This is the 4th blog in a series about Artificial Intelligence (AI) in the context of credit union risk and compliance. This series is designed to provide auditors and compliance professionals with a clear understanding of how AI can be applied and managed within their operations.
When you’re protecting something important, you want to defend it well. The Institute for Internal Auditors developed a model that recommends 3 lines of defense:
- Management controls
- Quality control and compliance
- Audit
Ultimately, no single person bears the responsibility for AI risk mitigation at a credit union. It’s a team effort. Read on to learn more.
(Re)Introducing the 3 Lines of Defense
The “3 Lines of Defense” model has been around for some time. It was developed by the Institute for Internal Auditors in 2013, and it’s been a solid model ever since.
In fact, we even covered it in a credit union context and with respect to Boeing.
Briefly, we’ll cover them here (in the context of AI):
1. Management Controls
2. Quality Control and Compliance
3. Audit
Bearing Responsibility for AI
Due to the nature of AI—products and uses are emerging faster than regulatory guidance—it’s important to start thinking about AI policies and frameworks now.
Credit union leaders must ensure that each line of defense understands its role in managing risk.
However, there’s no reason to wait on leadership when it comes to AI risk assessment and mitigation. It’s also best to be proactive about AI. If you have concerns about audit’s role here—or if you want to provide guidance—you may want to start a conversation about AI with the CU leadership team.
Ultimately, anyone at the CU with exposure to AI bears some responsibility for risk mitigation. From users and management, to compliance, to audit.
Next Steps and Takeaways
When working with new AI solutions, it’s important for credit unions to do the following:
- Define whether their AI strategy is for offense, defense, or both;
- Understand the goals of the AI strategy or solution;
- Set intention behind the stated AI strategy or solution; and
- Run the AI strategy or solution through this AI Assurance Agenda.
Subscribe now to see further installments of this series on AI and credit union risk and compliance.
If you’d like to see how Redboard can save time and improve visibility and accountability in your audit process, schedule an assessment here.
Get FREE Access to the Audit Checklist for Credit Unions!
