to the layers and ensure each draws its data from the layer where its risk signal lives.
Lastly, some KRIs draw from a single layer, while others – such as Audit Trail Completeness and Mean Time to Detect Anomalies – are cross-layer and cannot function without data from multiple layers. See slide 26 for all 20 demo KRIs mapped to the three layers.
This has three important implications:
- Agentic risk monitoring extends beyond traditional AI model risk and must also cover the risk of an AI system operating in a broader attack surface.
- You will need cross-layer monitoring for your own audit trail as well as for regulatory defence.
- KRI requirements should be a direct input to platform selection because not every platform can offer multi-layer monitoring.
The main takeaway: design monitoring for medium- and high-risk agents from the beginning, layer by layer, where each risk signal lives (slide 27).
Working with Agentic Risks
The practical service Webinar 3 highlights is the Agentic AI Control Design Package. It turns your policy into your agents’ actual controls: agent risk tiers and thresholds, agreed and documented; every applicable control specified, with its owner and the evidence it produces; and your team trained to run and evolve it.
This matters because your ability to control agents needs to grow as fast as your agent estate.
Continue the Webinar Series
Register now for Webinar 4, Building Safe Agents, on 22 October 2026, which will cover:
- Characteristics of good training data.
- Red teaming: trying to break an agent to find out how and when it fails.
Frequently Asked Questions
An agentic workflow risk assessment is a structured process to identify, evaluate, and control the risks created by autonomous AI workflows before deployment, including controls and KRIs.
You assess agentic workflow risks by following 7 steps that include identifying risks from the workflow, agent, organisation, and threats; defining and scoring risks; designing controls and KRIs; and integrating the approved findings into your enterprise framework.
Agentic workflows operate autonomously across systems, making decisions and taking actions independently, which introduces new uncertainties in scope, accountability, and error propagation.
Agentic AI controls are mechanisms embedded in the workflow to manage risk, while KRIs are measurable indicators used to monitor behaviour and detect when risk thresholds are breached.
Multi-layer monitoring tracks risk signals across the model, orchestration, and application layers, ensuring that risks are detected where they arise and avoiding blind spots.
An AI agent is low-risk only when its inherent task risk is low and its controls are strong enough to constrain, track, and stop it. Weak controls give an agent room to drift into higher risk.
