Artificial intelligence: Risk management actuaries need to work across business units

In an environment where artificial intelligence (AI) is reshaping life for insurers, pension plans and other financial institutions, a new report from the Canadian Institute of Actuaries (CIA) says those in this profession have an opportunity to play a leading role in identifying, assessing and managing the risks associated with AI.

“AI adoption is expected to reshape how financial institutions operate and how markets function, with implications for the management of institutional and systemic risk, say authors of the new CIA guidance document, Considerations for AI within an ERM Program. “This evolution underscores the need to reassess risk perspectives across the industries we serve and the ways in which risk management techniques are applied.”

The paper is written for actuaries, risk practitioners, managers and executives “supporting their understanding of the influence and impact of AI on enterprise risk management (ERM) programs and prompting reflection on AI in the context of more traditional risks.” They add that the concepts are applicable across all areas of actuarial practice, including life and health insurance, property and casualty insurance and pensions.

Cassandra Tontini, chair of the CIA’s enterprise risk management practice committee and director at PwC with the firm’s risk modelling services team, says actuaries entering the field of risk management will be particularly interested in the document. “We really wanted to provide some guidance to our profession to help them navigate AI risk,” she says, noting that the field is flooded with information. In that light, she adds that a report written by a team of Canadian actuaries talking about AI risk tends to stand out.

“The paper we wrote is meant to be foundational,” she says. “We were very careful when we wrote it to avoid it being stale quickly. We were trying to think of the foundational risk management activities that can help you understand AI risk and protect against it.”

The paper notes that AI governance is more than a model validation challenge: “it is an enterprise risk, technology, compliance and strategy challenge,” the report states.

To effectively get an accurate picture, Tontini notes that all risk managers, across channels – financial, operational, fraud risk managers included – need to consult each other. “You need to figure out how AI risk would manifest across those areas in order to properly manage it.”

She goes on to say that AI risk is essentially “transverse risk.”

“It manifests through other risks across your entire risk taxonomy. What that means is that you need to work with others in order to actually understand the impact of AI risk. It doesn’t sit neatly in a category,” she explains. “AI risk is introducing the need for us to talk to all other risk managers, to create committees to actually understand how this affects our institutions.”

One of the challenges too is the limited number of subject matter experts, simply because the risks are moving quickly.

A second challenge Tontini identifies is the application of traditional risk management techniques which often assume a human is acting with ill-intent (in a fraud case, for example) and applying these controls to scenarios where the culprit may not be human.

“I think there’s often insufficient resources in risk management to protect against that. The understanding is there, but I think there’s still a lot of work to do to protect ourselves against those risks,” she says.

In the document, its authors discuss the fact that many recent laws and regulations have avoided a precise definition of AI to reduce the risk of loopholes. To support the ERM discussion, however, the document helps to define AI in the context of six different risk categories (business risk, insurance risk, market, credit, liquidity and operational risks among them).

The paper also discusses the physical characteristics of an AI system’s implementation, use cases, risk identification approaches, third-party oversight and validation, along with a review of pertinent regulations and law.

“Capabilities create opportunities (efficiency, accuracy, speed) as well as additional risks (model bias, opacity, drift, data leakage, regulatory scrutiny). For the purposes of considering AI within the ERM framework, we focus on five core elements: risk governance, risk identification, risk assessment, risk monitoring and risk reporting,” they continue.

“Artificial intelligence is a rapidly evolving technology that is reshaping the competitive landscape and broader social and economic environment for insurers, pension plans and other financial institutions,” they conclude. “Actuaries have an opportunity to play a leading role in identifying, assessing and managing the risks associated with AI.”