For Heads-of · Practitioner
AI not mapped to important business services
AI components embedded in an important business service haven't been identified or mapped, so an AI failure isn't accounted for in the service's impact tolerance.
- high
- operational-resilience
- mapping
- important-business-services
How it happens
An AI system, a fraud-scoring model, a customer service assistant, an underwriting tool, becomes load-bearing for a service the organisation has already designated as important under its operational resilience framework, but the resilience mapping exercise was never updated to reflect it.
Why it matters
An unmapped dependency is invisible to exactly the process meant to catch it: the impact-tolerance and scenario-testing work happens without ever considering what happens if the AI component fails.
Mitigating controls
The controls that address this risk, ranked by effectiveness.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| SS1/21: Operational Resilience | Mapping | Mapping |
| SS1/21: Operational Resilience | Important business services | Identification of important business services |
Related resources
The external sources behind this risk, from the Resources library.