AI Risk Quantification / Scenario Loss / Control ROI Playbook

配对阅读：本手册的原理/架构解读版是 docs/ai-foundations/papers/170-ai-risk-quantification-scenario-loss-control-roi-architecture.md。先读 paper 建立机制与取舍，再用本手册落地为模板、RACI 与门禁，两者不需要重复精读。

定位: 面向金融零售 AI 风险场景、损失量化、控制投资、残余风险接受和上线决策的系统学习手册。目标是把 AI risk scenario 转成 expected loss range、control effectiveness、residual risk、control ROI、management action 和 release decision。

重要说明: 本文不是法律、合规、审计、精算、资本计量或监管意见。正式项目必须由 Legal、Compliance、Risk、Model Risk、Finance、Operations、Security、Privacy、Technology、Internal Audit 和业务管理层确认。

---

1. Purpose and When to Use

1.1 Purpose

本 playbook 用于回答一个高级问题:

Given an AI use case and a set of risk scenarios,
which controls are economically and architecturally justified,
what residual risk remains,
and what management action should be taken?

它把 AI 风险讨论从 qualitative rating 升级为 decision architecture:

scenario -> exposure -> frequency -> severity -> gross loss
-> control effectiveness -> residual loss
-> ROI / threshold / management action

1.2 When to Use

1.3 When Not to Use

---

2. Source Anchors

---

3. Operating Model

3.1 Roles

3.2 Workflow

1. Scope use case and decision boundary.
2. Build scenario register.
3. Estimate exposure, frequency and severity.
4. Estimate gross expected loss and P95 tail loss.
5. Map candidate controls to loss mechanisms.
6. Estimate control effectiveness, cost and friction.
7. Calculate residual risk and control ROI.
8. Compare against thresholds and business value.
9. Prepare management action pack.
10. Attach evidence packet to ADR / release decision.

3.3 Decision Rights

---

4. Templates

4.1 Scenario Register Template

Compact version:

4.2 Severity / Frequency Estimate Template

Frequency Estimate

Severity Estimate

Gross Loss Calculation

4.3 Control Effectiveness Estimate Template

Control effectiveness narrative:

The control reduces risk by changing the loss mechanism, not by improving the model in general.
Citation-required answer mode blocks or escalates unsupported regulated claims, so frequency falls.
Human approval token changes severity because draft errors do not directly update systems of record.
Vendor fallback reduces outage severity and duration but does not reduce hallucination frequency.

4.4 Residual Risk Template

Residual risk language:

Residual risk is not "low".
Residual expected loss is estimated at 45k-92k per month, with P95 at 130k-240k.
This is inside pilot threshold but above scale threshold.
Management action is controlled pilot plus targeted control investment before expansion.

4.5 Control ROI Template

Example:

Interpretation:

• Positive ROI is not automatically enough; control may still create unacceptable customer friction.
• Negative expected ROI can still be justified for critical resilience if P95 / P99 loss is intolerable.
• Reusable platform controls should allocate cost across use cases rather than penalizing the first adopter.

4.6 Management Action Pack Template

One-page format:

4.7 Evidence Packet Template

---

5. 分析视角与设计判断

5.1 Business Decision Questions

5.2 Workflow and Evidence Questions

5.3 Architecture Questions

---

6. Release Checklist

6.1 Minimum Before Pilot

6.2 Minimum Before Scale

6.3 Stop / Hold Triggers

---

7. Executive Narrative

7.1 Standard Narrative

This release pack quantifies material AI risk scenarios rather than relying on qualitative risk ratings.
The highest-risk scenarios are [A], [B] and [C].
For each scenario, exposure, frequency and severity are estimated using [shadow mode / QA / eval / production / expert] evidence.

Before controls, expected annual loss is estimated at [range], with P95 tail at [range].
The recommended controls reduce risk by [mechanism]: [frequency / severity / detection / recovery].
After controls, residual expected loss is [range], with P95 at [range].

The control portfolio costs [amount] annually and adds [friction].
Net risk reduction is [amount], producing [ROI] and compressing the main tail scenario from [before] to [after].

Recommendation: [approve pilot / scale / hold / reduce scope / fund control].
Conditions: [volume cap, excluded scope, threshold, review date, owner].

7.2 CFO Version

The business case is risk-adjusted.
The business case does not present productivity value alone.
Residual expected loss, control operating cost and workflow friction are subtracted.
The highest ROI controls are [X] and [Y].
The vendor redundancy control has weak expected ROI but is justified only for critical workflows because it compresses P95 outage loss.

