Anchor
The named basis for a scenario's severity. In descending order of strength: the organization's own incident history, a capacity or physical limit, a published external scenario, and labelled expert judgment.
Defined in 2 GAGE programs, which carry 5 distinct definitions of it. The wording above is taught in Certified Enterprise Governance, Risk and Compliance Professional (CEGP).
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
The named basis for a scenario's severity. In descending order of strength: the organization's own incident history, a capacity or physical limit, a published external scenario, and labelled expert judgment.
The IMPACT step that connects a contribution to an outcome the organization or target role values (revenue, cost, risk, customer outcome, capability, or a level's competencies); the "so what" rung.
The unit and threshold that define a band, written so that a person who was not present can verify which band an event falls into. The opposite of an adjective.
The description attached to a point on a scoring scale. An anchor describes an observable state, so that two assessors can check whether it is true rather than agreeing on an adjective.
A real previously rated issue kept at each severity level as the calibration reference, so that raters compare rather than judge.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- AI for Career Acceleration: Performance Documentation · AI in the Workplace and Team Leadership, Certified AI Practitioner: Workplace Foundations
- Risk criteria · Enterprise Risk Architecture and Risk Appetite, Certified Enterprise Governance, Risk and Compliance Professional (CEGP)
- Scenario construction · Risk Identification, Scenarios, and Assessment, Certified Enterprise Governance, Risk and Compliance Professional (CEGP)
- Inherent risk, tiering, and due diligence · Third-Party, Supply-Chain, and Concentration Risk, Certified Enterprise Governance, Risk and Compliance Professional (CEGP)
- Severity, ownership, acceptance, and escalation · Findings, Issues, Root Cause, and Remediation, Certified Enterprise Governance, Risk and Compliance Professional (CEGP)
Where it shows up at work
A definition is where Anchor starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Tiers vendors by use and impact, requests evidence instead of promises, tests in the customer's context, and plans monitoring and exit.
One lesson on this page teach it as a primary outcome.
Classifies models by tier, sets validation requirements, challenges data, methodology and performance evidence, and reports aggregate exposure.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- Chief Audit Executive, AI audit editionneeds working knowledge
- Chief Risk Officer, AI risk editionneeds working knowledge
- Chief Information Officer, technology leadership editionneeds it at depth
- Model Risk Managerneeds it at depth
- AI Vendor Risk Managerneeds it at depth
- Third-Party Cyber Risk Managerneeds it at depth
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: NIST AI RMF GOVERN 6 and MANAGE 3; ISO/IEC 42001 Annex A supplier controls; SR 11-7; NIST AI RMF MEASURE.
One interview question about it
A business unit wants to buy an AI tool next week. What do you ask the vendor, what evidence do you require, and what would make you say no?
Asked of candidates for ai vendor due diligence and third-party risk. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Privacy and data protection carries it as a claim to back up: Processor and vendor review is routine privacy work.
- Cybersecurity and IT carries it as a claim to back up: Supplier security assessment is routine.
- Nonprofit program and grants oversight carries it as a claim to back up: Reviewing grant and vendor agreements for data terms is vendor review.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.