Digital ERM, AI and the Future Risk Landscape

Introduction

Enterprise risk management (ERM) is undergoing a structural transformation. Traditional ERM relied heavily on periodic reporting, expert judgment, historical data, and manually assembled risk registers. Digital technologies now permit continuous data collection, automated control testing, real-time scenario analysis, machine-learning prediction, and integrated views of financial and non-financial risk. At the same time, digitisation creates new vulnerabilities: cyber dependence, data-quality failures, opaque algorithms, model errors, concentration in technology providers, and rapid contagion through interconnected markets and platforms.

The central managerial challenge is therefore not simply to acquire a sophisticated risk platform or deploy artificial intelligence (AI). It is to design a risk operating model in which technology improves decision quality without weakening accountability, professional judgment, resilience, ethics, or regulatory compliance. Digital ERM should be understood as a sociotechnical system: people, processes, data, models, technology, incentives, and governance interact to produce risk decisions.

This chapter evaluates digital ERM platforms, automation, real-time analytics, responsible AI, algorithmic and model risk, and the emerging risk landscape. It also considers climate, environmental, social and governance (ESG), geopolitical, systemic, and technology risks through contemporary applications and horizon-scanning methods.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain how digital technologies change the design and operation of ERM.
2. Evaluate risk platforms, data architectures, automation, and real-time analytics.
3. Distinguish ordinary model risk from algorithmic, AI, cyber, and third-party technology risk.
4. Design governance principles for responsible AI and automated decision-making.
5. Assess climate, ESG, geopolitical, systemic, and other emerging risks.
6. Apply horizon scanning, scenario analysis, and risk appetite concepts to contemporary cases.
7. Critically evaluate the limitations of technology-led risk management.

1. From Periodic ERM to Digital ERM

Traditional ERM commonly followed a reporting cycle: risks were identified, assessed, assigned owners, monitored through key risk indicators (KRIs), and reported to senior management or the board. This approach remains valuable, but periodic processes can be too slow when risks develop within minutes or hours. A cyberattack, liquidity run, social-media event, cloud outage, or sanctions announcement may materially change an organisation’s risk profile before the next monthly committee meeting.

Digital ERM adds five capabilities:

• Integration: financial, operational, cyber, compliance, supply-chain, sustainability, and external data can be connected.
• Velocity: data can be ingested and analysed continuously or at shorter intervals.
• Automation: routine collection, reconciliation, alerting, workflow, and control testing can be automated.
• Prediction: statistical and machine-learning models can identify patterns and estimate future exposures.
• Traceability: digital records can preserve data lineage, decisions, approvals, overrides, and model versions.

Digital ERM does not eliminate uncertainty. It changes the form of uncertainty. More data may reveal previously invisible exposures, but it may also increase false alarms, create dependence on questionable proxies, and encourage overconfidence in precise-looking outputs.

A useful conceptual relationship is:

This is not a calculable production function in the strict economic sense; it expresses a management principle. Weakness in any major component can undermine the system. A powerful model cannot compensate for incomplete data, poorly defined risk appetite, or unclear accountability.

2. Digital Risk Platforms and Architecture

A digital risk platform typically connects data sources, analytical engines, workflow tools, control libraries, reporting interfaces, and governance records. Architectures differ, but a mature platform usually contains the following layers:

The platform should be selected according to the organisation’s risk architecture rather than purchased as a collection of fashionable features. Important evaluation criteria include:

1. Functional fit: Does the platform support the organisation’s material risk categories and risk taxonomy?
2. Interoperability: Can it connect securely to existing finance, operations, identity, security, and reporting systems?
3. Data lineage: Can users identify the origin, transformation, owner, and date of each material data item?
4. Configurability: Can policies and thresholds be changed without uncontrolled code modifications?
5. Resilience: Can the organisation operate during outages, degraded connectivity, or cyber incidents?
6. Auditability: Are decisions, overrides, approvals, and model versions recorded?
7. Security and privacy: Are access, encryption, retention, and jurisdictional requirements satisfied?
8. Third-party dependence: What happens if the vendor fails, changes pricing, withdraws functionality, or suffers a breach?

