Risk Register Without an Impact Assessment
A fintech plans to launch a credit-limit model in a new country next month. The risk register scores the launch for 'reputational damage' and 'regulatory fine', with likelihood and financial impact approved by the risk committee. No assessment has been made of how the model affects applicants. The model uses postal code as a feature; internal testing shows a 12% denial rate for one district with a predominantly older population, against 4% elsewhere. The project sponsor says the model passes the company's fairness threshold because the vendor's disparate-impact metric is below 0.8. Customer complaints from a pilot are not logged as AI issues because the complaint form has no AI category.
1. Explain the difference between the AI risk assessment and the AI system impact assessment in this situation.
Read the worked answer
The AI risk assessment asks what could prevent the AIMS from achieving its objectives and what harm could flow to the organization - here, regulatory fines, reputational damage, and launch delay. Its unit of analysis is the organization and its objectives.
The AI system impact assessment asks who could be affected by the AI system and how - here, applicants in the older district who are denied credit at three times the rate elsewhere. Its unit of analysis is individuals, groups, and society, including fairness, accessibility, and due process.
A risk register that only scores fines and reputation can be 'green' while an impact assessment reveals discrimination. Passing a vendor's 0.8 fairness metric is not a substitute for the impact assessment: the threshold choice, the reference group, and the feature set all need scrutiny. The postal-code proxy and the complaint-logging gap are exactly the kind of findings an impact assessment should surface before launch.
2. Should the launch proceed next month? Recommend a decision and the conditions attached to it.
Read the worked answer
It should not proceed on the current evidence. The launch can be conditionally deferred until the impact assessment is complete and the postal-code feature is justified or removed.
Conditions:
- Complete an AI system impact assessment covering applicants in the affected district, including older applicants and those with thin credit files.
- Test the model without postal code and compare denial rates; document why the feature is necessary and proportionate if retained.
- Replace the single vendor metric with documented fairness criteria, reference groups, and thresholds approved by an accountable owner.
- Add an AI category to complaint logging and review pilot complaints.
- Define human review for denials in the affected segment.
- Set monitoring triggers - for example, denial-rate divergence above an agreed band - that pause the model.
- Report the assessment and decision to the risk committee.
A month may be enough if the work is prioritized, but the decision should be evidence-based, not calendar-based. Proceeding without the impact assessment would leave a known fairness issue unmanaged.
3. What should the AIMS owner do about the complaint-logging gap and the fairness threshold?
Read the worked answer
Both are AIMS weaknesses, not just project issues. The complaint-logging gap means AI-related harms are invisible to monitoring and management review. The AIMS owner should add an AI issue category, route complaints to an accountable function, and define how trends feed performance evaluation.
The fairness threshold needs a documented rationale. A vendor metric below 0.8 is a single indicator, not a complete control. The owner should require:
- A defined fairness objective and the groups it covers.
- Evidence that the metric suits the credit context.
- Human review of edge cases and overrides.
- Periodic revalidation as the population or model changes.
These should be recorded as risk-treatment actions with owners and dates, and tested in the internal audit programme. If the organization cannot articulate why 0.8 is acceptable, it cannot defend the decision to a regulator or an auditor. The AIMS owner's role is to make that reasoning explicit and traceable, not to substitute a vendor number for judgement.