The designated risk authority: Who should decide whether the residual risk is accepted?
Residual risks exceeding tolerance require decision by designated organizational authority, supported by documented controls and evidence.
The question
An employee-assistance chatbot has passed technical testing, but its residual privacy and harmful-content risks remain above the organization’s documented tolerance. The product team wants to launch because supervisors can manually review selected conversations. Who should decide whether the residual risk is accepted?
Preparing for AIGP? Take the free 5-min readiness quiz →
- The supervisors reviewing conversations.Supervisors provide operational evidence but should not independently accept risks exceeding documented organizational tolerance.
- The designated risk authority. ✓Residual-risk acceptance requires the organization’s authorized decision-maker, not an implementation team relying on partial supervisory review.
- The vendor’s customer-success manager.A vendor representative may describe product capabilities but cannot accept the deploying organization’s residual risks.
- The chatbot engineering lead.Engineering can explain technical controls but may lack authority to accept organizational privacy and harmful-content residual risks.
The trap
Distinguish people who operate controls from the authority empowered to accept organizational residual risk. How to remember it
Residual risks exceeding tolerance require decision by designated organizational authority, supported by documented controls and evidence.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How to Govern AI Development questions
- Constrain confidence-score use in customer workflows: What should design address first? →
- Obtain comparable disclosures before deciding: What evidence should determine the decision? →
- Document intended use and decision authority: Which evidence would resolve that uncertainty? →
- All 426 Understanding How to Govern AI Development questions →
Part of the Certsqill AIGP question bank · Understanding How to Govern AI Development ·
Every answer, right and wrong, comes with its own explanation.
