AI Risk Identification and Assessment
Core concepts
Risk identification is the disciplined discovery of what could go wrong; assessment is estimating likelihood and impact and prioritizing. Candidates must know risk taxonomies (e.g., harm to individuals, harm to the organization, societal harm), use-case tiering based on autonomy, data sensitivity, population affected, and reversibility of harm. Understand inherent risk scoring, control effectiveness assessment, and residual risk calculation.
Know the assessment techniques: model validation (conceptual soundness, data quality, performance, stability, interpretability), bias and fairness testing, stress and adversarial testing, red teaming, scenario analysis, and sensitivity analysis. For generative AI, include hallucination testing, prompt-injection assessment, and output-safety evaluation.
Key concept: risk is contextual. The same model deployed for internal drafting versus customer-facing advice carries different risk. Assessment must consider affected stakeholders, regulatory exposure, and reversibility.
Traps
Questions often treat validation as a one-time event; it is continuous. Another trap: scoring risk by model complexity rather than by use context and impact. Beware of conflating likelihood with frequency and impact with severity alone.
Rule of thumb
Assess who is harmed, how badly, how many, and can it be undone. High autonomy plus sensitive data plus irreversible harm equals high tier regardless of model accuracy.
Worked example
A chatbot answers employee policy questions. Low autonomy, internal audience, reversible harm: moderate tier. The same model repurposed to give customers medical guidance: high autonomy, vulnerable population, irreversible harm: high tier. The model did not change; the context did.