A county folds AI risk into an annual ERM refresh and never updates after major model-drift events. What improvement is most needed?

The improvement most needed is adopting continuous AI risk management that triggers updates after material model drift or performance change. Folding AI risk into a single annual ERM refresh leaves mid-year drift, data-shift, and accuracy degradation invisible to county risk owners. Continuous (or event-triggered) updates keep residual risk, KRIs, and treatments aligned with how the model actually behaves between annual cycles.

Aligning AI risk scoring with the annual audit plan and refreshing ratings during coordinated yearly control testing cycles fails because drift is a primary AI risk driver and can invalidate prior control assumptions long before the next annual testing cycle. Recording model drift metrics in technical dashboards for engineering review outside the ERM workflow fails conceptually: keeping risk visibility out of the ERM workflow means county risk owners never see or own the exposure. Expanding the annual ERM inventory to catalog AI models and document current vendor ownership details fails because it describes an inventory exercise, not risk management; trigger conditions must be risk-relevant (drift alerts, major retrains, data-source changes), not static ownership records.

Exam cavelet: “continuous” does not mean endless busywork—define materiality triggers and owners so updates are event-driven and auditable rather than vaguely perpetual. Operational check: inspect whether drift or performance incidents in the past year produced dated AI risk-register updates; if the register timestamp only matches the annual ERM cycle despite known drift events, the control gap is confirmed.