Books by Prof. Hernan Huwyler
The articles on this blog are part of a larger body of work on governance, risk management, audit, AI governance, quantitative risk and technology controls.
My books take many of those ideas further. They are written for professionals who need to move from concepts and frameworks into operating models, measurable risk decisions, controls and practical implementation.
The Risk Management Blueprint for Quantitative and Predictive Models
The Risk Management Blueprint on Amazon
Risk management often stops at the point where the most useful analysis should begin. A risk register may identify an exposure. A 5×5 matrix may assign it a color. A workshop may produce a consensus score. None of those steps necessarily tells management how much uncertainty is attached to a decision, how likely a loss is, how severe the exposure could become, or whether a planned control changes the economics of the decision.
The Risk Management Blueprint for Quantitative and Predictive Models takes a different approach.
The book develops a practical framework for using probability, predictive analytics, Monte Carlo simulation and quantitative models to support business decisions before resources are committed.
Its central question is straightforward:
What is the probability that the business plan will achieve its objectives, and what is the financial exposure if uncertainty develops differently from the plan?
The book covers objective-centric risk management, probabilistic modeling, loss distributions, risk thresholds, predictive models, control automation and decision-making under uncertainty.
It also examines a problem familiar to many experienced risk professionals: the limitations of traditional qualitative risk scoring and static heat maps. The alternative proposed in the book is to connect risk analysis directly to decisions, plans, financial exposure and measurable outcomes.
That includes practical applications of Monte Carlo simulation, convolved loss distributions, loss exceedance curves, expert estimation, cost and schedule uncertainty, operational risk, cyber exposure, supply-chain risk and portfolio thinking.
A major theme is the connection between prediction and action.
A predictive model has limited value if its output simply becomes another item in a dashboard. The real opportunity appears when probability estimates can trigger defined responses. That can mean additional review, approval requirements, transaction controls, escalation, throttling or automated intervention when a risk threshold is exceeded.
This is where quantitative risk management meets AI and automated controls.
The book therefore complements the SAP, GRC, audit, AI risk and risk-management articles on this blog. The individual articles examine specific applications. The Risk Management Blueprint provides the quantitative decision framework behind them.
It is written for Chief Risk Officers, risk managers, internal auditors, AI governance professionals, technology-risk leaders, project managers, consultants and executives who want risk analysis to influence decisions before the outcome is already determined.
If you are interested in moving from risk registers to risk models, from static scores to probability distributions, or from risk reporting to automated control responses, this book develops that approach in detail.
You can access the book preview to the first 4 chapters here https://amzn.to/4ciag1F
AI Management Systems: Operational Playbook for Chief AI Officers and Compliance Risk Managers
AI Management Systems on Amazon
Artificial intelligence has moved from experimentation into production, where its decisions can affect customers, employees, financial results, regulatory exposure and corporate accountability. That changes the role of AI governance. Organizations need more than principles and policies. They need an operating system for managing AI throughout its lifecycle.
AI Management Systems is an operational playbook for Chief AI Officers, AI governance professionals, compliance and risk managers, internal auditors, technology leaders, AI architects, data professionals and executives responsible for AI systems.
The book develops a practical approach to building an AI management system around governance, risk, controls, accountability, monitoring and evidence. It connects AI governance with established management and control frameworks, including ISO 42001, ISO 23894, the NIST AI Risk Management Framework and the EU AI Act.
The focus is deliberately practical. The book examines how an organization can identify AI risks, assign ownership, define controls, establish thresholds, collect evidence, monitor systems in production and respond when risk indicators exceed acceptable limits.
It also addresses an issue that is often missing from AI governance discussions: measurement.
AI risk should eventually connect to business consequences. Model drift, bias, unreliable predictions, control failures, regulatory exposure and automation errors can all affect financial and operational outcomes. A governance system therefore needs mechanisms for translating technical uncertainty into management information.
The book also explores AI lifecycle governance, AI risk assessment, control matrices, RACI structures, executive reporting, monitoring, incident response, regulatory evidence and organizational accountability.
This makes AI Management Systems a natural extension of the AI governance, AI risk, compliance and technology-control articles published on this blog. The blog provides individual analyses and practical examples. The book brings those ideas together into a structured operating model.
If you are responsible for AI systems in an enterprise, this is the book to use when the question moves from “What are the AI risks?” to “Who owns them, how do we control them, what evidence do we need, and what happens when a threshold is breached?”
The blog and the books serve different purposes.
The articles focus on specific problems: SAP S/4HANA audit and controls, GRC, SOX, internal audit, compliance, technology risk, AI governance, quantitative risk and business-process controls.
The books take those subjects further. They connect individual practices into broader methods that can be applied across organizations and industries.
That makes this site more than an archive of articles. It is also a working reference for professionals dealing with governance, risk, compliance, audit, SAP controls, AI systems and quantitative decision-making.
