A county risk committee compares inherent risk to residual risk after adding moderation and RAG ACL controls on a benefits assistant. What evaluation are they performing?
Select an answer to reveal the explanation.
Short Explanation
Inherent versus residual is how you see whether moderation and RAG ACLs actually moved the needle. That is risk treatment evaluation—not seal colors, zero-risk fantasies, or prompt-template catalogs.
Full Explanation
Comparing inherent risk to residual risk after adding moderation and RAG ACL controls is risk treatment evaluation: measuring how layered GenAI defenses change the risk posture of a benefits assistant. Inherent risk reflects exposure before those treatments (for example, unfiltered outputs or over-broad retrieval). Residual risk is what remains afterward. The county risk committee uses that delta—and whether residual risk sits within appetite—to decide acceptance, further treatment, transfer, or avoidance. That evaluation is core strategic AI risk management, not a cosmetic exercise.
Selecting a new city seal color based on chatbot sentiment is unrelated branding and does not measure control effectiveness. Asserting that residual risk always equals zero after any single control is a false claim; layered controls reduce likelihood or impact but rarely eliminate GenAI residual risk entirely. Replacing the risk register with a list of popular prompt templates discards structured risk evaluation in favor of content tips that do not track owners, ratings, or treatments.
Exam caveat: residual risk can remain material even after good moderation and ACLs; treatment evaluation is about honest measurement and decision-making, not guaranteed zero. A single control rarely collapses inherent risk to nothing. Operational check: document inherent versus residual ratings for the benefits assistant before and after moderation and RAG ACLs, record the committee’s acceptance decision, and list any further treatment actions with owners and due dates.