A municipal threat and vulnerability program catalogs traditional application flaws but ignores model drift as a failure pathway. What should the auditor recommend?

Including AI-specific failure modes such as model drift in municipal threat and vulnerability management emphasizes that civic AI degrades when data or environments shift even without classic CVEs. The correct recommendation works because a model that was acceptable at deployment can silently worsen on new populations, sensors, or seasonal patterns; treating that pathway as out of scope leaves cities blind to a primary AI operational risk. Drift, data shift, and related degradation belong in the same program that tracks other vulnerabilities.

Classifying model drift as a data quality ticket for the analytics team for quarterly review fails because drift is an operational AI failure mode needing continuous ownership, thresholds, and remediation inside the municipal threat and vulnerability program, not a quarterly analytics ticket. Tracking CVEs for municipal application dependencies in the existing vulnerability register for prioritization fails conceptually: dependency CVE tracking does not detect model performance decay or data shift on municipal AI workloads. Documenting model accuracy at procurement and referencing vendor SOC 2 reports for ongoing assurance fails because point-in-time accuracy and vendor attestations do not observe live predictive quality or data shift in production.

Exam caveat: metric drift alerts without defined owners and rollback criteria become ignored noise. Operational check: register AI systems in the municipal threat/vulnerability inventory, define drift metrics and thresholds, assign owners, and require remediation or human-fallback plans when civic model performance deteriorates.