Risk acceptances for a 311 chatbot are signed only by IT, not by the resident-services business owner. What should audit conclude?
Select an answer to reveal the explanation.
Short Explanation
IT can run the servers, but resident services owns the promise to the public. If only IT signs off on chatbot residual risk, the wrong captain just accepted the storm. Bring the business owner into the acceptance.
Full Explanation
Audit should conclude that AI-related residual risk acceptance lacks appropriate business ownership for the civic service. Risk acceptances for a 311 chatbot signed only by IT leave the resident-services owner—who owns outcomes, complaints, and service levels—outside the acceptance chain. Municipal AI residual risk for resident-facing channels should be accepted by the business accountable for the service, with IT advising on technical controls, not substituting as sole signer.
Claiming IT change approval records constitute business acceptance of residual AI risk fails because change approvals document technical deployment, not the business owner's acknowledgment of civic risk. Claiming vendor model documentation satisfies municipal acceptance for the resident-services use case fails because third-party model cards don't transfer the resident-services owner's accountability for how the chatbot affects residents. Claiming IT operational ownership of the chatbot platform includes accountability for civic service outcomes fails because platform operations are a technical function, while civic outcomes belong to the resident-services business owner.
Exam caveat: a rubber-stamp business signature without readable risk content is not meaningful ownership—acceptance packages must be comprehensible to non-technical owners. Operational check: sample recent 311 AI risk acceptances for resident-services (or equivalent) owner signatures, dated residual-risk statements, and evidence IT was not the sole approving party.