AI Risk Quantification / Scenario Loss / Control ROI Playbook

定位: 面向 experienced CBAP / financial retail PM / product architect / solution architect / AI governance lead 的执行手册。目标是把 AI risk scenario 转成 expected loss range、control effectiveness、residual risk、control ROI、management action 和 release decision。

重要说明: 本文不是法律、合规、审计、精算、资本计量或监管意见。正式项目必须由 Legal、Compliance、Risk、Model Risk、Finance、Operations、Security、Privacy、Technology、Internal Audit 和业务管理层确认。

---

1. Purpose and When to Use

1.1 Purpose

本 playbook 用于回答一个高级问题:

Given an AI use case and a set of risk scenarios,
which controls are economically and architecturally justified,
what residual risk remains,
and what management action should be taken?

它把 AI 风险讨论从 qualitative rating 升级为 decision architecture:

scenario -> exposure -> frequency -> severity -> gross loss
-> control effectiveness -> residual loss
-> ROI / threshold / management action

1.2 When to Use

1.3 When Not to Use

---

2. Source Anchors

---

3. Operating Model

3.1 Roles

3.2 Workflow

1. Scope use case and decision boundary.
2. Build scenario register.
3. Estimate exposure, frequency and severity.
4. Estimate gross expected loss and P95 tail loss.
5. Map candidate controls to loss mechanisms.
6. Estimate control effectiveness, cost and friction.
7. Calculate residual risk and control ROI.
8. Compare against thresholds and business value.
9. Prepare management action pack.
10. Attach evidence packet to ADR / release decision.

3.3 Decision Rights

---

4. Templates

4.1 Scenario Register Template

Compact version:

4.2 Severity / Frequency Estimate Template

Frequency Estimate

Severity Estimate

Gross Loss Calculation

4.3 Control Effectiveness Estimate Template

Control effectiveness narrative:

The control reduces risk by changing the loss mechanism, not by improving the model in general.
Citation-required answer mode blocks or escalates unsupported regulated claims, so frequency falls.
Human approval token changes severity because draft errors do not directly update systems of record.
Vendor fallback reduces outage severity and duration but does not reduce hallucination frequency.

4.4 Residual Risk Template

Residual risk language:

Residual risk is not "low".
Residual expected loss is estimated at 45k-92k per month, with P95 at 130k-240k.
This is inside pilot threshold but above scale threshold.
Management action is controlled pilot plus targeted control investment before expansion.

4.5 Control ROI Template

Example:

Interpretation:

• Positive ROI is not automatically enough; control may still create unacceptable customer friction.
• Negative expected ROI can still be justified for critical resilience if P95 / P99 loss is intolerable.
• Reusable platform controls should allocate cost across use cases rather than penalizing the first adopter.

4.6 Management Action Pack Template

One-page format:

4.7 Evidence Packet Template

---

5. PM / BA / Architecture Questions

5.1 PM Questions

5.2 BA / CBAP Questions

5.3 Architecture Questions

---

6. Release Checklist

6.1 Minimum Before Pilot

6.2 Minimum Before Scale

6.3 Stop / Hold Triggers

---

7. Executive Narrative

7.1 Standard Narrative

We quantified the material AI risk scenarios for this release rather than relying on qualitative risk ratings.
The highest-risk scenarios are [A], [B] and [C].
For each scenario, we estimated exposure, frequency and severity using [shadow mode / QA / eval / production / expert] evidence.

Before controls, expected annual loss is estimated at [range], with P95 tail at [range].
The recommended controls reduce risk by [mechanism]: [frequency / severity / detection / recovery].
After controls, residual expected loss is [range], with P95 at [range].

The control portfolio costs [amount] annually and adds [friction].
Net risk reduction is [amount], producing [ROI] and compressing the main tail scenario from [before] to [after].

Recommendation: [approve pilot / scale / hold / reduce scope / fund control].
Conditions: [volume cap, excluded scope, threshold, review date, owner].

7.2 CFO Version

The business case is risk-adjusted.
We are not presenting productivity value alone.
We subtract residual expected loss, control operating cost and workflow friction.
The highest ROI controls are [X] and [Y].
The vendor redundancy control has weak expected ROI but is justified only for critical workflows because it compresses P95 outage loss.

