An audit of the use-case inventory for a pilot deployment turns up an entry that lists the model type and risk score but no documented purpose. What does this finding mean?
Select an answer to reveal the explanation.
Short Explanation
Risk score without stated purpose is just number without context that tells you whether it's even right number. You need purpose captured with model type and risk, or intake's incomplete.
Full Explanation
The finding means intake was incomplete: purpose is one of the fields that must be captured alongside model type and risk, and its absence weakens the risk score itself. Purpose is not optional metadata; it is one of the facts an assessor needs to judge whether the recorded risk level is even plausible for what the system is meant to do. The claim that nothing is significant because purpose can always be inferred later from how the model is used in production is wrong because inferring purpose after the fact from observed behaviour is unreliable and defeats the point of documenting intent up front. The claim that the entry is fine because risk scoring does not depend on knowing why the model exists is wrong because risk assessment is directly shaped by intended purpose - the same model used for two different purposes can carry two very different risk levels. The claim that the inventory tool malfunctioned because purpose fields are generated automatically is wrong because purpose fields are populated by the people registering the use case, not generated automatically. For the exam, treat a missing purpose field as an incomplete intake, not a cosmetic gap.