A water utility AI PMO tracks projects but not residual risk acceptance by executives. What linkage should audit seek?
Select an answer to reveal the explanation.
Short Explanation
Milestone summaries tied to oversight committee reviews aren't the same as a signed "we accept this leftover risk." You need executives to own residual AI risk on the record, not delivery-team risk registers or vendor attestation reports.
Full Explanation
A water utility AI PMO that tracks projects but not residual risk acceptance by executives lacks the linkage audit should seek: documented executive residual risk acceptance connected to AI program oversight. Project milestone summaries linked to AI program oversight committee reviews can coexist with unaccepted privacy, safety, cybersecurity, or reliability residual risk. Executives—not delivery-team risk registers or vendor attestation reports—must accept residual risk within appetite and record that acceptance so accountability is clear when plant or customer impacts occur.
Milestone summaries tied to oversight committee reviews that omit risk acceptance hide the management decision that matters for governance and ratepayer trust. Project-level risk registers maintained by delivery teams are not formal executive acceptance and cannot be evidenced as such later. Vendor attestation reports cannot accept the utility’s residual risk on the city’s behalf; third-party control operation is not the same as risk appetite decisions.
Exam caveat: risk acceptance is a management control distinct from project milestone summaries linked to oversight reviews, delivery-team risk registers, and vendor attestation reports. Operational check: require signed residual-risk registers for in-flight AI systems, tie acceptance to steering or executive forums with dates and owners, and sample whether accepted risks have compensating monitors and review dates.