A dashboard is not a risk management system merely because it contains charts. Effective platforms connect measurement to action. A KRI should have a defined owner, threshold logic, escalation path, response time, and documented treatment. Otherwise, digital reporting can become “monitoring theatre”: highly visible information that does not change decisions.

3. Automation and Real-Time Analytics

Automation is most appropriate when tasks are repetitive, rules are stable, inputs are reliable, and exceptions can be escalated. Suitable examples include sanctions screening, reconciliation, access reviews, control attestations, policy reminders, limit monitoring, and notification of unusual transactions. Automation is less suitable when the decision depends on contested values, novel circumstances, incomplete information, or significant human consequences.

A practical automation classification is:

• Automated execution: a system performs a predefined action, such as blocking a transaction above a limit.
• Automated recommendation: a system proposes an action, while an authorised employee decides.
• Automated prioritisation: a system ranks cases for investigation.
• Human-in-the-loop: human review is mandatory before a consequential action.
• Human-on-the-loop: humans supervise a system that acts automatically and intervene when necessary.

The distinction matters because responsibility must not disappear into a workflow. Every automated control needs an accountable owner, documented logic, exception handling, performance monitoring, and a fallback process.

Risk indicators and alert design

A KRI may be expressed as a ratio, count, rate, or index. For example, a control failure rate can be calculated as:

where F is the number of failed control tests during a defined period and N is the number of tests performed. The result is dimensionless, although it is often reported as a percentage by multiplying by 100. The measure is meaningful only when the testing population is defined consistently and failures are recorded comparably over time.

If a business performs 480 control tests and 12 fail, the failure rate is 12 ÷ 480 = 0.025, or 2.5%. This does not automatically mean risk is low: one severe failure may matter more than eleven minor failures. Consequently, dashboards should combine frequency with severity, exposure, velocity, and control effectiveness.

Real-time analytics introduces a trade-off between speed and stability. A threshold set too low produces alert fatigue; a threshold set too high delays intervention. Thresholds should be calibrated using historical performance, scenario analysis, risk appetite, and the cost of false positives and false negatives. They should also be reviewed after structural changes, because historical relationships may no longer apply.

4. Data Governance as the Foundation of Digital ERM

Data is a risk-management asset only when it is fit for purpose. Key dimensions include:

• Accuracy: values represent the underlying phenomenon.
• Completeness: material fields and populations are not missing.
• Timeliness: data arrives early enough to support the decision.
• Consistency: definitions and formats are stable across systems.
• Validity: values conform to permitted ranges and rules.
• Uniqueness: records are not improperly duplicated.
• Provenance: origin and transformations are known.

Data governance assigns ownership and establishes rules for collection, access, classification, retention, quality testing, and correction. It should distinguish source data from derived data and preserve transformation logic. Data lineage is especially important in regulatory reporting and AI, where an apparently reasonable output may depend on an undocumented transformation or a biased sample.

The principle of “garbage in, garbage out” is incomplete. High-quality data can still generate harmful outcomes if the target variable is poorly defined, the sample is unrepresentative, or the decision rule embeds an inappropriate objective. Thus, data governance and model governance must be connected.

5. AI, Algorithmic Risk, and Model Risk

A model is a simplified representation used to classify, forecast, estimate, optimise, or simulate. Model risk is the possibility of adverse consequences from errors in model design, data, implementation, use, or interpretation. AI systems create additional concerns because they may be adaptive, probabilistic, difficult to explain, dependent on complex data pipelines, or based on third-party foundation models.

Important categories include:

• Specification risk: the model addresses the wrong question or uses an unsuitable target.
• Data risk: training or input data is biased, incomplete, stale, manipulated, or unlawfully obtained.
• Implementation risk: production code differs from the approved design.
• Performance risk: predictive accuracy deteriorates or the model performs poorly for certain groups or conditions.
• Drift risk: relationships between inputs and outcomes change over time.
• Use risk: users apply outputs outside the model’s validated purpose.
• Explainability risk: affected users cannot understand or challenge a consequential result.
• Adversarial risk: inputs are deliberately manipulated to influence outputs.
• Concentration risk: many critical decisions depend on one vendor, model, cloud, or data provider.