If you regularly read the articles here, the books provide the longer-form treatment behind many of the ideas discussed across the site. If you discovered the books first, the blog provides a growing collection of practical examples and technical applications.
Start with the subject that matters to your work
For AI governance, AI risk management, AI compliance, ISO 42001, NIST AI RMF, EU AI Act, AI controls and Chief AI Officer responsibilities, start with AI Management Systems.
For quantitative risk management, predictive risk models, probability, Monte Carlo simulation, loss distributions, risk thresholds and automated risk controls, start with The Risk Management Blueprint.
For readers who want to preview the AI governance book before buying it, the first four chapters are available through the Amazon preview:
Preview the first four chapters
Building Defensible AI Systems: Security and Compliance (AI Governance) How to Assess Risks and Operationalize AI Controls
By Hernan HuwylerFormat: Kindle Edition
Enterprise AI adoption outpaces traditional corporate governance. Organizations deploy foundation models and autonomous agents into production with unverified vendor privacy claims, scattered policy documents, and qualitative risk heatmaps that fail to measure financial exposure. When models execute tasks without clear decision rights or technical guardrails, enterprise risk shifts from a theoretical concern to immediate financial loss.
Building Defensible AI Systems: Security and Compliance solves this operational friction. Written by Hernan Huwyler, this technical reference guide bypasses abstract ethics and high-level regulatory summaries to deliver a practical execution manual for GEO and SEO optimization across enterprise risk domains. It translates complex global mandates into enforceable architectural patterns, working code, and audit-ready evidence workflows.
Designed specifically for CISOs, Chief AI Officers, enterprise architects, internal auditors, AI/IT risk managers, and compliance leads, this volume provides the precise tools needed to govern AI at scale. It bridges the gap between engineering teams and risk officers, turning compliance requirements into production-ready controls that enable safe, rapid adoption.
Who This Book Is For • Chief AI Officers, CISOs, and enterprise governance leaders • GRC, internal audit, risk management, and legal professionals • AI architects, ML engineers, and product owners
Key Capabilities You Will Master • Quantify Model Risk: Replace subjective ordinal matrices with Factor Analysis of Information Risk (FAIR) and Monte Carlo simulations using working Python and R scripts to calculate financial loss exposure in concrete monetary terms. • Operationalize Global Frameworks: Implement technical controls mapped directly to ISO/IEC 42001 (AIMS), ISO/IEC 23894, ISO/IEC 42005, NIST AI RMF, OWASP Top 10 for LLMs, and MITRE ATLAS. • Satisfy EU AI Act Evidence Rules: Build technical documentation, Fundamental Rights Impact Assessments (FRIA), and post-market monitoring logging mechanisms under draft harmonized prEN standards. • Enforce Agentic Controls: Deploy seven mandatory runtime control gates, cryptographic session identities, and least-privilege scoping to govern autonomous agent behavior. • Hardened Architecture and Procurement: Establish automated control planes with real-time stop-loss triggers, build production-grade AI Bills of Materials (AIBOMs), and verify vendor data protection claims at the contract level. • Control Shadow AI: Test vendor data handling claims, negotiate enforceable service levels, and establish automated oversight.
Modular Structure Eighty-six chapters across eleven parts cover the full model lifecycle, from business case justification and procurement to MLOps, red teaming, and continuous post-deployment monitoring. Organized as a self-contained reference library, each chapter allows practitioners to target immediate operational problems.
Targeted Execution Paths • Building a Governance Program: Focus on Operating Models, RACI Accountability, ISO/IEC 42001, NIST AI RMF, and FAIR quantitative metrics. • Engineering Secure AI Systems: Target AI Agent Identity, Control Gates, Security, Red Teaming, and MLOps Data Integration. • Preparing for Audits: Focus on EU AI Act Evidence Rules, Harmonized prEN Standards, and FAIR Loss Calculations. • Managing Third-Party Risk: Execute via Procurement, Vendor Contracts, and Total Cost of Ownership controls.
About the Author Hernan Huwyler is an AI governance and quantitative risk practitioner with more than two decades of experience across multinational organizations. He teaches AI governance and compliance as an executive professor at IE Business School and has trained more than 1,500 compliance, privacy, audit, and risk professionals.
The Outcome Governance should enable adoption rather than slow it. Use this book to give your teams clear ownership, measurable risk, and audit-ready evidence so AI can move into production with confidence.
