An organization conducts an AI system risk assessment using a heat map that plots likelihood of harm against severity of harm. An AI model for internal employee scheduling scores 'low likelihood, high severity.' How should this risk be managed?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — when a low-likelihood, high-severity risk shows up, you don't just accept it. You put controls in place that match the severity, like contingency plans and fallback procedures, because a major scheduling failure could leave critical operations unstaffed.
Full Explanation
The correct approach is to implement risk controls proportionate to the high severity, including contingency plans and fallback procedures, even though likelihood is low. A low-likelihood, high-severity risk, sometimes called a tail risk or black swan, cannot simply be accepted without controls; the potential severity justifies control measures even at low probability. For a scheduling model, a major failure could leave critical operations unstaffed. Appropriate controls include fallback manual scheduling procedures, automated alerts, and regular model health checks. Accepting the risk without controls because the low likelihood does not justify the cost of mitigation is inappropriate for high-severity events. Prioritizing this risk ahead of all others regardless of likelihood because severity is the only relevant factor ignores relative risk ranking; other high-likelihood risks may warrant more immediate attention. Transferring the risk entirely to an insurance policy to address the high severity component may be appropriate, but it does not eliminate the need for operational controls.