A water utility treats silent third-party model updates to a SCADA anomaly detector as low risk and skips re-assessment. What is the most appropriate audit response?
Select an answer to reveal the explanation.
Short Explanation
A quiet model swap is still a change — like swapping the brakes without a test drive. When the vendor updates the anomaly detector, re-open the risk assessment before you trust it on plant signals. Frozen paperwork after silent updates is hope, not control.
Full Explanation
The most appropriate audit response is to require risk re-evaluation when AI models or vendor versions change materially before accepting continued production use. Silent third-party updates to a SCADA anomaly detector can alter detection thresholds, feature sensitivity, and false-alarm behavior on plant signals. Municipal water utilities cannot treat a new model version as operationally equivalent without reassessing residual risk, control fitness, and monitoring.
Recording the updated vendor model version in the asset register at a scheduled review while maintaining current production approval fails because it approves continued production use of a materially changed model without a prior risk re-evaluation; updating an asset register is an administrative step and does not reassess residual risk or control fitness on live plant signals.
Relying on a vendor functional test summary for the changed anomaly detector to support continued operational authorization fails because a vendor’s own functional test summary is not an independent risk re-assessment and cannot confirm that detection behavior, thresholds, or false-alarm rates remain acceptable in production.
Retaining the existing risk rating after reviewing vendor release notes confirming stable detection performance in lab conditions fails because lab performance does not equal production risk; a changed model can behave differently on live plant signals and release notes are not a substitute for a documented re-evaluation.
Exam caveat: material must be defined—version bumps, retrains, and threshold changes need clear triggers so vendors cannot redefine silent updates as immaterial by default. Operational check: inspect vendor release notes and change tickets against risk-assessment dates; require a documented re-evaluation (or justified waiver) before any new anomaly-detector version remains in production on live plant data.