An internal AI audit team at a bank is evaluating the scope of their AI model audit universe. A business unit argues that their rule-based credit scoring system, which was built by data scientists using statistical analysis, should be excluded because it is 'not really AI.' How should the audit team respond?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — if the system applies statistical, economic, or mathematical techniques to produce quantitative estimates, SR 11-7 treats it as a model, so you keep it in the audit universe. The 'AI' label doesn't decide model risk applicability.
Full Explanation
Apply the SR 11-7 definition of 'model': if the system applies statistical, economic, or mathematical techniques to produce quantitative estimates, it is a model and falls within the model risk management framework regardless of whether it is labeled AI. SR 11-7's broad definition captures any quantitative method that transforms inputs into quantitative estimates, including rule-based scoring systems built through statistical analysis. The 'AI' label is irrelevant to model risk applicability, and the audit team should include the system under model risk oversight. Agreeing to exclude it because rule-based systems are not AI would leave a significant category of quantitative decision tools unmonitored. Including it only if it uses machine learning algorithms, while excluding it if based on regression analysis, is not the regulatory standard. Deferring the classification decision to the technology team and excluding it pending their determination abdicates the audit team's independent classification responsibility.