Model lifecycle governance

A robust lifecycle includes:

1. Inventory: identify all material models, including spreadsheets, vendor tools, and embedded algorithms.
2. Classification: rate models by materiality, consequence, complexity, autonomy, and affected population.
3. Design documentation: define purpose, population, variables, assumptions, limitations, and prohibited uses.
4. Independent validation: test conceptual soundness, data, implementation, outcomes, and sensitivity.
5. Approval: obtain authority proportionate to risk before deployment.
6. Monitoring: track accuracy, stability, drift, overrides, complaints, and disparate outcomes.
7. Change control: revalidate material changes and record version history.
8. Retirement: remove obsolete models and preserve necessary records.

Validation is not a single accuracy score. For a binary classifier, a confusion matrix distinguishes true positives, false positives, true negatives, and false negatives. Precision is:

Recall is:

Here, TP means true positives, FP false positives, and FN false negatives. Precision answers, “Among cases classified positive, how many were actually positive?” Recall answers, “Among actual positive cases, how many were identified?” Both are unitless proportions. Their usefulness depends on the decision context and the relative cost of errors. A fraud system may require high recall, while an investigation team with limited capacity may require high precision.

No fairness metric is universally correct. Measures such as demographic parity, equal opportunity, and calibration may conflict when base rates differ. Governance must therefore define the relevant harm, legal obligations, affected stakeholders, and acceptable trade-offs rather than treating fairness as a single technical score.

6. Responsible AI and Accountability

Responsible AI translates ethical principles into operational controls. Common principles include legality, fairness, transparency, explainability, privacy, security, safety, human oversight, contestability, and accountability. Principles become credible only when linked to ownership, evidence, and consequences.

A responsible-AI control framework should address:

• Purpose limitation: use the system only for a documented and legitimate purpose.
• Necessity and proportionality: do not use highly intrusive or autonomous methods when a lower-risk method is adequate.
• Human accountability: name the decision owner; “the algorithm decided” is not an adequate governance explanation.
• Impact assessment: evaluate affected groups, foreseeable harms, and possible misuse before deployment.
• Transparency: communicate the existence, role, principal factors, and limitations of the system where appropriate.
• Challenge and remedy: provide routes for correction, appeal, and human review.
• Security: protect models, prompts, data, credentials, and interfaces against attack.
• Monitoring: examine performance and harm after deployment, not merely during testing.

Generative AI creates specific risks: fabricated outputs, leakage of confidential information, copyright disputes, prompt injection, unreliable summaries, and automation bias. Appropriate controls include approved use cases, restricted data environments, retrieval and citation controls, output verification, logging, red teaming, and a prohibition on treating generated text as authoritative without review.

7. Climate, ESG, and Nature-Related Risk

Climate risk has both physical and transition dimensions. Physical risk arises from events such as floods, heat, storms, drought, and sea-level rise. Transition risk arises from changes in policy, technology, consumer preferences, litigation, energy systems, and asset values during decarbonisation. These risks can affect credit, market, liquidity, operational, insurance, legal, and strategic risk simultaneously.

Scenario analysis is more appropriate than a single forecast because climate outcomes depend on uncertain physical, economic, technological, and policy pathways. A simplified exposure calculation is:

where PD is probability of default, LGD is loss given default as a proportion of exposure, and EAD is exposure at default in currency units. The result is a currency amount. The relationship is a simplified credit-risk representation and assumes the inputs are appropriately defined; it does not capture all dependence, timing, optionality, or scenario uncertainty.

Suppose a portfolio has an exposure of $20 million, a scenario probability of default of 4%, and loss given default of 45%. Expected loss is:

0.04 × 0.45 × $20,000,000 = $360,000.

In climate analysis, these inputs may vary across pathways and time horizons. A scenario is not a prediction, and expected loss should not be interpreted as a precise reserve unless the relevant accounting and risk-measurement framework permits that use.

