Managing new technology: the combination of model risk and enterprise risk management

Artificial intelligence (AI) and machine learning (ML) offer organisations expanding opportunities for greater control and efficiency and more timely and accurate results, but at the same time bring escalating emergent risks. Two significant and complementary approaches to the organisational challenges posed by AI and ML are model risk management (MRM) and enterprise risk management (ERM). In this review we identify the key literature on technology risk and organisations and use it to consider how effectively MRM policies nested within an ERM approach can resolve the risk conundrum created by the growing complexity of algorithmic technologies. We develop here a framework of the elements of MRM and ERM and the links between them. We first look at MRM and highlight four areas of model development (data, design, implementation and performance) and their associated risks. We then consider ERM and how digital technology implementation affects the entire organisation. We highlight the need to move away from a measurement and compliance approach to risk towards a broader and more proactive approach, aimed at organising technology risk, to which our MRM/ERM framework contributes. We argue that careful attention to the roles, aspirations and incentives of human operators and other stakeholders will be critical in making this transition successfully. Our review has implications for future research in several areas, including the design of human-machine hybrid systems, development of organisational best practice in managing risks arising from algorithmic bias, the design of effective government regulation for artificial intelligence and machine learning, and the role of algorithms in regulatory regimes.