How do you manage the risks associated with AI decision making in your projects?

AI is a different beast. Ultimately, AI is a technology problem without a technology solution. Don't get me wrong, technology controls are essential but not sufficient. AI adds new risks and adds new dimensions to existing risks. AI tends to impact the Integrity leg of the CIA Triad and to paraphrase the former head of DARPA (Dr. A. Prabhakar), now the Director of the Office of Science and Technology Policy (OSTP), when AI fails, it fails in ways a human never would. For AI-specific risks, focus on mitigating the Blast Radius (impact), knowing something will skew. Also, review your risk register and ask yourself, "How does AI change the Likelihood and the Impact?"

As in any disruptive area, we're still struggling to find the actual purpose of the technology. AI seems to be the solution to everything nowadays.... Love the Problem, not the Solution. What are we really solving with AI? And is there really a causility, or just a correlation? In order to properly assess any (AI) risk, you really, really, really need to understand the Process. Talk to the people who are actually doing it now, or intend to do so. I've seen so many wrongfully done risk assessments on either side-effects, or on theoretical exceptions, resulting in eager Risk managers mitigating absolutely nothing, or worse - blocking a well running process altogether.

Just like any algorithm, AI models used in wealth management can inherit biases from the data they are trained on. This could lead to recommendations that favor certain investments or overlook opportunities for certain client demographics. Wealth managers should ensure the data used to train the AI is fair and representative of the market.

Managing AI decision-making risks starts with a comprehensive risk assessment. Identifying issues like biased data and ensuring algorithmic transparency are crucial. In my experience, understanding the AI's decision scope and data usage helps in foreseeing potential problems. Evaluating the likelihood and impact of these risks allows for prioritizing management efforts effectively. Regular audits, diverse data sets, and robust oversight mechanisms are essential to mitigate these risks. Engaging stakeholders throughout the process ensures that AI decisions are aligned with organizational values and ethical standards, fostering trust and accountability in AI-driven projects.

In general terms, risk management is defined as the process of identifying, monitoring and managing potential risks. Risk management is a process, not a static feature or checklist. Typical risk management cycles have four or five steps: identify the risk, assess or analyse the risk, (evaluate or rank the risk,) treat the risk, and monitor and review the risk. Risks can be mitigated in a variety of ways. Most logically is to eliminate them in design or development of the system, or to introduce safeguards or fail-safes. If that is not feasible, providing instructions on how to avoid them. Third, take out liability insurance to cover the consequences.

Considering the ethical implications of AI, internal auditors role becomes crucial in ensuring that AI systems make accurate and ethical decisions. Internal Auditors will have to deploy some strategies to assess AI decision-making: - Understand the AI System, at least the basics like algorithm objective, etc., even if the auditors needn't be experts in AI programming. - Collaborate with AI Experts, if required, to be able to make informed decisions. - Evaluate Data Quality used by the AI system to verify data architecture, models, and training data. - Consider using Explainable AI (XAI) techniques to understand how AI algorithms arrive at decisions. - Evaluate the risks associated with AI decisions and audit the decision-making process.

The ‘techlash’ that was the result of various incidents in the late 2010s set in a period of increased attention to ‘honest’ or ‘ethical’ AI. Initially, the main effect was to produce codes of ethics, that made large promises of fairness and transparency (“virtue signaling”) but did little to change the actual products or services. As already known from the field of business ethics, changing a company’s behavior requires more than ethical statements: “[w]hen ethical ideals are at odds with a company’s bottom line, they are met with resistance”. It is imperative that AI ethics become a fundamental component of any and all work done on or with AI. The values must meet those of the organization and be actually worked towards.

It's a timely topic. Since AI is still developing, it is important to acknowledge that AI systems are not foolproof. They can make mistakes, especially if they are fed biased or incomplete data. The quality of the data used to train AI systems directly impacts their performance. Use accurate, up-to-date, and relevant data. Poor data can lead to poor decisions, so maintaining high data standards is crucial. Maintain a level of human oversight in AI decision-making processes. Humans can provide the context and judgment that AI lacks.

Fallback plans can range from sophisticated strategies like maintaining an off-site duplicate of the entire system, which continuously syncs with the primary master system, to simpler solutions. For instance, a watchdog system may monitor response times of an AI customer service system, and transfer customers to a human operator if the AI appears to be unresponsive for too long. In a smart home setting, a set of preprogrammed defaults may set in if the algorithmic environment management system makes many changes in a short time. And in a decision-support system, the AI-driven advisor can be replaced by a questionnaire or flowchart that addresses common situations.

Somewhat flippant point but here we have an article written by AI guiding us on how to manage risks associated with integrating AI decisions. Hmmm :-) Humans of course also have biases and source data from contrasting experiences that inform their 'expertise' and guidance, my comment here being no different. But regardless of whether an information source is AI or human, or a system or process output is an AI decision or a human decision, risk managers must always be sceptical and ask the right questions. In the case of deploying new AI there might be new risks to manage but the risk management pillars of Identify/Assess/Plan/Implement/Monitor/Review remain.

AI like any other tool is meant to improve and enhance the way we do things. A hammer in the hand of a skilled carpenter can result to great creations. That same hammer in the hand of a raging madman can cause a lot of destruction. Ultimately, it is still us humans who exercise the final judgment and determines how we use AI in our lives.