ESG risk requires conceptual discipline. ESG ratings may disagree because providers use different definitions, weights, data, and materiality assumptions. Organisations should distinguish:

• the organisation’s impact on society and the environment;
• the effect of ESG factors on enterprise value; and
• compliance with disclosure, conduct, and stakeholder obligations.

Greenwashing is a governance risk when claims exceed evidence. Controls should require clear definitions, traceable metrics, documented methodology, independent review, and consistency between public claims, capital allocation, incentives, and operational performance. Nature-related dependencies, water stress, biodiversity loss, and ecosystem degradation increasingly matter because they can disrupt supply, insurance, production, and community relationships.

8. Geopolitical, Systemic, and Technology Risks

Geopolitical risk includes interstate conflict, sanctions, trade restrictions, political instability, elections, resource nationalism, and diplomatic deterioration. Digital ERM should connect external intelligence to legal entities, suppliers, customers, assets, jurisdictions, and financial exposures. Static country-risk scores are insufficient when events move rapidly or when indirect dependencies are hidden.

Systemic risk concerns the possibility that distress spreads through interconnected institutions, markets, infrastructures, or behaviours. Digital systems may amplify systemic risk by increasing speed, common exposures, algorithmic similarity, and dependence on shared providers. Examples include cloud concentration, common data vendors, payment infrastructure, index strategies, and correlated automated trading responses.

Technology concentration risk deserves separate attention. An organisation may diversify suppliers while remaining dependent on one cloud region, identity provider, model provider, or telecommunications network. Resilience testing should consider correlated outages rather than only isolated vendor failure. Important measures include exit plans, data portability, alternate processing, contractual audit rights, service-level requirements, recovery objectives, and tested manual workarounds.

Cyber risk should be integrated with enterprise risk rather than treated solely as an information-technology issue. A cyber event can create operational interruption, fraud, regulatory breach, litigation, liquidity pressure, safety consequences, and reputational damage. Risk assessment should therefore map attack paths to business services and financial consequences.

9. Horizon Scanning and Emerging-Risk Governance

Horizon scanning is a structured process for detecting weak signals, interpreting change, and deciding whether emerging issues require action. It should not become an unprioritised list of alarming headlines.

A practical scanning cycle is:

1. Scan: monitor regulatory, technological, scientific, social, economic, environmental, and geopolitical developments.
2. Cluster: group signals into themes and identify common drivers.
3. Interpret: assess plausible mechanisms, time horizons, affected objectives, and uncertainty.
4. Prioritise: compare potential impact, velocity, persistence, preparedness, and interdependence.
5. Stress: develop scenarios, reverse stress tests, and trigger indicators.
6. Decide: assign owners, treatments, investment, or explicit acceptance.
7. Review: update assumptions as evidence changes.

The risk matrix remains useful for communication but has limitations. Multiplying likelihood by impact implies a precision that may not exist and can conceal low-probability catastrophic risks. A richer assessment records uncertainty, velocity, interconnectedness, reversibility, and early-warning indicators.

Reverse stress testing begins with an unacceptable outcome and asks what combination of events could produce it. For example: “What could cause the organisation to breach its liquidity risk appetite within five business days?” This method can reveal dependencies not identified through ordinary risk registers.

10. Applied Case: Cloud Dependency and AI Credit Triage

Background

The following is an illustrative case. Meridian Commercial Bank uses a cloud-hosted platform to process small-business credit applications. An AI model assigns applications to automatic approval, manual review, or rejection. The bank also uses the same cloud provider for customer identity, document storage, and risk dashboards.

Problem

The model initially reduces processing time and produces acceptable aggregate accuracy. After an economic slowdown, however, repayment patterns change. Approval rates for businesses in several regions fall sharply, while the cloud provider experiences intermittent identity-service outages. Staff discover that model overrides are not consistently recorded and that a third-party data field is unavailable for some applicants.

The bank faces linked risks: model drift, possible unfair outcomes, operational interruption, data-quality weakness, third-party concentration, regulatory scrutiny, and credit deterioration.

