An AI audit plan is being developed for an organization that uses AI in three high-risk areas: credit underwriting, anti-money laundering transaction monitoring, and HR performance evaluation. Resources are insufficient to fully audit all three in one cycle. How should audit prioritization be determined?
Select an answer to reveal the explanation.
Short Explanation
You should prioritize the audit based on risk, not convenience or ownership. That means weighing regulatory scrutiny, potential harm to individuals, and what prior audits or monitoring have already shown. This gets your limited resources pointed at the highest-risk AI systems first.
Full Explanation
Prioritize based on a risk-based assessment considering regulatory scrutiny, potential harm to individuals, and findings from prior audits or monitoring. This directs limited resources to highest-risk areas. Randomly selecting two areas and rotating is unprincipled. Auditing all three at reduced scope reduces depth below effective assurance thresholds. Deferring to model owners violates audit independence.