Applying Risk Appetite and Risk Tolerance in the Age of AI

玛丽卡迈克尔
作者: 玛丽卡迈克尔, CRISC, CISA, CPA, Member of ISACA Emerging Trends Working Group
发表日期: 2024年8月19日
阅读时间: 5 分钟

采用人工智能——从生成式人工智能到计算机视觉——已经成为竞争的必需品, 不仅仅是一个选择. As these AI capabilities expand, they introduce a spectrum of risks. 风险,定义为“不确定性对目标的影响”,包括潜在的收益和损失. This definition highlights the necessity of a nuanced approach to AI, 目标不仅是避免不利结果,而且是获得竞争优势.

Assessing Risk Tolerance for AI: A Crucial First Step for Organizations

With core IT spending on AI projected to rise from US$235.6 billion in 2024 to $521 billion by 2027, 根据IDC, the stakes for organizations are exceptionally high. 这种投资水平表明了第一步的重要性——彻底评估组织管理不确定性的能力. 例如, 一家大型零售商正计划部署人工智能驱动的库存管理系统,并需要确定其风险承受能力. While keen on leveraging predictive analytics to forecast demand and automate replenishment, 零售商还必须考虑到可能导致库存过多或缺货的潜在数据不准确. By understanding its risk tolerance, 零售商可以设置错误率阈值,以确保其提高运营效率的动力不会破坏供应链的可靠性.

Defining Risk Management Concepts: Risk Appetite and Risk Tolerance

风险偏好和风险承受能力是风险管理中的重要概念,它们允许公司通过为可接受的风险建立明确的界限来引导技术采用. 这些术语通常可以互换使用,但是它们具有不同的定义和含义. 下面我们来仔细看看风险偏好和风险承受能力是如何定义的,以及它们的区别:

风险偏好 指组织为实现其目标而愿意承担的风险的数量和类型. 它反映了组织的战略意图,以及冒着遭受损失或面临挑战的风险追求潜在收益的意愿. 这通常是由高层领导设定的,并作为如何在整个组织中处理风险的指导方针

风险承受能力 is more specific and operational than risk appetite. 它量化了组织在特定领域或系统中可以承受的可接受风险水平. 风险容忍度通常被设定为在操作和决策过程中不应超过的阈值或限度(定量或定性).

对于人工智能计划, risk appetite sets the overall tone and boundaries for risk-taking, while risk tolerance provides specific, 可操作的限制和指导方针,帮助运营团队安全有效地进行日常决策和活动.

An Example: AI-driven Chatbot for Customer Service:

考虑一家旅游公司使用人工智能驱动的聊天机器人,通过协助旅行计划来增强客户服务, 预订及查询. 这项技术旨在提高运营效率,并通过按需服务改善客户体验. However, it also presents risks related to accuracy, reliability and customer satisfaction. Below is an example of a risk appetite and risk tolerance statement for this scenario: 

风险偏好声明 风险承受能力声明

我们公司致力于利用人工智能技术简化客户互动,增强服务交付. We accept a moderate level of risk with technology deployments, provided they significantly enhance customer engagement and operational efficiency. 我们致力于最高标准的数据安全,并遵守相关法规,这表明我们致力于保护我们的声誉,并始终如一地为客户提供卓越的价值.

我们的人工智能客户支持聊天机器人旨在将旅行预订和查询的错误率保持在1%以下, ensuring  our commitment to precision and reliability in customer interactions. We maintain minimal service interruptions, with system downtime not exceeding 0.工作时间的5%. Should any risks surpass these thresholds, 我们将迅速制定纠正措施,以配合我们的战略目标,并保持我们尊贵的客户的信任.

从风险承受能力声明中, the company identifies acceptable thresholds and limits, 使用分配给监视器的指标. 这些指标, which include Key Performance 指示器s (KPIs) and Key Risk 指示器s (KRIs), 为人工智能驱动的聊天机器人的性能和有效性创建一个评估框架. This ensures that potential risks are quickly identified and addressed, with corrective actions taken to maintain accuracy, availability and customer satisfaction at the desired levels.

Examples: Establishing Risk Thresholds Through 指示器s

下表详细介绍了用于监控和评估一家旅游公司实施的人工智能驱动的聊天机器人的性能和风险的kpi和KRIs, aligned with its risk appetite and tolerance.

指标类型  指示器 描述 目标
KPI

顾客满意度评分

Measures overall customer satisfaction with the chatbot interactions

满意率95%以上

KPI

解析率

Percentage of customer inquiries resolved by the chatbot without human intervention

至少90%的分辨率

KRI

误解率

Percentage of interactions where the chatbot fails to understand or respond accurately

不到1%的误解

KRI

升级速度

Percentage of chat sessions escalated to human support due to chatbot limitations

低于10%的互动

Applying Risk Tolerance for AI to De-Risking

降低风险包括采取行动将与项目或技术相关的风险最小化, ensuring they align with an organization's defined risk tolerance. 下面是一个应用风险容忍度来降低为客户服务设计的人工智能聊天机器人部署风险的示例.

Example: Applying Risk Tolerance to De-risk an AI Chatbot Customer Service Project

第一步:风险识别:

Identify risks: Inaccurate responses, 数据泄露, or non-compliance with data protection regulations.

第二步:运用风险承受能力

低风险承受能力:由于客户数据至关重要,并且由于不正确的信息可能导致声誉受损, the company maintains a low risk tolerance for privacy breaches and misinformation, 目标是小于0.5% of interactions to yield an incorrect response.

第三步:降低风险策略:

概念验证(POC):聊天机器人首先在一个有限用户群的受控环境中进行测试,以验证其功能,并在低风险环境中识别任何关键问题

敏捷方法:该公司使用敏捷开发来基于实时反馈迭代改进聊天机器人, allowing for rapid response to any emerging risks or issues

Controls: Strong encryption for data storage, comprehensive logging for transparency, 验证协议验证响应的准确性和适当性,以符合公司的低风险容忍度

Step 4: Continuous Risk Monitoring

性能:定期监控聊天机器人的性能,以检测和响应操作问题或与预期结果的偏差.

 

这种方法允许组织使用其风险承受能力来识别超过其可接受阈值的风险,并实施缓解措施以降低AI聊天机器人部署的风险.

Navigating AI’s Uncertainty: Risk Tolerance is Our Trusted Compass

风险容忍度是组织衡量他们在实施人工智能技术时愿意承担多大风险的关键工具. 这个概念对于平衡人工智能的潜在好处和它可能带来的挑战至关重要, 比如数据隐私问题, biased results or operational disruption. 随着技术的快速变化,拥有清晰的风险承受能力就像一个可信赖的指南针. It guides organizations through new challenges with confidence and clear direction. This careful approach ensures that progress is deliberate and secure, turning AI into a valuable ally rather than a risky gamble.