A water utility is formalizing AI risk management. Which artifact best captures identified risks?
Select an answer to reveal the explanation.
Short Explanation
Sticky notes don’t run a utility risk program. You want an AI risk register—likelihood, impact, owners, and residual risk after controls.
Full Explanation
A water utility formalizing AI risk management should capture identified risks in an AI risk register with likelihood, impact, owners, and residual risk after controls. A register turns scattered concerns into managed work: each risk is rated, assigned, treated, and tracked to residual level so leadership can see what remains after mitigations. This structure is the operational backbone of civic AI risk management across treatment plants, customer systems, and forecasting tools.
A sticky note that says “AI is risky” on a monitor fails by concept because slogans neither rate nor assign ownership. An unsigned rumor list with no owners or ratings fails because unmanaged lists do not drive treatment or accountability. A vendor brochure filed as the entire risk program fails because marketing literature is not the utility’s risk inventory for its deployment context.
Exam caveat: residual risk must be explicit—controls reduce but rarely eliminate AI risk; accepting residual risk without recording it is incomplete governance. Operational check: stand up the register with mandatory fields (likelihood, impact, owner, controls, residual), review it on a fixed cadence with utility risk and operations leads, and link each high residual item to a treatment decision record.