A CIO preparing quarterly board reports on AI risk at a publicly traded investment manager wants to structure the presentation to satisfy both the board's fiduciary oversight obligation and the firm's SEC disclosure requirements. Which reporting structure best achieves this dual objective?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Todd Lammle: Board AI risk reporting is like a cockpit instrument panel — it doesn't show engine schematics, but it absolutely shows airspeed, altitude, and warning lights. Option B gives the board exactly that: a risk taxonomy with materiality thresholds and trend arrows they can act on, framed in language that maps to SEC disclosures they're already obligated to understand.
Full explanation below image
Full Explanation
Board-level AI risk reporting must bridge two audiences simultaneously: directors who bear fiduciary responsibility but often lack technical AI literacy, and regulators (via SEC disclosures) who require material risk representation. The solution is a risk taxonomy framework that organizes AI risks into categories the board can govern without needing to understand model architecture.
A well-structured taxonomy covers: (1) Model Risk — performance degradation, data drift, model concentration; (2) Operational Risk — system failures, vendor dependency, cybersecurity exposure of AI pipelines; (3) Regulatory Risk — evolving SEC AI disclosure requirements, CFTC algorithmic trading rules, and international equivalents. Each category should carry a materiality threshold (the level at which the risk requires board action vs. management discretion), a current risk status (green/yellow/red), a trend indicator, and predefined escalation triggers.
Option A (technical dashboard) fails the board by presenting information in a format they cannot govern. F1 scores and hyperparameter tables do not map to fiduciary duties. Comprehensiveness is not the same as usefulness.
Option C (cost and headcount only) creates a reporting gap that regulators would view as a material omission. The SEC's 2023 guidance on AI disclosure obligations under Regulation S-K makes clear that investment firms must disclose material AI-related risks — not just AI-related expenses.
Option D (narrative without metrics) is the most dangerous approach for a publicly traded firm. Qualitative-only board reports on material risk topics expose the firm to inadequate oversight claims in SEC enforcement and shareholder litigation contexts.
CFIA candidates should reference the SEC's 2023 cybersecurity and AI-related disclosure rules, the NACD Director's Handbook on AI Governance, and the FSB's 2023 report on AI in financial services for board governance frameworks.