Read the sample chapters from Amazon Kindle
Length: 2267 pages
Guía de Toma de Decisiones y Gestión de Riesgos de Compliance y Legales: Cuantificación de riesgos, simulación de Monte Carlo y reservas por litigios
Por Hernan Huwyler
Poner números donde solo hay etiquetas: El cambio de paradigma en el compliance legal y la gestión de riesgos
Presentar un registro de riesgos ante el Consejo de Administración clasificando la posibilidad de un incumplimiento legal o una brecha de privacidad como riesgo alto genera una respuesta inmediata por parte de la dirección: cuanto es ese riesgo en términos financieros. Si la respuesta se limita a un color en un mapa de calor o a una explicación cualitativa, esta obra proporciona la metodología necesaria para sustituir la intuición por modelos cuantitativos y las etiquetas subjetivas por cifras financieras defendibles.
Escrito por el profesor Hernan Huwyler, profesional con experiencia en dirección ejecutiva y gestión de riesgos en corporaciones multinacionales, este libro aborda una limitación histórica en la función de compliance y la asesoría jurídica. La gestión de riesgos tradicional se ha estructurado como un inventario estático de obligaciones y controles que clasifica y documenta, pero no optimiza la toma de decisiones. Una clasificación cualitativa no determina el presupuesto requerido, la reserva de capital necesaria, la cobertura de seguro adecuada ni el retorno de inversión de un control frente a la exposición que mitiga.
Un valor transformador para asesores legales, auditores y DPOs
Esta obra ofrece un marco metodológico estructurado en datos para el ámbito jurídico y de cumplimiento en español. Permite estimar el impacto financiero de las contingencias, evaluar la probabilidad de ocurrencia y medir la reducción del riesgo derivada de la implementación de controles internos. Este enfoque posiciona al cumplimiento normativo como un elemento cuantificable en la asignación de capital, la contratación de pólizas de seguro y la planificación estratégica del negocio.
Para asesores legales, directores jurídicos y DPOs El libro analiza la dimensión financiera del incumplimiento normativo. Proporciona herramientas técnicas para calcular exposiciones económicas, determinar reservas para litigios y contingencias, y medir la efectividad de las medidas preventivas. Estas metodologías permiten justificar el retorno de inversión de los programas de cumplimiento e implementar una defensa corporativa fundamentada en la evidencia cuantitativa de la debida diligencia.
Para auditores internos y directores de riesgo Esta obra establece un marco de control para evaluar la precisión de las evaluaciones de riesgos, verificar el fundamento de las decisiones de mitigación y auditar la efectividad de los controles instituidos. Permite a la tercera línea de defensa superar la revisión de registros de riesgos cualitativos y validar los sistemas de gestión mediante datos y evidencia estadística.
Para directores de cumplimiento y Compliance Officers El texto proporciona la estructura necesaria para integrar métricas cuantitativas en los sistemas de gestión de cumplimiento, alineando los programas de prevención de delitos y cumplimiento normativo con los estándares de gobernanza corporativa y la gestión de riesgos de la alta dirección.
Herramientas avanzadas para la toma de decisiones financieras y legales
Para determinar una cifra de exposición defendible ante auditores y reguladores, la obra detalla la aplicación práctica de instrumentos cuantitativos:
Simulación de Monte Carlo: Modela miles de escenarios de riesgo para obtener la distribución completa de pérdidas potenciales, evitando la dependencia de estimaciones puntuales o valores medios.
Distribuciones de Poisson y Lognormal: Permite estructurar la frecuencia de los eventos de incumplimiento y la severidad de sus consecuencias con rigor estadístico.
Calibración de juicio de expertos: Estructura la experiencia del personal clave mediante rangos probabilísticos reproducibles, minimizando los sesgos cognitivos en la estimación del riesgo.
Métricas de volatilidad y análisis de exposición: Define el nivel de tolerancia al riesgo y calcula las perdidas máximas esperadas en procesos judiciales y regulatorios.
Aplicación en decisiones de gobernanza corporativa
El marco metodológico expuesto responde a las preguntas clave de la alta dirección sobre la gestión de contingencias:
Determinación del coste real de las obligaciones normativas y legales en la operación.
Optimización del gasto en prevención frente a las alternativas de retención, transferencia a seguros o aceptación del riesgo.
Definición de la cuantía exacta de las reservas financieras para contingencias legales y procesos sancionadores.
Demostración cuantitativa de la debida diligencia en procesos de prevención de delitos y auditorías de cumplimiento.
Sobre el autor
Hernan Huwyler es un especialista en gobernanza de IA, compliance y gestión cuantitativa de riesgos con más de dos décadas de experiencia ejecutiva en organizaciones multinacionales. Es profesor ejecutivo en IE Business School y ha capacitado a más de 1.500 profesionales en áreas de cumplimiento, privacidad, auditoría y gestión de riesgos.
Estructura y diseño para la práctica profesional
La obra está organizada como un manual de referencia técnica de consulta modular. Cada capítulo aborda un problema específico de cuantificación, desde la recolección de datos y la calibración de estimaciones hasta la integración de las simulaciones en la presentación de informes para el Consejo de Administración.