Risk Assessment and Impact Assessment for a Biased Recruitment Model
TalentBridge operates an ML candidate-ranking tool for 40,000 applications a year across 12 client employers. The model ranks applicants on predicted job fit using CV text, assessment scores and interview notes. A client's audit found that candidates aged 50+ were selected for interview at an 18% lower rate than under-40 candidates after controlling for role and score. The vendor calls the model proprietary and says it was 'validated for fairness'. TalentBridge has no AI system impact assessment, no documented risk criteria and no baseline bias testing. Its risk register lists only 'reputational damage' at likelihood 4, impact 4, with no owner and no treatment. The product manager wants to launch a new 'video interview sentiment' feature in six weeks. The board has asked whether the AIMS can be certified without changing the vendor contract.
1. Design the AI risk assessment for the ranking tool. Specify how you would set risk criteria, identify AI-specific risks and assess them, and what role the AI system impact assessment plays.
Read the worked answer
Risk criteria should be defined before assessing the tool: likelihood and impact scales, plus AI-specific dimensions such as the number of affected people, reversibility, discrimination potential, opacity, regulatory exposure and dependency on a supplier. Set risk acceptance thresholds and identify who can accept residual risk. Risk identification should cover bias and discrimination, data quality and provenance, privacy, automation bias, model drift, explainability, vendor lock-in, misuse and human-rights impacts. Assess inherent risk, then controls, then residual risk. The AI system impact assessment is not the same as organizational risk: it focuses on individuals and society and should examine whether the ranking process could disadvantage protected groups, how decisions are reviewed and whether candidates can challenge outcomes. The 18% disparity is a symptom that must be investigated, not accepted because the vendor says the model was validated. Ask for the validation data, test on TalentBridge's own population and document uncertainty. Feed the results into the risk treatment plan and the Statement of Applicability. If the vendor refuses evidence, treat that as a risk and consider independent testing or suspension. Record the method, criteria, results and approvals so the assessment is repeatable.
2. Evaluate the product manager's proposed six-week launch against ISO/IEC 42001 planning requirements. What must be true before the feature can be released?
Read the worked answer
Planning under ISO/IEC 42001 requires risk treatment, objectives, resources, competence, communication and documented information. A six-week launch is a change that should trigger a risk assessment update and a release gate. Before release, at minimum: a completed impact assessment for the new feature; evidence that sentiment analysis does not proxy for protected characteristics or create new bias; representative test data; human review for adverse decisions; candidate notice and a complaint route; logging; monitoring metrics and thresholds; rollback; vendor change notification; and training for users. The product manager's schedule is not a control. If these are not in place, the feature should be deferred or piloted in a limited, monitored way with no adverse impact. Certification does not require zero risk, but it does require that risks are identified, treated and accepted at the right level. Launching because the contract is unchanged would leave the organization unable to show control. Document the decision and the residual risk acceptance.
3. The board asks whether certification is possible without renegotiating the vendor contract. What is your answer and reasoning?
Read the worked answer
Certification is possible only if TalentBridge can demonstrate control over the outsourced AI, not necessarily by rewriting every contract immediately. The standard requires supplier relationships to be managed and risks from third parties to be treated. The current contract gives no audit rights, no incident notification, no change notification and no access to validation evidence. That is a control gap. Options are: renegotiate before certification; obtain contractual attestations and independent test reports as compensating controls; or accept the residual risk with top-management approval and a time-bound plan. The certification body will sample supplier management evidence, so a promise to renegotiate later is weak unless there is an approved plan, interim monitoring and a risk assessment. If the vendor will not provide any evidence, the organization should consider changing vendor or limiting use. The board should hear that a certificate is not a substitute for supplier leverage. The answer is yes in principle, but not on the current evidence: the contract or compensating controls must change first.