Books by Prof. Hernan Huwyler
The articles on this blog are part of a larger body of work on governance, risk management, audit, AI governance, quantitative risk and technology controls.
My books take many of those ideas further. They are written for professionals who need to move from concepts and frameworks into operating models, measurable risk decisions, controls and practical implementation.
The Risk Management Blueprint for Quantitative and Predictive Models
The Risk Management Blueprint on Amazon
Risk management often stops at the point where the most useful analysis should begin. A risk register may identify an exposure. A 5×5 matrix may assign it a color. A workshop may produce a consensus score. None of those steps necessarily tells management how much uncertainty is attached to a decision, how likely a loss is, how severe the exposure could become, or whether a planned control changes the economics of the decision.
The Risk Management Blueprint for Quantitative and Predictive Models takes a different approach.
The book develops a practical framework for using probability, predictive analytics, Monte Carlo simulation and quantitative models to support business decisions before resources are committed.
Its central question is straightforward:
What is the probability that the business plan will achieve its objectives, and what is the financial exposure if uncertainty develops differently from the plan?
The book covers objective-centric risk management, probabilistic modeling, loss distributions, risk thresholds, predictive models, control automation and decision-making under uncertainty.
It also examines a problem familiar to many experienced risk professionals: the limitations of traditional qualitative risk scoring and static heat maps. The alternative proposed in the book is to connect risk analysis directly to decisions, plans, financial exposure and measurable outcomes.
That includes practical applications of Monte Carlo simulation, convolved loss distributions, loss exceedance curves, expert estimation, cost and schedule uncertainty, operational risk, cyber exposure, supply-chain risk and portfolio thinking.
A major theme is the connection between prediction and action.
A predictive model has limited value if its output simply becomes another item in a dashboard. The real opportunity appears when probability estimates can trigger defined responses. That can mean additional review, approval requirements, transaction controls, escalation, throttling or automated intervention when a risk threshold is exceeded.
This is where quantitative risk management meets AI and automated controls.
The book therefore complements the SAP, GRC, audit, AI risk and risk-management articles on this blog. The individual articles examine specific applications. The Risk Management Blueprint provides the quantitative decision framework behind them.
It is written for Chief Risk Officers, risk managers, internal auditors, AI governance professionals, technology-risk leaders, project managers, consultants and executives who want risk analysis to influence decisions before the outcome is already determined.
If you are interested in moving from risk registers to risk models, from static scores to probability distributions, or from risk reporting to automated control responses, this book develops that approach in detail.
You can access the book preview to the first 4 chapters here https://amzn.to/4ciag1F
AI Management Systems: Operational Playbook for Chief AI Officers and Compliance Risk Managers
AI Management Systems on Amazon
Artificial intelligence has moved from experimentation into production, where its decisions can affect customers, employees, financial results, regulatory exposure and corporate accountability. That changes the role of AI governance. Organizations need more than principles and policies. They need an operating system for managing AI throughout its lifecycle.
AI Management Systems is an operational playbook for Chief AI Officers, AI governance professionals, compliance and risk managers, internal auditors, technology leaders, AI architects, data professionals and executives responsible for AI systems.
The book develops a practical approach to building an AI management system around governance, risk, controls, accountability, monitoring and evidence. It connects AI governance with established management and control frameworks, including ISO 42001, ISO 23894, the NIST AI Risk Management Framework and the EU AI Act.
The focus is deliberately practical. The book examines how an organization can identify AI risks, assign ownership, define controls, establish thresholds, collect evidence, monitor systems in production and respond when risk indicators exceed acceptable limits.
It also addresses an issue that is often missing from AI governance discussions: measurement.
AI risk should eventually connect to business consequences. Model drift, bias, unreliable predictions, control failures, regulatory exposure and automation errors can all affect financial and operational outcomes. A governance system therefore needs mechanisms for translating technical uncertainty into management information.
The book also explores AI lifecycle governance, AI risk assessment, control matrices, RACI structures, executive reporting, monitoring, incident response, regulatory evidence and organizational accountability.
This makes AI Management Systems a natural extension of the AI governance, AI risk, compliance and technology-control articles published on this blog. The blog provides individual analyses and practical examples. The book brings those ideas together into a structured operating model.
If you are responsible for AI systems in an enterprise, this is the book to use when the question moves from “What are the AI risks?” to “Who owns them, how do we control them, what evidence do we need, and what happens when a threshold is breached?”
The blog and the books serve different purposes.
The articles focus on specific problems: SAP S/4HANA audit and controls, GRC, SOX, internal audit, compliance, technology risk, AI governance, quantitative risk and business-process controls.
The books take those subjects further. They connect individual practices into broader methods that can be applied across organizations and industries.
That makes this site more than an archive of articles. It is also a working reference for professionals dealing with governance, risk, compliance, audit, SAP controls, AI systems and quantitative decision-making.
If you regularly read the articles here, the books provide the longer-form treatment behind many of the ideas discussed across the site. If you discovered the books first, the blog provides a growing collection of practical examples and technical applications.
Start with the subject that matters to your work
For AI governance, AI risk management, AI compliance, ISO 42001, NIST AI RMF, EU AI Act, AI controls and Chief AI Officer responsibilities, start with AI Management Systems.
AI Management Systems | Amazon
For quantitative risk management, predictive risk models, probability, Monte Carlo simulation, loss distributions, risk thresholds and automated risk controls, start with The Risk Management Blueprint.
The Risk Management Blueprint | Amazon
For readers who want to preview the AI governance book before buying it, the first four chapters are available through the Amazon preview:
Preview the first four chapters
About the author
Prof. Hernan Huwyler, MBA, CPA, CAIO, is an AI governance, GRC, audit and quantitative risk practitioner and professor. His work connects corporate governance, internal audit, SOX, SAP controls, technology risk, AI governance and quantitative decision-making. His writing focuses on a practical question: how can organizations turn risk information into measurable controls and better business decisions?