Foundations of AI/ML and Risk Management
What this domain tests
This domain checks whether you can distinguish traditional model risk from AI/ML risk and apply a risk-based lens across the lifecycle. Expect questions on ML paradigms, generalization, validation, risk tiering, and the limits of accuracy as a safety measure.
Core rules
- Model risk is the potential for adverse consequences from decisions or errors based on model outputs; AI risk adds data dependence, opacity, autonomy, scale, and sociotechnical context.
- Supervised learning predicts labeled targets; unsupervised learning finds structure; reinforcement learning optimizes actions through rewards. Each changes validation needs.
- Generalization, not training fit, is the goal. Overfitting, leakage, and unrepresentative samples are primary failure modes.
- Risk is assessed as inherent risk before controls and residual risk after controls. Tiering should reflect materiality, complexity, regulatory sensitivity, and customer impact.
- Controls include data lineage, independent review, challenger models, monitoring, and human oversight.
Worked example
A lender uses a gradient-boosted model for credit approval. Overall error is 2%, but error is 9% for thin-file applicants. Accuracy alone would classify the model as low risk. A risk-based assessment should instead flag high inherent risk because of consumer harm and fair-lending exposure, require disaggregated testing and reason codes, and treat residual risk as high until mitigation is validated.
Traps
Do not equate a high AUC with low risk; do not treat AI as deterministic software; do not assume a vendor model is solely the vendor risk; and do not ignore proxy variables or feedback loops.