Analysis

The first error would be to treat the issue as only a model-performance problem. The risk is a system problem involving data, infrastructure, processes, and governance. The bank should examine:

• whether the target variable remains valid under changed economic conditions;
• changes in precision, recall, calibration, and outcomes across relevant groups;
• the effect of missing data and imputation;
• whether approval thresholds remain consistent with risk appetite;
• the business services affected by cloud outages;
• the ability to process applications manually;
• whether customers can challenge decisions;
• whether contractual rights permit audit, portability, and incident access.

Approach and solution

Meridian establishes a temporary human review requirement for borderline and high-impact decisions. It freezes unapproved model changes, reconstructs data lineage, and validates the model using recent and stress-period data. It creates a model inventory and assigns a senior accountable owner. Monitoring includes drift indicators, override rates, error rates, complaint trends, and group-level outcomes.

For cloud resilience, the bank maps critical services, defines recovery time and recovery point objectives, tests a manual intake process, stores essential data in a portable format, and develops an alternate identity-verification route. The board risk committee receives a combined report rather than separate model, cyber, and operational reports.

Outcome

The bank identifies that aggregate accuracy had concealed deterioration for a particular segment and that a missing vendor field had affected the routing of applications. The revised process slightly increases operating cost but reduces unreviewed adverse decisions and improves continuity during outages. Management also discovers that its original risk appetite addressed credit losses but did not specify tolerance for automated decision error, customer redress time, or critical-service downtime.

Learning points

1. Model performance must be monitored after deployment and across relevant populations.
2. Digital concentration can turn a local vendor problem into an enterprise-wide event.
3. Human review is meaningful only when reviewers have authority, information, and time.
4. Risk appetite should include technology, customer, data, and algorithmic outcomes.
5. Integrated reporting is necessary when one event crosses several risk categories.

11. Implementing Digital ERM: A Management Road Map

A credible implementation can proceed in stages:

Stage 1: Establish the target operating model. Define risk taxonomy, decision rights, risk appetite, materiality, escalation, and the relationship between first-line ownership, risk oversight, and internal audit.

Stage 2: Map critical services and dependencies. Identify processes, systems, data, vendors, algorithms, people, and jurisdictions supporting important outcomes.

Stage 3: Improve data foundations. Assign data owners, standardise definitions, implement lineage, correct high-impact quality problems, and control access.

Stage 4: Prioritise use cases. Begin with problems where better information or automation has a clear benefit and manageable harm. Avoid deploying AI merely because it is available.

Stage 5: Build lifecycle governance. Establish inventories, validation standards, approval committees, monitoring, incident processes, change control, and retirement procedures.

Stage 6: Test resilience and human capability. Conduct outages, cyber exercises, model-failure simulations, scenario analysis, and manual fallback tests. Train managers to challenge outputs rather than accept dashboards passively.

Stage 7: Measure outcomes. Evaluate loss reduction, response time, control effectiveness, false-alert burden, customer outcomes, resilience, and cost. A successful programme improves decisions, not simply the number of automated processes.

12. Challenges and Limitations

Digital ERM can fail in several ways. First, automation bias may cause employees to defer to a system even when evidence conflicts with its output. Second, excessive dashboards can create attention scarcity and obscure the few indicators that matter. Third, historical data may reproduce past discrimination or fail to represent future conditions. Fourth, sophisticated systems can produce false confidence because numerical precision is mistaken for knowledge.

Fifth, integration increases blast radius: a common data model or platform may make information available efficiently but allow one error to propagate widely. Sixth, vendor claims may be difficult to verify, particularly for proprietary AI models. Seventh, privacy and surveillance concerns can damage trust and create legal exposure. Finally, risk cannot be fully digitised. Strategic judgment, ethical reasoning, political interpretation, and accountability remain human and institutional responsibilities.

The appropriate response is not to reject technology but to use proportionality. High-impact, irreversible, or rights-affecting decisions require stronger validation, transparency, human oversight, and avenues for remedy than low-impact administrative automation.

