AI Management Information / Board Reporting Architecture Playbook

适用对象: CBAP-level Financial Retail PM / Senior BA / AI Product Architect / Enterprise Architect / Risk Product Lead / Model Risk Partner / Board Reporting Lead。 目标: 把 AI telemetry、业务价值、风险偏好、控制有效性、事件、客户伤害、采用、成本、供应商集中度和管理行动转成可追溯、可验证、可决策的 Management Information。 核心观点: Board pack 是展示层; MI architecture 是 metric contracts、lineage、thresholds、data quality、cadence、RACI、validation 和 action log 的操作系统。 边界说明: 本文是学习、作品集和架构设计材料, 不构成法律、监管、审计、模型验证、财务确认或董事会治理意见。正式项目必须由 business owner、risk、model risk、legal、compliance、privacy、security、finance、data、architecture、operations 和 internal audit 共同确认适用要求。

---

1. Executive Framing

弱 AI board update 通常汇报 use case 数、模型调用量、满意度、预计节省小时和 "没有重大事故"。董事会和审计委员会真正需要的是:

Which AI systems are material?
What value is proven, not estimated?
Which risks are outside appetite?
Which controls are working or failing?
What customer harm occurred?
Where are model/vendor/data dependencies concentrated?
What management actions are overdue?
What decision is required this quarter?

AI MI architecture 的目标:

AI fact capture
  -> metric contract
  -> lineage and quality control
  -> risk appetite threshold
  -> management view
  -> board / audit committee decision
  -> action log and evidence closure

Governance defines who should challenge and decide. MI architecture defines what facts they can rely on, where those facts came from, and what action follows.

This quarter, management reports 22 registered AI systems, of which 7 are material.
Portfolio residual risk is Medium with one Red appetite breach in vendor concentration.
No severe AI incident occurred; two medium customer-service harm events were contained and remediated.
Qualified AI value events increased 18%, but only three systems have finance-recognized benefits.
Decision requested: approve targeted platform funding for evidence automation and require remediation before expanding customer-facing GenAI scope.

---

2. Source Anchors

访问日期按 2026-06-30 记录。

---

3. MI Architecture

AI products / workflows
  -> event and telemetry capture
       - model / agent gateway
       - RAG retrieval and citation logs
       - tool action logs
       - workflow and human approval events
       - eval, QA, red-team and control test results
       - incidents, complaints, appeals and remediation
       - cost, adoption and value events
       - vendor, model and dependency registry
  -> MI data product layer
       - canonical AI event model
       - metric contracts
       - data quality checks
       - lineage graph
       - threshold and appetite rules
       - entitlement, retention and privacy controls
  -> MI marts / dashboards
       - executive AI portfolio
       - board and audit committee pack
       - risk appetite dashboard
       - control effectiveness dashboard
       - value realization dashboard
       - incident and customer harm dashboard
       - concentration and resilience dashboard
       - management action log

Canonical AI MI event model:

---

4. Metric Taxonomy

AI exposure
  -> accepted AI output
  -> quality and risk pass
  -> workflow outcome improvement
  -> cost within boundary
  -> finance / business owner recognition

Risk, control, harm and concentration metrics:

---

5. Data Lineage

Business event
  -> AI exposure event
  -> model / RAG / tool trace
  -> human or system decision
  -> QA / eval / incident / outcome record
  -> metric calculation
  -> dashboard tile
  -> board statement
  -> management action
  -> closure evidence

Board tile: Unsupported claim rate for Customer Service RAG = 1.6%, Green.
metric_id = MI-AI-QUAL-003
definition_version = v1.2
source systems = model_gateway_trace, rag_retrieval_log, qa_review_tool
denominator = regulated-topic AI-assisted responses sampled by QA
numerator = sampled responses judged unsupported by approved source
quality checks = 99.2% trace completeness, 100% QA reviewer assigned, 0 duplicate response_id
threshold = Green <= 2%, Amber >2% <=3%, Red >3%
owner = Head of Customer Operations QA

---

6. Risk Appetite Dashboard

The institution has no appetite for unapproved fully automated final decisions in credit, AML, fraud or wealth workflows; severe customer harm without immediate containment; restricted data exposure to unapproved AI tools; expansion of material AI where audit trace completeness is below 95%; or expired high-risk exceptions without risk committee review.
The institution has limited appetite for contained medium incidents, controlled pilots under stop rules, and temporary concentration risk where fallback and exit roadmap are funded.

