A county public-health AI triage tool is scheduled for production, but inherent and residual risk were never documented. What should audit insist on before go-live?

Audit should insist on completing an AI risk assessment that documents inherent risk, planned controls, and residual risk acceptance before the public-health triage tool goes live. County triage AI can influence care pathways and urgency routing; leadership must see raw (inherent) risk, which controls will reduce it, and what residual risk accountable owners formally accept. That documentation is a go-live gate, not optional paperwork after residents are already in the queue.

Accepting a vendor model validation report and accuracy metrics as documented evidence of organizational risk acceptance fails because vendors optimize for product narrative, not the county’s risk appetite, population mix, or clinical escalation design. Finalizing clinical workflow integration testing and staff training attestations to authorize production deployment fails because those operational steps do not substitute for documenting inherent risk, planned controls, and residual risk acceptance before go-live. Completing a data privacy review and documenting model explainability testing to satisfy pre-launch assurance fails because privacy and explainability checks, while useful, do not constitute the required AI risk assessment with inherent risk, control mapping, and residual risk acceptance by accountable owners.

Exam caveat: a filled template without named owners, decision thresholds, and clinical escalation paths is not a completed assessment; substance matters more than form completion. Operational check: withhold production promotion until the assessment file shows inherent risk, control mapping, residual risk statement, and dated acceptance by the public-health business owner—not only IT.