Actuaries Institute launches AI risk management guide

Actuaries Institute and UTS Human Technology Institute (HTI) have partnered to launch a practical risk management guide to help financial services firms manage artificial intelligence (AI) risks.

With rapid AI adoption, the Institutes note governance and risk management practices have not kept pace, and the AI Risk Management in the Financial Services Sector guide was designed to close the gap.

"Despite the growing use and importance of AI, many financial services organisations are ill-equipped to manage the scale, complexity, and evolving risk profile of AI systems," Actuaries Institute co-lead author Victor Bajanov said.

"Organisations that choose to do nothing in this space will be exposed to new risks they are not equipped to deal with."

Bajanov added risks associated with previous technologies are largely driven by human behaviour and are well understood, while frontier AI systems don't follow rules and generate responses based on patterns learned from data, which adds additional uncertainty.

"The financial services sector has well-established processes for managing traditional risks, but AI creates a vastly different risk profile, meaning organisations need to go back to first principles when deciding how to manage AI risks and assign responsibility for oversight. Managing AI risk needs to be much more than a tick-box exercise," Bajanov said.

The AI risk management framework provides a four-part framework for AI risk management. The first part builds around governance and how firms can assign accountability for AI risks in the organisation.

"AI creates a distinctive accountability challenge because AI risks are often distributed across multiple functions and are highly context-dependent," the report read.

"This is particularly true for general-purpose and enterprise-wide AI systems, where the same underlying model may be used in different ways in different business contexts, each creating distinct risks."

The report recommends the three lines of defence model, with the first line being business and technology that owns and manages risk in day-to-day operations, the second being risk and compliance that sets risk framework and provides oversight, and third being internal audit that provides independent assurance.

The second framework focuses on classification of AI risk within the organisation, the third focuses on quantification of AI risks and the four on controls for most common AI use cases.

The framework includes a toolkit of resources to explain how it can be applied in financial services organisations with significant AI investments. It can also be adapted by smaller organisations, or those earlier in their AI journey, to suit their scale, complexity, and risk appetite.

"AI in this sector can offer significant benefits for institutions and customers alike, improving efficiency, speed, and quality of service," Actuaries Institute chief executive Elayne Grace said.

"Yet failures in these systems risk significant harm. As experts in data-driven analysis, risk management, and long-term thinking, actuaries are well placed to support financial services organisations with decision making as they embed AI into their operations."