From Spreadsheet to Agent: Making Your Risk Data Computable

Category: AI & Automation Tags: computable risk, GRC data model, AI, automation, risk register, MCP

Under all the excitement about AI in risk and compliance sits a prerequisite almost nobody is naming: your data has to be computable before any of it works. Digitized data is a different thing, and the gap between the two is where most GRC programs are stuck.

A risk register in a spreadsheet is digitized. A risk register where likelihood is derived from incident counts, residual is derived from control effectiveness, and every rating traces to evidence, that's computable. The first one an AI can read. The second one an AI can operate, and which one you have decides what AI in GRC can do for you.

Digitized vs Computable

Most risk data is digitized prose. A risk has a title, a description, and two numbers somebody typed in a workshop. The numbers aren't connected to anything; they're opinions stored in cells. You can search this data, sort it, put it in a chart. But you can't reason over it, because there's no logic underneath it. Change a control and nothing recalculates. Log an incident and no rating moves. The spreadsheet is a filing cabinet, not a model.

Computable data is different in one specific way: the numbers are outputs of rules over linked inputs, not standalone entries. This is the discipline behind the data-driven risk assessment (every score traces to evidence) extended into structure: the evidence is itself linked data, and the rules run automatically. Once that's true, the data can answer questions nobody typed the answers to. "What's our residual exposure if this control degrades?" has an answer, because residual is computed, not stored.

Structured, Linked, Rule-Driven

Structured. Risks, controls, issues, and incidents exist as defined records with defined fields, not as free text in a document. An agent can't reason over a paragraph; it can reason over a record.

Linked. The records reference each other by ID. This incident belongs to that risk. This issue affects that control. This risk is mitigated by these controls. The links are the relationships from the connected GRC model, and they're what let a change in one place propagate to the right places everywhere else.

Rule-driven. The ratings come from explicit, deterministic rules over the structured, linked data, not from human judgment re-entered each cycle. Incident count maps to a likelihood. Average control effectiveness maps to a reduction factor. The rules are fixed and documented, so the output is reproducible and defensible.

Hit all three and your data stops being a record of what people decided and becomes a model of what's actually true. That model is what an AI agent works from.

Why This Is the Real AI Prerequisite

When an "AI for GRC" demo disappoints, the cause is almost never the model; it's that the AI is pointed at digitized prose. Ask the smartest model in the world "which of my risks got worse this quarter" and if the underlying data is just typed-in numbers with no link to incidents, the model has nothing to compute from. It can only guess or summarize.

That fixes the order of operations. Buying an agent first gets you nothing; you make your data computable, and then an agent becomes useful, because now there's a model for it to operate. Programs that invest in the data model first will get enormous value from agents, while the ones that skip it keep buying chatbots and wondering why they don't help.

How an Agent Reaches Computable Data

Once the data is computable, the last piece is exposure: the agent needs a defined way to query and act on the model. The emerging standard for that is the Model Context Protocol: the engine that computes your ratings is wrapped as a set of tools (list the risks, rank by residual, simulate a control change), and any AI client can call them. The agent doesn't get raw spreadsheet access and a prayer; it gets defined operations with auditable results. The computable model is the substance; the protocol is the doorway.

You don't need any of that infrastructure to start, though. The substance comes first, and it's buildable in a spreadsheet today.

Start With One Register

Make one thing computable. Take your risk register and connect residual to control effectiveness instead of guessing it twice; the build is in how to build a risk register that calculates residual risk. Then link your incidents to risks and let the count inform likelihood. You've now turned a filing cabinet into a model, and you've done the single most useful thing you can do to get ready for AI, without buying any AI at all.

When the agents arrive, they will go to work in the programs whose data is computable, and everyone else will still be watching demos.