What banking directors should ask about AI and machine learning risks

Bank risk teams must help boards understand the challenges and opportunities that AI provides and ask hard questions of C-suite leaders.

In brief

• Boards should be aware of how AI and machine learning are driving digital transformation across financial services plus being used by risk management teams.
• Credit risk management, anti-money laundering and regulatory compliance are use cases that offer clear value in improving model accuracy and efficiency.
• As generative AI becomes more prevalent, bank boards must advocate for robust governance and controls, especially since regulatory direction is unclear.

Artificial intelligence and machine learning (AI/ML) have been near the top of the strategic agenda for boards and bank leaders for several years and are likely to continue. The emergence of generative AI tools capable of producing rich, prompt-based content and code has further fueled this focus. Even before generative AI burst onto the scene, boards were challenged to assess the full range of AI and machine learning risks. These challenges are highlighted in two 2022 surveys performed by Ernst & Young LLP (EY) and the Institute of International Finance (IIF) and are further supported by recent roundtable sessions we’ve held with chief risk officers (CROs) from financial services.

Our research also confirms that the majority of CROs see digital transformation and AI risks continuing to grow. There’s no doubt that generative AI will play a prominent role in ongoing digital transformation, especially in customer-facing operations, which will further increase the risk profile. Boards must continually consider how generative AI will amplify the existing risks of AI. For example, the adoption of large language models will strain computational and data management capabilities and make the explanation of existing AI models even more complex.

2. CROs are embracing advanced technology to optimize risk operations

As with other functions across the business, risk management teams are expanding their use of AI/ML to improve their own work. At some organizations, the rapid pace of adoption means boards must engage management as soon as possible to establish oversight.

According to our survey, CROs are using advanced technologies to:

• Automate operational tasks: 44%
• Enhance financial crimes monitoring: 33%
• Improve client credit decision-making: 37%
• Identify possible cyber-attacks: 35%

Interestingly, CROs at global systemically important banks (G-SIBs) were more likely to focus on automation (67%) and financial crime monitoring (50%) in their AI/ML deployments than non-G-SIBs. All CROs expect to use these technologies for these activities in the future, indicating that we’re still in the early days.

In the future, we expect to see risk teams using AI to scan and review regulations and for process, risk and control diagnostics. Over time, AI-enabled scenario modelling will be used for market simulation, portfolio optimization and credit risk assessments. Automation of model documentation for consistency, clarity and reproducibility is another way banking CROs will adopt generative AI.

3. Evolving governance models are mostly based on existing risk frameworks that should evolve

The use of AI/ML is being governed through existing risk models and enterprise risk frameworks, according to our research. Most banks surveyed use model monitoring feedback mechanisms and controls – or are in the process of defining feedback mechanisms – to ensure machine learning models deliver the expected outcomes.

According to survey respondents, the primary techniques used in validating machine learning models in credit risk management include:

• Ongoing performance monitoring: 52%
• Monitoring against benchmarks: 47%
• In-sample/out-of-sample testing: 44%

Source: 2022 annual EY-IIF survey report on machine learning

Nearly every institution uses a range of mechanisms to avoid bias and discriminatory outcomes for credit risk management and AML. Mechanisms include institutional codes of ethics; auditing, testing and controls; and the exclusion of sensitive attributes from feature analysis, selection and engineering. All these frameworks need to be continuously reviewed and evolved to support generative AI and address the incremental risks associated with this technology – including hallucinations (where the models create fictitious responses), IP rights and bias management.

4. Banks are engaging with regulators to establish standards

Board directors have concerns about the regulatory uncertainty concerning AI and machine learning in risk management and other business functions. To address this, boards may support management in engaging with regulators and participating in industry initiatives to establish adoption standards. Relative to anti-money laundering, CROs are particularly concerned about the complex and opaque nature of some algorithms and regulatory supervisors’ lack of experience with these technologies. Banks may also engage regulators to discuss transparency, bias and ethical issues, and regulatory constraints for credit risk applications.

Effective board leadership in the AI era

In a dynamic banking market, board directors have more risks to consider than ever before – and AI/ML should top the list, as our research confirms. Effective board oversight will only become more important as generative AI creates transformative new possibilities in finance, IT, product development, customer service, marketing and other parts of the business. We expect forward-looking banks to embrace AI-driven risk management strategies, enhance the operating model and build ecosystems with robust data governance and ethical, legal and regulatory frameworks for generative AI.

Boards should consider whether the organization has an underlying data and innovation culture. Those with strong data and/or innovation cultures will likely be more successful in their deployment of generative AI. Generative AI should support not only business goals but also company values. Change management and workforce alignment should be included as part of the larger equation.

Relative to the risk function, boards should support CROs and other business leaders in devising long-term and holistic roadmaps for AI usage, including generative AI.

As AI becomes more deeply embedded in operations and processes – both within risk management and in the broader business – the priority for boards must be to understand how AI is used by CROs and risk management teams to mitigate other threats to the business.

About the surveys

The 2022 annual EY-IIF survey and report on machine learning: uses in credit risk and AML applications — The IIF surveyed 43 financial institutions across global regions, including G-SIBs, national banks, regional banks and other financial institutions. EY and the IIF performed analysis of the survey results covering a broad range of topics.

The 2022 12ᵗʰ annual EY-IIF survey of global banking CROs — EY, in conjunction with the IIF, surveyed CROs or other senior risk executives from 88 banks in 30 countries around the world from June 2022 through October 2022. Participants were interviewed, completed a survey or both. Participating banks were headquartered in Asia-Pacific (11%), Europe (16%), Latin America (18%), the Middle East and Africa (19%), and North America (36%), and 14% were G-SIBs.

EY and IIF are collaborating on the 2023 EY-IIF survey of global banking CROs as well as the 2023 AI/ML Use in Financial Services survey, which explores these themes further. The surveys will be published late 2023.

Contact EY professionals to learn more about the resources we offer financial services directors.