Contemporary Best Practices

• Maintain a single, risk-based inventory of models, algorithms, critical vendors, and data assets.
• Link every material alert to an owner, action, deadline, and escalation rule.
• Separate model development, approval, use, and independent assurance.
• Test performance under stress and structural change, not only on average historical data.
• Monitor outcomes by material segment and investigate unexplained differences.
• Preserve data lineage, model versions, prompts or inputs where relevant, and decision logs.
• Include manual fallback and recovery testing in technology resilience programmes.
• Treat climate, cyber, geopolitical, and third-party risks as interconnected.
• Use scenario analysis and reverse stress testing for uncertain, nonlinear risks.
• Give boards concise information about assumptions, uncertainty, concentration, and decisions required.
• Ensure people affected by consequential automated decisions can obtain explanation, review, and correction where appropriate.

Chapter Summary

Digital ERM extends traditional risk management through integrated data, automation, real-time analytics, predictive models, and traceable workflows. Its value depends on data quality, model validity, process integration, governance, and human judgment. Risk platforms should be evaluated for functionality, interoperability, resilience, auditability, security, and third-party concentration rather than visual sophistication alone.

Automation is most reliable for stable, repetitive, rule-based activities, but consequential decisions require clear accountability, exception handling, human oversight, and fallback arrangements. AI introduces model, data, drift, explainability, adversarial, fairness, and concentration risks. Responsible AI therefore requires purpose limitation, impact assessment, transparency, monitoring, security, contestability, and accountable ownership.

Climate and ESG risks affect multiple traditional risk categories and should be assessed through scenarios rather than simplistic forecasts or ratings. Geopolitical, systemic, cyber, and technology concentration risks demonstrate how interconnected exposures can propagate rapidly. Horizon scanning, reverse stress testing, service mapping, and integrated risk reporting help organisations prepare for uncertain and emerging threats. The future of ERM is not a choice between humans and machines; it is the disciplined design of institutions in which digital tools improve, rather than replace, responsible judgment.

Key Terms

Digital ERM: The use of integrated digital data, technology, analytics, and governance to manage enterprise risk.

Risk platform: A technology environment that connects risk data, analytics, workflows, reporting, and governance records.

Real-time analytics: Analysis performed continuously or at sufficiently short intervals to support rapid decisions.

Key risk indicator (KRI): A measure used to monitor exposure, control conditions, or movement toward a risk threshold.

Automation bias: The tendency to over-rely on automated outputs.

Data lineage: The documented origin, transformation, movement, and ownership of data.

Model risk: The possibility of adverse consequences from errors in model design, data, implementation, or use.

Algorithmic risk: Risk arising from the design, operation, effects, or misuse of algorithmic decision systems.

Model drift: Deterioration caused by changes in relationships, populations, behaviour, or operating conditions.

Explainability: The ability to communicate how an analytical system produces or supports an outcome.

Responsible AI: The governed development and use of AI consistent with legal, ethical, fairness, safety, and accountability requirements.

Human-in-the-loop: A design in which human review is required before a consequential automated action.

Third-party concentration risk: Risk created by dependence on a common vendor, platform, infrastructure, or service provider.

Physical climate risk: Risk from climate-related physical events and gradual environmental changes.

Transition risk: Risk arising from economic, technological, policy, legal, or behavioural changes associated with transition to a different operating model, including decarbonisation.

Greenwashing: Misleading or unsupported environmental or sustainability claims.

Systemic risk: Risk that distress spreads through interconnected institutions, markets, infrastructures, or behaviours.

Horizon scanning: Structured monitoring and interpretation of emerging developments and weak signals.

Reverse stress test: Analysis that begins with an unacceptable outcome and identifies events or conditions that could cause it.

Review Questions

Short Answer Questions

1. What distinguishes digital ERM from a traditional periodic ERM process?
2. Why is data lineage important in AI-enabled risk management?
3. Define model drift and give one example of its cause.
4. What is the difference between physical climate risk and transition risk?
5. Why should a risk dashboard connect indicators to owners and escalation actions?

Long Answer Questions

1. Critically evaluate the criteria an organisation should use when selecting a digital risk platform.
2. Explain the principal stages of an effective AI and model-risk governance lifecycle.
3. Discuss how responsible AI principles can be translated into operational controls.
4. Analyse the benefits and limitations of real-time analytics in enterprise risk management.
5. Explain why cyber, cloud, geopolitical, and systemic risks should be assessed as interconnected exposures.