7.3 CRO Version

The residual risk statement is scenario-specific.
The decision does not ask for blanket acceptance of AI risk.
For each material scenario, the pack shows gross loss, selected controls, residual loss, threshold status, owner, expiry and review trigger.
Scenarios above threshold are not approved for scale unless scope is reduced or controls are funded.

7.4 CTO Version

The architecture investment is prioritized by loss mechanism.
Prompt-only control has low tail impact.
Deterministic controls such as source gating, tool gateway, scoped authorization, trace evidence and graceful degradation compress the loss distribution more reliably.
Reusable platform controls should be funded as architecture runway, not charged only to one product.

---

8. Scenario Studies

8.1 Quantification Pattern

AI risk quantification starts with business loss scenarios, not generic model metrics. For each scenario, define exposure, frequency and severity, then estimate gross expected loss and P95 tail range. Controls are mapped to the loss mechanism they reduce: frequency, severity, detection delay or recovery cost. After control cost and workflow friction are estimated, residual risk and control ROI determine management action: approve, scale, reduce scope, invest in controls, accept residual risk with expiry or stop.

management action
= scenario materiality
+ gross expected loss / tail loss
+ control mechanism strength
+ residual threshold status
+ business value after control cost and friction

8.2 Regulated Advice Hallucination

Scenario: a wealth copilot sometimes produces unsupported product-specific advice that could be reused in a customer conversation.

Analysis path:

• Denominator: regulated-topic advisor responses, split by product, jurisdiction and customer segment.
• Frequency evidence: red-team, shadow mode, QA sampling, complaint sample and citation failure rate.
• Severity components: review, correction, complaint handling, customer remediation, relationship impact and regulatory response support.
• Controls: approved-source RAG, citation enforcement, recommendation phrase blocking, suitability policy, licensed-advisor handoff.
• Release decision: education content may proceed under controlled scope; product-specific recommendation support remains out of scope until residual P95 is inside threshold.

8.3 AML Missed Escalation

Scenario: an AML copilot improves investigation productivity but may miss rare high-risk typologies.

Analysis path:

• Productivity value must be separated from tail risk.
• Frequency is typology-specific, using shadow comparison, QA and analyst override evidence.
• Severity includes reopened investigations, escalation delay, backlog impact, exam support and potential remediation.
• Controls should preserve recall for high-risk typologies: mandatory red-flag checklist, no auto-close, typology eval floor and analyst override evidence.
• If residual tail risk remains above threshold, the copilot can summarize evidence but should not prioritize or de-prioritize alerts.

8.4 Fraud False Negatives vs False Positives

Scenario: a lower fraud threshold reduces false negatives but increases false positives, customer friction and review load.

Analysis path:

• Decision metric is net risk reduction, not model score improvement.
• Avoided fraud loss is offset by incremental false-positive review cost, authentication friction, abandonment and complaint handling.
• Segmentation matters: transaction risk, recovery rate, customer value, merchant category, channel and region should not share one global threshold.
• Controls with strong ROI include risk-tiered queues, velocity rules fallback, post-event learning and targeted step-up.
• Low-value or low-risk segments may keep higher automation when review cost exceeds avoided loss.

8.5 Vendor Outage

Scenario: a model provider outage affects internal drafting, contact-center support and critical financial crime workflows.

Analysis path:

• Multi-vendor design is justified by business criticality, not as a blanket rule.
• Low-risk internal drafting may rely on manual fallback or delayed processing.
• Critical AML, fraud, contact-center peak or customer-facing regulated workflows may justify graceful degradation, cached policy answers, fallback routing or second provider support.
• Expected-loss ROI may look weak while P95 tail compression is material. The architecture decision should therefore separate expected value from unacceptable tail scenarios.

8.6 Control ROI Challenge

Scenario: a proposed AI control adds cost and friction but may reduce a material risk scenario.

Analysis path:

• Mechanism evidence: the control clearly reduces frequency, severity, detection delay or recovery cost.
• Economic evidence: gross loss minus residual loss exceeds control and friction cost, or the control compresses a tail scenario that management will not accept.
• Sensitivity evidence: assumptions are shown across defect rate, exposure growth, severity range, adoption and control coverage.
• Residual threshold: low ROI does not automatically reject a control if policy boundary, audit requirement or critical tail risk requires it.
• Decision record: controls are approved, rejected or constrained based on mechanism, economics, evidence maturity and residual threshold status.

---

9. Evidence Artifact Checklist

Use this checklist before treating the artifact as release or investment evidence: