Systemic Controls for Managing Risk in AI/ML Systems
This paper, published in the Fall 2024 Enterprise Technology Leadership Journal, addresses the challenges of managing risks associated with artificial intelligence (AI) and machine learning (ML) systems. The authors aim to educate auditors, internal risk directors, and software leaders on the differences between existing risk management controls and those needed for new AI/ML systems, including generative AI. The paper provides an overview of the control environment for AI/ML systems, focusing on six unique assets and suggesting controls for managing associated risks throughout the AI/ML development life cycle.
The authors discuss the various stages of AI/ML system development, including data preparation, data management, model development, model evaluation, model deployment, and continuous monitoring. For each stage, they provide sample controls to mitigate specific risks. The paper emphasizes the importance of understanding the new types of software assets introduced by AI/ML systems and the need for organizations to update their practices to accommodate these new components. The authors also highlight real-world examples of problems that can occur when AI/ML assets are not properly managed, underscoring the importance of implementing effective controls.
What's inside
- New Asset Types — AI/ML systems introduce new types of software assets, such as model weights and datasets, which require specific controls and management practices.
- Life Cycle Approach — Effective risk management for AI/ML systems requires controls at each stage of the development lifecycle, from data preparation to continuous monitoring.
- Specialized Controls — Traditional software development controls are insufficient for AI/ML systems; new controls are needed to address unique risks such as model drift, data quality issues, and hardware dependencies.
- Continuous Monitoring — Ongoing surveillance of AI/ML systems in production is crucial for detecting issues like model drift, data anomalies, or outputs beyond expected thresholds.
- Pages
- 22
- Topics
- AI · Audit & Security
- Formats
- epub · pdf
- License
- Creative Commons BY-NC-SA