7.3 CRO Version

The residual risk statement is scenario-specific.
We are not asking for blanket acceptance of AI risk.
For each material scenario, the pack shows gross loss, selected controls, residual loss, threshold status, owner, expiry and review trigger.
Scenarios above threshold are not approved for scale unless scope is reduced or controls are funded.

7.4 CTO Version

The architecture investment is prioritized by loss mechanism.
Prompt-only control has low tail impact.
Deterministic controls such as source gating, tool gateway, scoped authorization, trace evidence and graceful degradation compress the loss distribution more reliably.
Reusable platform controls should be funded as architecture runway, not charged only to one product.

---

8. Interview Drills

Drill 1: 30-Second Answer

Question:

How do you quantify AI risk for a financial retail AI product?

Answer:

I start with business loss scenarios, not model metrics. For each scenario I define exposure, frequency and severity, then estimate gross expected loss and a P95 tail range. I map controls to the loss mechanism they reduce: frequency, severity, detection delay or recovery cost. After estimating control cost and friction, I calculate residual risk and control ROI. The output is a management action: approve, scale, reduce scope, invest in controls, accept residual risk with expiry or stop.

Drill 2: Regulated Advice Hallucination

Question:

A wealth copilot sometimes produces unsupported product-specific advice. What do you do?

Strong answer:

I would not start with a generic hallucination metric. I would quantify the scenario where unsupported product-specific advice is reused in a customer conversation. The denominator is regulated-topic advisor responses. Frequency comes from red-team, shadow mode and QA. Severity includes review, correction, complaint handling and potential relationship impact. Controls include approved-source RAG, citation enforcement, recommendation phrase blocking and licensed-advisor handoff. The release decision depends on residual P95 and adoption friction: education content may proceed, product-specific advice may stay out of scope until residual risk is inside threshold.

Drill 3: AML Missed Escalation

Question:

How would you compare productivity gain from an AML copilot with missed escalation risk?

Strong answer:

I separate productivity value from tail risk. Productivity may reduce investigation time, but missed escalation has asymmetric downside. I would estimate typology-specific false negative or omission frequency using shadow comparison and QA, then calculate severity as reopened investigations, escalation delay, backlog and exam support. Controls should preserve recall for high-risk typologies: mandatory red-flag checklist, no auto-close, typology eval floor and analyst override evidence. If tail risk remains above threshold, the copilot can summarize evidence but should not prioritize or de-prioritize alerts.

Drill 4: Fraud False Negatives vs False Positives

Question:

Fraud wants a lower threshold, product worries about false positives. How do you decide?

Strong answer:

I would use net risk reduction. Lowering the threshold reduces fraud false-negative loss, but increases review cost, customer friction and possible abandonment. The model should estimate avoided fraud loss minus incremental false-positive cost and service friction. I would segment by transaction risk, recovery rate and customer value rather than applying one threshold globally. Controls with strong ROI may include risk-tiered queues, velocity rules fallback and post-event learning, while low-value segments may keep higher automation.

Drill 5: Vendor Outage

Question:

Should every AI system have a second model vendor?

Strong answer:

No. I would quantify outage scenario by business criticality. For low-risk internal drafting, manual fallback may be cheaper than multi-vendor complexity. For critical AML, fraud or contact-center peak workflows, vendor outage severity can justify graceful degradation, cached policy answers or fallback routing. The ROI may be weak on expected loss but justified on P95 tail compression. The architecture decision should be risk-tiered, not blanket multi-vendor.

Drill 6: Control ROI Challenge

Question:

How do you prove an AI control is worth the cost?

Strong answer:

I prove mechanism and economics. Mechanism means the control clearly reduces frequency, severity, detection delay or recovery cost. Economics means gross loss minus residual loss exceeds control and friction cost, or the control compresses a tail scenario management will not accept. I would show assumptions, evidence maturity, sensitivity and residual threshold status. If control ROI is low but the control is required for critical tail risk or policy boundary, I would say that explicitly rather than forcing a fake ROI.

---

9. Portfolio Artifact Checklist

Use this checklist before publishing the artifact as a portfolio note: