Risk Assessment and Management Questions

Identifying, analyzing, prioritizing, and treating information-security, compliance, and privacy risk. Covers qualitative and quantitative risk assessment methodologies, threat and vulnerability identification, likelihood and impact (and severity-of-harm) scoring, risk registers, and treatment decisions (accept, mitigate, transfer, avoid). Includes privacy-specific assessments such as DPIAs and PIAs: when an assessment is required, how to structure it, and how to weigh likelihood and severity of harm to individuals, plus prioritizing compliance and privacy risk across a portfolio of initiatives. Emphasizes structured, repeatable methodology tied to business context.

MediumTechnical

49 practiced

How would you define model risk tiers (low/medium/high) and the corresponding SLAs and control requirements? Provide concrete examples of controls for each tier and describe how to enforce them programmatically (pre-deploy checks, runtime guards, monitoring).

Sample Answer

Define tiers by potential business impact, user harm, and regulatory exposure:

- Low risk: internal analytics, non-decisioning models with no PII exposure. SLA: best-effort (48–72h incident response). Controls: unit tests, train/validation split, basic fairness checks, model card. Enforcement: pre-deploy CI checks (unit tests, data-schema validation, performance thresholds). Runtime: simple health checks, request/response logging. Monitoring: basic telemetry (latency, error rate).

- Medium risk: customer-facing recommendations or soft-decision models (personalization) with limited PII. SLA: 24–48h incident response, rollback within 4–8 hours. Controls: holdout testing, drift detectors, automated bias metrics, versioned model registry, access control. Enforcement: pre-deploy gating in CI/CD (autotest suite: performance, fairness, explainability summary, adversarial tests). Runtime guards: rate limiting, input validators, feature-range checks, canary deploys. Monitoring: automated alerting on metric degradation, data drift, and unexpected feature distribution shifts; periodic audits.

- High risk: regulatory/financial/health decisions or models that can cause safety/harm. SLA: immediate (4–8 hours) response, automatic rollback within minutes. Controls: strict governance, line-by-line reproducibility, formal validation, thresholded approvals, human-in-the-loop, detailed model card, encrypted PII handling, explainability and counterfactual analysis. Enforcement: pre-deploy: mandatory approval workflow, formal validation suite (statistical tests, stress tests, compliance checks), signed provenance in model registry. Runtime guards: kill-switch, prediction confidence thresholds forcing human review, sandboxing, strict RBAC, input provenance checks. Monitoring: continuous model performance, fairness, concept-drift detectors, replayable audit logs, automated compliance reports and SLA-driven alert escalation (pager).

Programmatic enforcement examples:- Pre-deploy CI pipeline (YAML) that runs: data-schema validator -> unit/integration tests -> performance & fairness tests -> artifact signing; fail pipeline on any violation.- Runtime middleware that validates inputs, checks feature ranges, enforces confidence thresholds, logs requests to a streaming store (Kafka) for real-time drift detection.- Monitoring stack: Prometheus/Grafana for latency/errors, ML-specific monitors (WhyLabs, Evidently) for data/model drift, and an alerting runbook that triggers automated rollback via Kubernetes job or feature-flag disabling when critical SLA breaches occur.

This tiered approach balances speed and control: higher tiers require stronger automated gates, faster SLAs, and more invasive runtime protections.

Unlock Full Question Bank

Get access to hundreds of Risk Assessment and Management interview questions and detailed answers.

Join thousands of developers preparing for their dream job.