Page 25 - Risk Management Bulletin April -June 2021

RMAI BULLETIN APRIL TO JUNE 2021

Cory Levins is business development director for Air the damage is done. This can take the form of
Sea Containers. everything from lost revenue and missed market
opportunities to security breaches and damage to
https://www.supplychainbrain.com/
internal structures and processes.
How AI complicates enterprise risk At its heart, implementing the proper controls on AI
is a form of risk management. Due to its autonomous
management nature, however, AI requires a little more attention
Despite the gains artificial intelligence has already than standard IT, say McKinsey partners Juan
brought to the enterprise, there is still much hand- AristiBaquero, Roger Burkhardt, Arvind Govindarajan,
wringing over its potential for unintended and Thomas Wallace. For one thing, AI introduces a
consequences. While the headlines tend to focus on number of unfamiliar risks across a multiple disciplines,
AI running amok and destroying all mankind, the including compliance, operations, legal, and regulatory.
practical reality is that current generations of AI are Banks, for example, have long worried about bias from
more likely to wreak havoc on business processes - and their human employees, but if those employees start
profits - if not managed properly. making recommendations based on what a biased AI
But how can you control something that, by its nature, tells them, now the institution has systematized that
is supposed to act autonomously? And by doing so, bias into its decision-making process.
won't the enterprise be hampering the very thing that Another problem is the way AI is rapidly becoming
makes AI such a valuable asset in the workplace? decentralized across the enterprise, which makes it
AI gone wrong difficult to track and monitor. And as the various AI
implementations of multiple vendors, partners, and
OnCorps CEO Bob Suh offers a good overview of the
harm AI can cause, even when employed with the best other entities start to communicate with one another,
of intentions. The experiences of the social media the potential to introduce new risks increases. A new
tool within a vendor's CRM platform, for example,
platforms illustrate how poorly designed algorithms
can produce one set of positive results (more sharing) could create data privacy and compliance risks across
while at the same time promulgating negative results multiple geographical regions.
(misinformation and manipulation). It's fair to say that Up-front management
executives at Facebook and Twitter did not intend for The best way to manage these risks is to implement
their platforms to foster society-wide conflict and the proper controls before AI becomes woven into the
animosity, but they did focus their efforts on fabric of the enterprise, according to Todd Bialick,
maximizing profits, so that is what their reinforcement digital assurance and transparency leader at PwC. To
learning agents (RLAs) did. do that, you'll need to conduct a full-stack review of
RLAs are based on simple reward functions in which everything AI touches as it seeks to fulfill its mandate.
positive results prompt the agent to expand and refine This includes data-layer policies governing input and
its actions. Without a countervailing reward set selection, oversight and transparency in algorithm
mechanism, the agent will continue to get better at and model development, continual review of output
what it does even if it no longer produces a desirable and decisions, and full control over logical security,
outcome. In this way, the social media bots were highly compute operations, and program change and
successful at achieving their programmed objectives development.
even as they were being manipulated by some in the Training AI to behave ethically is also an emerging, yet
user community to weaponize public opinion and sow extremely nascent, field that has drawn the interest of
discord throughout the population. both private- and public-sector organizations. One of
These same problems can emerge in sales, marketing the key difficulties is that ethics is a very subjective
and other functions. And unfortunately, few discipline, in which ethical actions in one set of
organizations are equipped to identify and correct circumstances can be unethical in another. But as
algorithms that are driving undesirable outcomes until James Kobielus, senior director of research for data

23