AI Risk Identification and Assessment
Domain 2 tests whether you can identify AI-specific risks and run a defensible assessment, not just list model accuracy metrics. Questions often ask you to choose a method, score inherent and residual risk, or spot a missing risk category in a register.
Core rules and concepts
- Use a taxonomy that covers performance and drift, robustness and adversarial exposure, privacy, fairness and bias, transparency and explainability, security, third-party supply chain, human factors, and legal/regulatory risk.
- Threat modeling for AI should combine system context with adversary techniques. MITRE ATLAS and OWASP Top 10 for LLM Applications are useful lenses, not substitutes for your own architecture review.
- Assess inherent risk before controls and residual risk after. Record likelihood, impact, velocity, and detectability; calibrate scales with examples.
- AI impact can be amplified by scale, autonomy, opacity, and feedback loops. A chatbot error may be low impact per interaction but high aggregate impact.
- Reassess on triggers: model update, new data source, new tool/plugin, new jurisdiction, incident, or drift threshold breach.
Worked example
An internal RAG assistant answers HR policy questions. Risks: hallucinated policy (performance/transparency), indirect prompt injection from retrieved documents (security), leakage of restricted HR content (privacy), stale index (drift), and over-reliance by staff (human factors). Score inherent risk high for privacy because the index may contain case notes. Controls: source allow-listing, per-user retrieval filtering, answer citations, prompt-injection filtering, and quarterly index refresh. Residual risk is medium with a named HR owner and a review trigger when a new document source is added.
Traps that cost marks
- Scoring only technical model risk and omitting human, legal, and third-party risk.
- Calling a control a risk: 'we have a filter' is not a risk statement.
- Using uncalibrated high/medium/low labels with no criteria.
- Forgetting reassessment triggers and model drift.