Dashboard view:

---

7. Board Pack Templates

Quarterly AI MI cover page example:

# Quarterly AI Management Information Report
Reporting period: Q2 2026
Prepared for: Board Risk Committee / Audit Committee
Decision requested: approve funding for evidence automation and model diversification.
Executive conclusion: Portfolio residual AI risk is Medium, with one Red concentration breach. Material AI systems: 7. Severe incidents: 0. Medium AI-attributable customer harm events: 2, contained and under remediation. Finance-recognized benefits: 3 systems. Critical open actions: 1 overdue high action with approved extension.
Decisions required: approve platform funding; require remediation before expanding customer-facing GenAI to regulated fee and dispute categories; endorse updated concentration limit.

Portfolio summary:

Decision requested: approve limited expansion of Customer Service RAG to two additional low-risk product lines.
Evidence: qualified value events 74%; AHT reduction 18%; unsupported claim rate 1.6%; AI-attributable complaints flat to baseline; source freshness SLA 97.8% amber; top model exposure 72% red.
Conditions: no expansion to regulated fee, dispute or credit explanation categories until source freshness and cross-use-case regression pass; model diversification roadmap funded; weekly MI for 8 weeks.
Stop triggers: unsupported claim rate above 3%; any severe AI-attributable customer harm; HITL bypass in regulated topics; trace completeness below 95%.

Audit committee evidence requests:

---

8. Management Action Log

Management reporting is incomplete if it only shows status.

signal -> issue classification -> management action -> owner and due date
  -> evidence of completion -> validation -> residual risk update -> closure or escalation

---

9. Report Validation

Restate a board metric when source-system error changes a board-level status, late incident capture changes severity or appetite status, metric definition was applied incorrectly, excluded population materially changes the decision conclusion, or data quality failure invalidates the period result. Record restatement reason, approver, impacted reports and management conclusion.

---

10. Cadence

---

11. RACI

---

12. Templates

AI MI metric catalog:

For Q2 2026, management attests that the AI Management Information report covers all seven material AI systems in the approved register, applies approved metric contracts and thresholds, discloses the source freshness amber issue, reconciles reportable AI incidents and customer harm events, and links all amber/red appetite signals to management actions or approved risk acceptance. Signers are business owner, risk owner, technology owner, data owner, security/privacy owner and finance owner for benefit claims.

Concrete incident board update example:

Incident ID: AI-INC-2026-014.
Severity: Medium.
Systems affected: Customer Service RAG and Branch Knowledge Assistant.
Customer impact: 31 customer drafts contained stale fee-policy citation; no financial loss; remediation completed.
Root cause: regulated fee document missed daily source refresh.
Controls that worked: agent review prevented direct customer auto-send.
Controls that failed: superseded-document block did not cover one fee schedule.
Management actions: daily regulated-policy ingestion, block retired source IDs, QA retest by 2026-07-10.
Decision requested: no customer-facing direct response until source freshness returns to green for two cycles.

---

13. 30-Day Lab

Goal: produce a portfolio-ready AI MI and board reporting architecture artifact for a financial retail institution.

---

14. Financial Retail Case

Board narrative:
The AI portfolio is producing early value but is not ready for broad customer-facing autonomy.
Customer service and AML show stable value in human-supervised workflows.
Credit memo remains held due to explanation and fairness evidence gaps.
The largest portfolio risk is concentration: the same model and evidence export path support multiple material systems.
Management requests funding for evidence automation, source freshness controls and model fallback.

---

15. Interview Answers

Q1: How do you design AI board reporting that is actually useful?

