ISACA AAIR study materials
ISACA AAIR study resources

The Silent Model Swap: Automated Hiring Scores, Bias Audits and Expansion Pressure

ISACA AAIR · Put your knowledge to work in context.

All case studies

The Silent Model Swap: Automated Hiring Scores, Bias Audits and Expansion Pressure

Meridian Retail Group hires 12,000 people a year across 1,400 stores. Since 2022 the talent team has used a vendor's automated video-interview scoring tool to rank entry-level applicants; recruiters review the top 40% and typically hire from the top 15%. The vendor delivered a bias audit in June showing an impact ratio of 0.86 for one racial group. In September, without notice, the vendor deployed a new scoring model, changing the features from word use to facial expression and speech pace. The employer's own January analysis on 3,100 applicants shows an impact ratio of 0.79 for the same group and 0.81 for women. Legal has not been involved. The talent VP wants to extend the tool to internal promotions and to shift the review cut-off from top 40% to top 25% to save recruiter time. The company operates in jurisdictions including New York City. The contract says the vendor 'may update the service'.

1. Characterise the risk created by the unannounced model change and state what must happen before any expansion.

Read the worked answer

The June audit is now stale by construction. It tested a different system. Changing features from word use to facial expression and speech pace is not an incremental update - it is a different model with different failure modes, different validity claims and a new biometric data exposure. Relying on the June result to justify the September model would misrepresent the evidence.

Risk characterisation

  • Evidentiary: the employer cannot currently demonstrate the tool is job-related and consistent with business necessity for the version in use.
  • Disparate impact: the 0.79 impact ratio sits below the four-fifths guideline for one group and 0.81 for women. This is a screening flag requiring investigation, not proof of unlawful discrimination - but it is exactly the signal that should stop an expansion.
  • Expansion to promotions raises the stakes: higher-impact decisions, a population the tool was never validated on, and potential employee-relations exposure.
  • Cut-off change to top 25% amplifies whatever bias exists in the score, since fewer candidates are reviewed and the score carries more weight.
  • Jurisdictional: in New York City, automated employment decision tools carry annual independent bias-audit, publication and candidate-notice obligations; a material model change should trigger a fresh audit, not an annual clock alone.

Before any expansion Freeze the expansion and the cut-off change; obtain full documentation of the current model; commission an independent audit of the version in use; bring in legal; brief the CHRO and the risk function rather than only the talent team. Expansion is a decision for the CHRO, legal and the AI governance forum - not the talent VP alone.

2. Design the bias audit. What data, metrics and methodological pitfalls must be addressed?

Read the worked answer

Scope Define the decision under audit (scoring, shortlisting, or actual hire - they are different and can produce different results), the population, and a window of at least 12 months. At 3,100 applicants, subgroup counts may be thin; report confidence intervals and avoid over-reading 0.79 versus 0.80.

Metrics

  • Selection rates and impact ratios against the highest-selecting group.
  • Score distributions by group, not just pass/fail at the cut-off.
  • Error rates by group: a tool can show equal selection rates while false negatives are unequally distributed.

Pitfalls to name

  • Criterion contamination: if 'successful hire' is proxied by later performance ratings, those ratings may carry their own bias. Prefer independently measured, job-related outcomes, or decline to make a criterion-validity claim.
  • Proxy features: facial expression and speech pace correlate with disability, age, accent, culture and camera or bandwidth quality. Device and connectivity differences can produce a group effect that is a technical artefact - test for it before concluding bias.
  • Validity ≠ parity: passing the four-fifths guideline does not establish job-relatedness, and failing it is not a legal verdict. The guideline is a screening heuristic drawn from enforcement practice, not a safe harbour.
  • Independence: the auditor must be independent of the vendor, with access to raw scores and feature documentation. A vendor-produced audit of its own model is a conflict of interest.

Document methodology, retain data per local rules, and require re-audit before any material model change rather than only annually.

3. Set out the governance and contract remediation, including decision rights and candidate-facing obligations.

Read the worked answer

Contract

  • No deployment without employer approval: advance notice plus a right to reject or defer an update.
  • Audit rights and access to model documentation, validation evidence and feature listings.
  • Obligation to re-run an independent bias audit before material changes and annually.
  • Data ownership, deletion, biometric-data restrictions and retention limits.
  • Indemnity and termination rights on failed audit.

Process

  • Register the tool in an AI/model inventory with a named business owner.
  • A pre-deployment review gate run jointly by HR, legal and risk for any new tool or material change.
  • Ongoing monitoring of selection rates and post-hire outcomes by group, with thresholds that trigger review.
  • A candidate complaint and reconsideration route.

Decision rights The CHRO is accountable for the employment decision; the vendor is accountable for the tool; risk and legal challenge both. Expansion to promotions should require CHRO, legal and AI governance sign-off.

Candidate-facing and accessibility Confirm notice timing, plain-language explanation of the tool's role, and a human review path for anyone who opts out or is scored low. Recorded video interviews create accessibility and accommodation exposure - candidates with disabilities, unreliable devices or poor connectivity may be systematically disadvantaged. If accommodation requests were never analysed, they belong in the same audit.

Report upward: one page to the AI governance forum covering the stale audit, the impact ratios, the frozen expansion and the remediation dates.