Shadow AI, Untested Recovery and a Single Remediation Budget
Anli Insurance has 2,300 staff and 400 confirmed users of unapproved generative-AI assistants, 17% of whom pasted policyholder data into them according to a network sample. Internal audit reported 23 of 40 critical systems with disaster recovery that has never been tested, and 61 supplier contracts with no right-to-audit clause, including the two that host claims processing. The regulator has asked for evidence that outsourcing risk is 'identified, measured and reported to the board'. There is a risk committee that meets quarterly, an information security team of nine reporting to the CIO, and no formal risk appetite - each business unit sets its own tolerance. The audit committee has given you one remediation budget of CNY 8 million and 12 months, and has asked for a single report it can sign. Business units say any AI restriction will simply push usage onto personal devices.
1. Draft the risk appetite structure the board can actually sign, with quantified tolerances, and show how each becomes an operational limit.
Read the worked answer
The board is being asked to sign something it does not have: a stated appetite. 'Each unit sets its own tolerance' is not decentralisation, it is the absence of a decision.
Structure: appetite statement → tolerance → limit → KRI.
Appetite (one page, qualitative): Anli accepts low appetite for compromise of policyholder data and for regulatory breach; moderate appetite for availability risk in internal systems; zero appetite for processing personal data outside contracted, assessed arrangements.
Tolerances (quantified, board-owned):
- Zero use of tools without a data-processing agreement for personal data, measured as DLP egress events per month. Current state: roughly 68 staff observed pasting data, so the tolerance is being exceeded daily - that is itself the finding.
- No more than two tier-1 systems with untested recovery at any point from month 9 onward. Current: 23 of 40 critical systems untested, 57.5%.
- 100% of tier-1 supplier contracts carrying audit and exit rights within 12 months.
Limits (operational, CISO-owned): block personal-data egress to unapproved AI endpoints; monthly KRI pack to the risk committee; any single breach of a limit escalates within five working days with a dated remediation plan and a named owner.
Independence problem. Information security reporting to the CIO gives the second line a reporting line into the first line. At 2,300 staff the pragmatic fix is a CISO reporting to the chief risk officer with a direct board reporting right. The regulator is asking for evidence of reporting, and the current structure cannot produce it convincingly.
2. Allocate the CNY 8 million across 12 months. Justify the sequencing by risk exposure rather than by audit severity.
Read the worked answer
Rank by exposure, not by audit rating. Exposure = likelihood × impact × regulatory weight; audit ratings ignore the last two.
| Priority | Item | Indicative cost | Reasoning |
|---|---|---|---|
| 1 (months 0–3) | AI data-egress containment: DLP on outbound personal data, sanctioned assistant, migrate 400 users | ~1.0M | Highest probability, live evidence of harm, cheapest control, most regulator-visible |
| 2 (months 0–6) | The two hosting contracts for claims processing: audit rights, exit plan, residency evidence | ~0.5M legal + ~1.0M assurance testing | Claims is the critical operation; no audit right means no assurance at all |
| 3 (months 3–9) | Recovery testing for the top 8 tier-1 systems, ordered by maximum tolerable downtime | ~2.5M | Eight tested systems prove more than 23 untested plans; testing also exposes fix costs |
| 4 (months 6–12) | Remaining 59 contracts through a clause library and renewal calendar | ~1.0M | Cheap per contract and paced by renewal dates; no benefit in rushing |
| 5 | Remaining 32 recovery plans, rolling annual test cycle | ~2.0M | Not achievable in 12 months - agree a date certain with the regulator |
Hold 15% (about 1.2M) contingency and say so in the paper - recovery tests routinely find work that must be fixed before the system can be signed off.
Report format: one page per quarter with tolerance status in red/amber/green, trend direction, and decisions requested. The audit committee asked for something it can sign, which means stating where you will remain outside tolerance and by when - not claiming full remediation. A credible partial report beats an implausible complete one.
3. How would you handle the 400 users of unapproved AI tools so usage does not go underground? Specify who decides what.
Read the worked answer
The control failed, not the staff. Four hundred people adopted generative AI because it made their work faster. That demand is legitimate and will not be removed by a ban; a ban pushes usage onto personal devices where visibility is zero - the outcome business units are already predicting.
Sequence:
- Amnesty and visibility (weeks 1–4). Two-week amnesty, no sanctions, users declare what they use and why. This yields the real inventory and the use cases that justify buying a sanctioned tool.
- Make the safe path faster than the shadow path (weeks 2–8). Procure one or two enterprise assistants with SSO, no-training-on-your-data terms and a data-processing agreement, and pre-approve them. If the sanctioned tool is slower or worse, adoption fails and the policy loses credibility permanently.
- Control at egress, proportionate to risk (weeks 4–10). DLP rules on the specific data classes that matter - policy numbers, name plus claim data, bank details - rather than mass surveillance of prompts. Log and review; do not read everyone's work.
- Enforce only after 1–3 exist (week 10 onward). At that point a policy with teeth is credible because breaches are genuinely avoidable.
Decision rights: the risk committee owns the tolerance for personal data in external tools; the CISO owns the control standard and the approved-tool list; business units choose which use cases to pursue within that standard; internal audit assures.
Success metric: share of AI usage on sanctioned tools (target 90% of the 400 within six months) and DLP incidents per 100 users - not the number of blocks, which measures how good you are at hiding the problem.