AI Governance is scored on three different levels: AI Use Case, AI System and institution-wide AI Controls.
Every AI Use Case is scored using the CSBS AI Use Case Risk-Tiering Worksheet as a reference. The highest of four risk factors sets its Inherent Risk, that tier decides which controls apply, and the controls in place lower it to a Residual Risk that rolls up to the AI system and the board report.
NOTE: Archived or removed use cases are ignored everywhere and do not count toward any score.
AI Use Cases set the system's Inherent Risk.
A Use Case's Inherent Risk is based off four factor levels:
Consumer Impact
Human Oversight
Harm Potential
Data Sensitivity
Each of the four levels are rated as Low, Moderate or High.
The final inherent risk is the highest of the four levels, so one High factor makes the whole Use Case High.
A reviewer can override the calculated level.
Final Risk = the override (if there is one), otherwise the Inherent Risk. Controls, residual risk and review interval are all based on the final risk.
Controls help lower a use case's risk .
There are 24 suggested controls for Use Cases (C1–C24) which are grouped by the Use Case's Final Risk tier:
Controls cover three different scopes: institution, system or Use Case.
NOTE: Control C9 is met automatically once the use case has a risk tier. It is not shown as a question.
Only Use Case scope controls that apply to the Final Risk are counted.
Yes Count = Are all controls with Yes answers and auto-met controls (C9).
No counts against coverage, not just as a missing Yes.
If you have equal Yes and No answers, your coverage would equal 0%.
Applicable Count = Are all controls with Yes or No answers. Any controls with N/A or unanswered controls are excluded from the count.
Coverage = (Yes − No) ÷ (Yes + No). Never below 0.
Residual Risk = Rounding of (Final level × (1 − 0.7 × Coverage)). Never below Low.
Residual Risk override: A reviewer can override the residual risk. The override is removed automatically if the Inherent Risk changes or if it matches the calculated level.