A housing authority AI inventory omits shadow GenAI tools caseworkers use on personal devices. What completeness issue should audit raise?
Select an answer to reveal the explanation.
Short Explanation
If caseworkers are pasting files into mystery chat apps on personal phones, that’s still on the map. An inventory that only lists the blessed SaaS is missing the leaky side doors.
Full Explanation
An AI inventory that omits shadow GenAI tools caseworkers use on personal devices presents program coverage gaps that leave unapproved AI tools outside inventory and oversight. Shadow use can exfiltrate resident case data to consumer services lacking county agreements, retention rules, or logging. Completeness of inventory is a prerequisite for risk assessment, acceptable-use enforcement, training, and technical blocking controls. Tools that never appear on the list also never receive model-risk or privacy review.
Timestamp lags in quarterly attestations for approved models already in registry are a reporting timeliness issue, not the completeness failure of leaving unapproved personal-device GenAI tools out of the inventory entirely. Official SaaS spend reports miss free apps and personal-account tools caseworkers actually use in the field. Data quality errors in existing registry entries for approved eligibility models are an accuracy problem, not the completeness gap caused by omitting unapproved shadow tools from personal devices.
Exam caveat: inventories must cover sanctioned and unsanctioned AI touching civic data, not only procured platforms on the invoice register. Operational check: run discovery via surveys, CASB/DLP, and help-desk tickets; add shadow tools to a risk register; provide approved alternatives; and set enforcement for high-risk personal-device use involving case data, with training that names prohibited paste-in behaviors.