30 秒版本:

I start with board decisions, not charts. Each metric must support scale, hold, stop, fund, remediate or accept risk. Then I define metric contracts, source lineage, thresholds, owners, cadence and action logs. A board pack should be the presentation layer over a governed MI data product. 2 分钟版本: I first identify the decisions the board or audit committee needs to make: risk appetite, expansion, funding, remediation, residual risk acceptance or incident oversight. For each decision, I define metrics across value, adoption, quality, customer harm, control effectiveness, incidents, concentration, cost and auditability. Each metric gets a contract: numerator, denominator, grain, source systems, threshold, owner, quality rules and evidence. Then I design lineage from AI telemetry and workflow events to dashboard tiles and board statements. Finally, every amber or red metric links to a management action log.

Q2: What is the difference between AI governance and AI MI architecture?

30 秒版本:

Governance defines who oversees AI and what decisions they own. MI architecture defines the facts, definitions, lineage, thresholds and actions used in that oversight. Governance without MI becomes opinion; MI without governance becomes unused reporting.

Q3: How do you report AI value without falling into vanity metrics?

30 秒版本:

I avoid using model calls, feature count or generated content as primary value evidence. I use qualified value events: the workflow was eligible, AI was used, output was accepted, quality and risk passed, unit economics were within boundary, and the business or finance owner recognized the outcome.

Q4: How should SR 26-2 affect AI board reporting in 2026?

30 秒版本:

SR 26-2 supersedes SR 11-7 and SR 21-8 and moves toward risk-based, materiality-driven model risk management. It explicitly excludes generative and agentic AI from formal scope, so I would not misclassify every GenAI system as SR 26-2 governed. But I would use its discipline: inventory, materiality, monitoring, governance, documentation and action tracking, alongside broader AI risk frameworks.

Q5: How do you make AI control effectiveness visible to an audit committee?

30 秒版本:

I turn each control into an operating metric and evidence artifact. For example, "human-in-the-loop" becomes HITL bypass count, reviewer coverage, override reason, review queue age and sample evidence. Audit should be able to reconstruct whether the control operated, not just see that it exists in a policy.

Q6: What would you do if a board metric turns red?

30 秒版本:

A red metric triggers the pre-agreed action path: classify the issue, identify affected systems, assign owner, decide contain/hold/stop/escalate, record due date and evidence, then validate closure. If residual risk remains outside appetite, management needs risk acceptance or scope restriction.

Q7: How do you handle vendor concentration in board MI?

30 秒版本:

I report concentration as risk-weighted exposure by model, vendor, RAG platform, evidence stack and human review dependency. The board should see whether one dependency supports multiple material systems, whether fallback is tested, and whether exposure exceeds appetite.

Q8: How do you prove the board report is reliable?

30 秒版本:

I use report validation: reconcile the AI register, verify metric contracts, run data quality checks, test lineage, sample source records, validate threshold logic, reconcile incidents and actions, and obtain owner sign-offs. Audit should be able to replay sampled numbers end to end.

---

16. Common Pitfalls

---

17. Final Checklist

• AI systems have stable IDs, owners, stages, risk tiers and materiality.
• Board metrics have metric contracts.
• Metric contracts include numerator, denominator, grain, source, threshold, owner and version.
• Telemetry covers model, RAG, tool, human review, workflow, incident, harm, value and dependency events.
• MI data product has quality checks, lineage and semantic layer.
• Dashboards reuse approved metrics instead of slide-local calculations.
• Thresholds map to appetite, stop rules or escalation.
• Every amber/red signal links to action or approved risk acceptance.
• Report validation samples metrics, incidents, actions and trace reconstructability.
• Board pack asks for decisions, not passive awareness. CBAP+ mastery standard: you can define board-useful AI metrics without vanity measures, write metric contracts at business-rule precision, draw source-to-board MI lineage, map telemetry to value/risk/control/harm, connect thresholds to risk appetite and actions, explain SR 26-2 nuance without overclaiming GenAI scope, design an audit-ready evidence pack, and use MI to recommend scale, hold, stop, fund or remediate. Final memory card:

AI MI architecture is the control plane behind board reporting.
Board report = decision.
Metric contract = definition.
Lineage = trust.
Threshold = risk appetite.
Action log = management accountability.
Validation = audit readiness.