CRISC Certified in Risk and Information Systems ControlIT Risk AssessmentHard
A financial institution is evaluating the risk of a new AI-driven fraud detection system. The system's decisions are highly complex and opaque ('black box' nature), making it difficult to understand why certain transactions are flagged as fraudulent. This characteristic primarily contributes to which type of IT risk?
- APerformance risk
- BModel risk
- CAvailability risk
- DRegulatory compliance risk
Show answer & explanationAnswer & explanation
Correct answer: B. Model risk
The 'black box' nature and difficulty in understanding decisions are hallmarks of 'model risk' within AI/ML systems. This risk arises from the potential for incorrect or suboptimal decisions due to model errors, inherent biases, or a lack of transparency, leading to adverse outcomes.
Why the other options are wrong
- A. Performance risk relates to the system not meeting its operational speed or efficiency requirements, not its decision-making transparency.
- C. Availability risk concerns the system being inaccessible when needed, which is not directly addressed by the system's decision-making opacity.
- D. While regulatory compliance risk can stem from opaque AI systems, the core issue described (difficulty understanding decisions) directly points to the inherent 'model risk' before considering external regulations.
Model Risk (AI/ML)
The risk of adverse consequences resulting from decisions based on incorrect, misused, or opaque model outputs, especially in AI and machine learning systems.
- Arises from model errors, data flaws, or misinterpretation.
- Increased by 'black box' models lacking explainability.
- Can lead to financial, reputational, and operational losses.
Memory trick: AI Risks: Models Make Mistakes, Bias Builds, Data Defaults, Ethics Errs.