County ERM wants AI risks visible to executives alongside other enterprise risks. What practice best fits?
Select an answer to reveal the explanation.
Short Explanation
You want executives to see AI risks alongside the county’s other enterprise risks, not tucked away in a developer-only spreadsheet. Integrate them into enterprise risk heatmaps so they can be compared and prioritized with other major risks.
Full Explanation
County ERM that wants AI risks visible to executives alongside other enterprise risks should include them in the enterprise view, not confine them to technical or private channels. Integrate AI risks into enterprise risk heatmaps—not a siloed IT-only list is correct because AI exposures such as bias, outages, data misuse, and model drift can affect county mission delivery, finances, compliance, and reputation. Heatmap integration gives executives comparable visibility and supports prioritization alongside cyber, operational, and financial risks. Tracking AI risks in a technical team spreadsheet reviewed only by developers during system updates fails because it provides no regular executive oversight or enterprise-wide view. Banning any mention of AI in the enterprise risk program fails because it excludes risks from the very process leadership needs for visibility. Reporting AI risks only to a closed chat with no leadership access fails because it prevents enterprise reporting and accountability. Exam caveat: inclusion in an enterprise heatmap does not mean every model experiment is a top-quartile enterprise risk; scoring and thresholds still apply. The goal is to include AI in the enterprise process, not automatically escalate trivial tools. Practical check: confirm county AI risks appear on the enterprise heatmap and executive ERM reporting pack, assign each significant risk an owner and review cadence, and verify that leadership can identify top residual AI risks without relying on an offline developer briefing.