Analytical / Application Questions

1. A bank’s automated fraud system identifies 900 true positive cases, 100 false positive cases, and 100 false negative cases. Calculate precision and recall, and explain which metric would matter more if missed fraud were substantially more costly than unnecessary investigations.
2. Design a horizon-scanning process for a multinational manufacturer exposed to supply-chain disruption, climate events, sanctions, and AI-enabled cyberattacks. Specify signals, owners, scenarios, triggers, and escalation routes.
3. Using the Meridian Commercial Bank case, prepare a board-level action plan that balances model performance, customer fairness, cloud resilience, regulatory accountability, and operating cost.

Multiple Choice Questions with Answers

Question 1

Which feature most clearly distinguishes digital ERM from a traditional periodic ERM process?

A. It eliminates the need for risk owners.

B. It enables integrated and more continuous monitoring of risk exposures.

C. It replaces all qualitative judgment with quantitative models.

D. It guarantees that future losses can be predicted accurately.

Correct Answer: B. It enables integrated and more continuous monitoring of risk exposures.

Question 2

A control-testing programme records 12 failures from 480 tests. What is the failure rate?

A. 0.25%

B. 2.5%

C. 4.0%

D. 25.0%

Correct Answer: B. 2.5%

Question 3

Which activity is generally most suitable for rule-based automation?

A. Resolving an unprecedented ethical dilemma

B. Determining an organisation’s strategic risk appetite

C. Reconciling records and escalating exceptions

D. Replacing board judgment during a crisis

Correct Answer: C. Reconciling records and escalating exceptions

Question 4

In model governance, what does model drift refer to?

A. Unauthorised access to a model’s source code

B. A change in conditions that causes model performance or relationships to deteriorate

C. The deliberate deletion of model documentation

D. The process of transferring a model to another vendor

Correct Answer: B. A change in conditions that causes model performance or relationships to deteriorate

Question 5

Which statement best describes responsible AI governance?

A. It requires that every AI model be perfectly interpretable.

B. It focuses only on improving predictive accuracy.

C. It combines accountability, fairness, security, transparency, oversight, and avenues for remedy.

D. It permits automated decisions whenever a model has been purchased from a reputable vendor.

Correct Answer: C. It combines accountability, fairness, security, transparency, oversight, and avenues for remedy.

Question 6

If probability of default is 4%, loss given default is 45%, and exposure at default is $20 million, what is simplified expected loss?

A. $36,000

B. $360,000

C. $900,000

D. $9,000,000

Correct Answer: B. $360,000

Question 7

Which statement about climate scenario analysis is correct?

A. A scenario is necessarily a precise forecast.

B. Scenario analysis can explore alternative pathways under uncertainty.

C. Scenario analysis applies only to physical risks.

D. Scenario analysis removes the need for management judgment.

Correct Answer: B. Scenario analysis can explore alternative pathways under uncertainty.

Question 8

What is the primary purpose of a reverse stress test?

A. To calculate the average historical return of an asset.

B. To begin with an unacceptable outcome and identify conditions that could produce it.

C. To replace all routine control testing.

D. To rank vendors according to price alone.

Correct Answer: B. To begin with an unacceptable outcome and identify conditions that could produce it.

Question 9

Which is an example of technology concentration risk?

A. Using multiple independent recovery procedures

B. Dependence on one cloud provider for identity, storage, and critical processing

C. Maintaining a documented manual fallback process

D. Separating model development from model approval

Correct Answer: B. Dependence on one cloud provider for identity, storage, and critical processing

Question 10

Why can a high aggregate model-accuracy score be insufficient for governance?

A. Accuracy scores are always irrelevant.

B. Aggregate performance may conceal poor outcomes for particular segments or changing conditions.

C. High accuracy proves that a model is biased.

D. Accuracy can be measured only for financial models.

Correct Answer: B. Aggregate performance may conceal poor outcomes for particular segments or changing conditions.