Managing Artificial Intelligence Risks
Key Takeaways:
- Establish AI Governance and Controls: Ensure AI systems produce reliable, secure, explainable, private, and fair results, with clear accountability.
- Understand the Risks of AI: Poor AI predictions and misuse can lead to significant financial losses, reputational damage, and workforce impacts.
- Choose the Right Assessment Framework: Select an AI framework based on your organization’s environment, AI use, maturity, and objectives.
- Monitor AI Throughout Its Lifecycle: Establish governance, map potential risks, measure performance, and continuously manage AI systems to ensure they remain effective and trustworthy.
AI Key Considerations
Artificial Intelligence (AI) is becoming part of many everyday decisions through all levels of organizations. As organizations integrate AI into their operations, they should be asking themselves whether or not they’re developing and implementing adequate AI Governance and Controls. Also, are they confident that their AI is trustworthy and produces valid results that are reliable, safe, secure, resilient, explainable, private, and fair? Are people held accountable for producing results that are transparent and explainable? If an organization cannot answer yes to these questions, then it may be time to invest in an assessment of their AI Governance and Controls.
AI Lessons Learned
AI continues to change how organizations perform many business operations, including forecasting revenue, serving customers, evaluating job applicants, monitoring security, and making operational decisions. AI introduces a new level of risks for organizations.
Zillow was on the forefront in using predictive technology to generate a Zestimate for homes. They were so confident of the AI predictions that they announced Zestimate would be their initial cash offer for eligible homes. This little venture resulted in a Q3 2021 ~$304 million inventory write-down and a 25% reduction in Zillow’s workforce. In 2024, an AI generated video impersonating a company’s CFO and senior board members resulted in Arup losing ~$25.6 million.
What AI Assessment Is Best?
The answer to this question is the age-old “it depends.” The various AI frameworks all start with an inventory of AI systems, tools, embedded features, and employee use. From there the frameworks diverge and should be selected based upon an organization’s environment, AI use, and AI maturity and objectives. The following presents three common frameworks with a high-level explanation of their applications.
AI Accountability
The Institute of Internal Auditors (IIA) AI auditing frameworks approach the AI assessment from an accountability perspective and assess oversight, execution, and independence. This model follows the IIA’s Three Lines of Defense and assesses the responsibilities of the governing bodies’ oversight, management’s establishment of controls, and internal audit’s evaluation and reporting of the performance of those controls. This approach assigns accountability to the appropriate personnel instead of making technology personnel solely accountable.
AI Managed Risks
The Information Systems Audit and Control Association (ISACA) uses COBIT 2019 as the basis for their AI assessment framework. This model addresses organizational structure, processes, information, policies, skills, culture, and technology necessary to govern AI. The framework assesses the management of AI risk, data, performance, and conformance monitoring. The objective is to have AI support business priorities, risk tolerances, data stewardship, and provide measurable results. The objective is an efficient use and monitoring of AI throughout the organization.
AI Implementation Support
The National Institute of Standards and Technology AI Risk Management Framework (NIST AI RMF) assesses the management of AI risks throughout the AI lifecycle. There are four functions: Govern, Map, Measure, and Manage. These functions work together to connect technical performance to business consequences. The goal is positive business consequences.
Govern
This function establishes the policies, responsibilities, and oversight for AI across all the function areas. The result is an AI inventory with clear rules for AI ownership, oversight, approval, use, escalation requirements, and results review and validation.
Map
This establishes the processes for assessment of use, which considers the purpose, stakeholders, data sources, dependencies, impacts, and consequences of failure. AI should be connected to measurable business objectives and assessed to determine if AI is appropriate for the task.
Measure
AI should be tested and assessed to examine the performance. The testing should cover areas such as security, accuracy, privacy, trustworthiness, and limitations. Scenarios should assess the potential for financial and reputational losses that could occur due to the use of AI. The AI implementation should include thresholds and red flags that trigger investigation or intervention.
Manage
AI, like most processes, is not once and done. Internal and external factors can impact the performance of AI and change the outcomes. AI needs to be continuously monitored and include procedures for analyzing incidents, recovery, changes, and potentially retirement of the AI.
McKonly & Asbury has qualified and credentialed staff who are available to consult on AI and assist you in deciding on the best assessment framework for your organization. To learn more about our AI Assessment services, please contact Partner David Hammarberg or Director Elaine Nissley.
About the Author
Elaine Nissley, MBA, CISA, PMP, CRISC, CRMA, CCSFP, Lead CCA is a Director with the firm. Her primary responsibilities include management of the Cybersecurity Maturity Model Certification (CMMC) Assessment group where she handles bus… Read more
