Day 1: Defining Model Risk and Materiality

Model Inventory and Classification

• Ownership expectations for model inventory
• Oversight cadence for governance controls
• Decision rights and approval thresholds
• Control testing before workplace approval

Risk Sources Across Lifecycle

• Performance signals around risk sources
• Escalation paths for control failures
• Audit evidence informing full traceability
• Evidence retention for later oversight

Ownership and Independent Challenge

• Practical tests for independent challenge
• Exceptions handled with documented rationale
• Policy limits limiting unauthorized use
• Independent review for high-impact cases

Day 2: Validating AI Models and Controls

Data and Methodology Review

• Operational risks around methodology review
• Accountability for approved AI outputs
• Governance roles throughout the lifecycle
• Human oversight at critical decisions

Performance and Robustness Testing

• Application limits around robustness testing
• Adversarial tests before production release
• Detection gaps exposed by testing
• Containment steps before wider spread

Bias and Explainability Assessment

• Decision points for explainability assessment
• Evidence preserved for incident oversight
• Malicious patterns across security telemetry
• Access anomalies needing prompt investigation

Day 3: Monitoring Model Risk in Production

Drift and Performance Thresholds

• Practical tests for performance thresholds
• Privilege changes needing closer review
• Attack paths across trust boundaries
• Identity risks tied to context

Change and Revalidation Triggers

• Control boundaries around revalidation triggers
• Recovery actions after security events
• Threat signals needing rapid triage
• Escalation thresholds for critical threats

Model Risk Reporting

• Practical tests for model risk reporting
• Missing values requiring deliberate treatment
• Data lineage informing result traceability
• Consistent definitions for core measures

• Hands-on workshop applying risk sources to realistic tasks
• Peer review challenging assumptions around robustness testing
• Practical lab developing performance thresholds for operational use
• Decision simulation testing model risk reporting in context