A transit AI threshold for delay alerts is tuned live by an engineer without a rollback plan. What should the auditor recommend?
Select an answer to reveal the explanation.
Short Explanation
Live-tuning alert thresholds without a rollback plan is tightening bolts on a moving bus. Write the change down and know how to undo it. Daily alert sampling after deployment isn't a rollback plan.
Full Explanation
Requiring documented change procedures and rollback plans for transit AI delay-alert threshold changes works because parameter edits can flood riders with noise or suppress genuine delay warnings. Live tuning by a single engineer without a written change and undo path creates unstable civic alerting and tribal knowledge recovery. Documented procedures specify who may change thresholds, what tests precede promotion, how effects are monitored, and how to revert to the prior known-good values. The correct recommendation extends change and rollback discipline to AI operational parameters, not only code or hardware.
Requiring engineering lead approval for threshold tuning and monitoring alert accuracy after changes fails because lead sign-off and post-change monitoring still provide no written change procedure or recoverable rollback path for the next engineer. Recording threshold values in version control and scheduling periodic reviews of alert performance fails conceptually: versioned records and periodic reviews still lack a predefined, tested rollback procedure that must exist before the next threshold edit. Assigning threshold ownership to operations and validating changes through daily post-deployment alert sampling checks fails because operational ownership and daily sampling are not durable change control and provide no predefined way to revert to known-good values.
Exam caveat: rollback plans that revert thresholds without also considering coupled configs (related routes, time-of-day profiles) can restore the wrong operating point—rollback scope must match how parameters are packaged. Operational check: store threshold values in versioned config, require change tickets for edits, rehearse rollback to the previous version in a non-production alert sandbox, and confirm monitoring detects alert-volume spikes after changes.