Select Two (Multi-Select) Questions

Inference request latency.

High latency can impact user experience or business processes.

Prediction error rate (or failure rate).

An increase in errors is a direct indicator of model failure.

Integration with existing GRC and software delivery workflows.

Integration makes governance feel like part of the work, not an add-on.

Establishing a clear, collaborative engagement model between risk teams and developers.

Collaboration reduces friction and ensures buy-in from technical staff.

The availability of cross-functional expertise (e.g., legal, compliance, ethics) within the AI governance body.

A multi-disciplinary approach is essential for holistic AI risk assessment.

The maturity of the enterprise's existing risk management processes and their compatibility with AI-specific risks.

Leveraging existing frameworks is critical for long-term sustainability.

The distribution of prediction outputs.

Detects if the model's behavior is changing significantly.

The confidence score of the model predictions.

Declining confidence often precedes performance failure.

The distribution of incoming input features.

Detects if the incoming data population has shifted.

Qualitative overview of ethical AI alignment with company values.

Ethical alignment is a critical board-level oversight responsibility.

Summary of current AI risk appetite and threshold breaches.

Appetite and threshold breaches allow the board to assess organizational risk status.

Strategic assessment of regulatory compliance and potential legal exposure.

Regulatory risk is a primary board concern due to legal and financial impacts.

Incomplete datasets with many missing values.

Missing data leads to unreliable predictions.

Systematic errors in the target label annotations.

Label errors train the model to be wrong.

Selection bias in the training set creation process.

Bias in data ensures bias in the model.

Data Privacy Office

Crucial for handling PII within AI datasets.

Legal and Compliance

Ensures adherence to evolving regulations.

Identification of potential failure modes and their impact.

Failure mode analysis is a standard risk assessment technique.

The residual risk level after applying controls.

Residual risk is the primary output of an assessment.

Documentation of mitigating controls for identified risks.

Mitigation documentation explains how the risk is managed.

Training data is from a 5-year-old dataset that is no longer representative.

Lack of temporal relevance renders the data low-quality for current needs.

Training data features have inconsistent units (e.g., mixed meters and feet).

This is a fundamental data quality error.

Rapid propagation of faulty or biased models to production.

A major risk when automation isn't constrained.

Increased risk of security vulnerabilities being overlooked in the deployment config.

Automation can miss subtle security misconfigurations.

Lack of human intuition to catch edge-case failures.

Automated metrics might miss nuanced edge cases that a human could spot.

AI-powered biometric identification for facility access.

Biometric systems carry significant privacy and security risks.

Automated recruitment and hiring filtering tools.

Hiring systems can perpetuate bias and impact human livelihoods.

The original Model Card and documentation.

Identifies the intended purpose vs. actual misuse.

The raw input and prediction output logs.

Identifies the specific data inputs that caused the incident.

The model versioning and lineage logs.

Identifies the specific code/data state.

Conducting fairness audits using specialized metrics (e.g., Disparate Impact).

Provides quantitative evidence of bias.

Sourcing training data from diverse, representative populations.

Addresses bias at the source.

Model validation results

Confirms the model meets risk thresholds before deployment.

Incident response logs

Necessary for accountability and forensic analysis.

Data lineage and provenance

Ensures data integrity and ethical sourcing.

Identification of relevant stakeholders

ISO 42001 emphasizes stakeholder communication and consultation.

Assessment of AI risk levels (likelihood and impact)

Risk analysis is a mandatory component of the risk management process.

AI system description and intended use

Defining the scope and purpose is foundational for ISO 42001.

Senior Leadership/Business Owners

They decide the acceptable risk for business goals.

The Risk Management/Compliance Office

They ensure the risk is consistent with the corporate strategy.

The model's intended use cases and operational boundaries.

Defines the scope of risk.

The performance metrics and limitations observed during testing.

Defines what the model can and cannot do.

Access management controls restricting model usage.

Limiting who can trigger or modify models is a foundational security control.

Manual approval gates for model deployment.

Approval gates provide the necessary oversight before production deployment.

Automated version control for model training code.

Version control ensures repeatability and auditability of models.

Risk Treatment/Mitigation.

Treating identified risks is central to the lifecycle.

Risk Identification.

Identification is the first step in the risk lifecycle.

Ongoing Monitoring and Review.

Monitoring ensures that risks don't re-emerge.

The organization's tolerance for legal and reputational damage.

Reputational and legal tolerance are core components of risk appetite.

The complexity and autonomy level of the AI models being deployed.

Higher autonomy models carry higher risk, requiring a defined appetite.

The existing regulatory landscape and sector-specific compliance requirements.

Compliance requirements define the 'floor' for risk appetite.