Rasumussen's model and others since represent a growing trend away from "root causes" or you might say Nancy's Leveson [2] provides an example of how this can be used to model safety control: Nancy Leveson - Hierarchical Model of Safety Control Framework Predictions Rasmussen's Risk Management Framework makes of pressure toward cost-effectiveness in an aggressive, competing environment Rasmussen's Migration Model - Transport Canada - Jim McMenemy, Safety Intelligence Project Rasmussen's migration model represents

and foundation models. However, organizations are developing their own specialized models for specific use cases. These custom models require their own risk assessment and safety measures tailored to their particular This means organizations cannot simply rely on foundation model providers to solve all safety problems If you're fine-tuning models, creating retrieval-augmented generation systems, or deploying AI agents

One is tearing down the model we’ve relied on for decades. Think about what that means for the platform model. The existing model has exhausted its goodwill. The SaaS model — the dominant business model in technology for the past two decades — starts to look Bespoke, AI-generated solutions invert that model.

Every problem becomes a reason for another model, another agent, another pipeline, multiplying without Most AI deployments have no equivalent: no clear conditions under which a model is retired, rolled back

assets and dependencies, classifying systems by impact and risk, then mapping controls to data quality, model Roles & Accountability Assign decision rights: executive sponsor, AI/Model Compliance lead, Engineering Strengthen what works, eliminate what doesn't, expand to next-priority systems This is the Lean Startup model risk and control effectiveness over time, using evidence from operations to update your governance model

This will look different across industry sectors, but each will have an operational model that must be following maps are helpful to identify where these places are: Total Value Chain Map Organizational Model The Operating Model Canvas book is a good place to start understanding operating models from which you

Regulatory Theorem posited by Conant and Ashby states that "Every Good Regulator of a System Must be a Model Examples of models that we are more familiar with include: a city map which is a model of the actual which is a model of an employee's roles and responsibilities, and so on. In more technical terms the model of the system and the regulator must be isomorphic. The theorem does not state how accurate the model needs to be or the technical characteristics.

Frameworks, control libraries, risk registers, maturity models, oversight committees — all of it operates This is the problem our Organizational Regulation Model was built to address: bringing regulation back Lean Compliance, helping organizations operationalize governance through the Organizational Regulation Model

Some form of causation model (deterministic, probabilistic, linear, non-linear, etc.) is needed to estimate In cases of greater uncertainty these models will be adjusted over time as more information is gathered defined (ISO 31000, COSO) as the effects of uncertainty on objectives which involves having a causation model

Goal Structure Notation & Claim Trees Applied to Obligations & Promises Compliance Model The Core Problem Lean Compliance Operational Model The Lean Compliance Operational Model recognizes that obligations Goal Structure Notation (GSN) Example For compliance using the Lean Compliance model, your top goal is When applied to the Lean Compliance Operational Model these are evidence that commitments (i.e. promises Your strategy is to demonstrate this through the operational model layers.

Large language models didn't just process that data — they internalized it.

To understand this better we developed the following compliance operational model: Compliance Operational Model This model comprises what's needed to continuously deliver on promises to maintain a state of MVC is not achieved at the end of a 5-step maturity model, but right at the start.