Risk and audit teams are being asked to approve AI systems they did not design. Most do not need a technical degree to do this well. They need the right questions.
Here are ten. If the team cannot answer one, that is your finding.
The ten questions
1. What decision or task does the system handle? In one sentence. If it takes a paragraph, the scope is not clear.
2. What is the worst realistic mistake? Not the worst imaginable. The worst that could happen on an ordinary Tuesday. Who is hurt, and how much?
3. Where does a human step in? Name the step, the person and what they see. “Humans can override” is not an answer if nobody reviews.
4. What data goes in, and where does it go? Check whether personal or confidential data leaves your environment, and under which contract.
5. How was quality tested? Ask to see the test set, the score and a few failed cases. A team that shows failures is more trustworthy than one that shows only wins.
6. How will we know if it gets worse? Models change, data drifts. There should be a weekly or daily measure.
7. Can we reconstruct a past decision? For any output, can someone later see the input, the steps and the result? Auditors will ask.
8. What does it cost, and what stops a runaway bill? Look for budget alerts and hard limits.
9. Who owns it? One named person who can pause it.
10. How do we switch it off? And what happens to the work when we do? A fallback process should exist and be tried.
Scale the effort to the risk
A tool that drafts internal meeting notes needs a light review. A system that touches loans, claims, hiring or patient information needs the full list, plus legal input. Sort every AI use case into low, medium or high risk first, and spend your time on the high ones.
Rules differ by country
Regulation on AI, data protection and sector rules varies, and it is changing. Treat this checklist as a starting point and confirm legal requirements with your own advisers.
Need a second pair of eyes? Our AI strategy sprint includes a risk review, and the readiness checklist is free.
Work with us on this
- AI Strategy Sprint: A fixed two-week sprint that gives you a ranked use-case list, a working proof of the top idea and a costed plan.
- MLOps & LLMOps: Evaluation, monitoring, cost tracking and release processes that keep AI systems reliable after launch.