Back to Risk Catalogue

FFIEC IT Examination Handbook

The FFIEC IT Examination Handbook booklets covering architecture, development, management, and security of financial institution IT systems.

AIO: VI Operations

Risks

AIR-OP-007Availability of Foundational Model

AUD: Internal Audit Program

Risks

AIR-RC-022Regulatory Compliance and Oversight

AUD: Risk Assessment and Risk-Based Auditing

Risks

AIR-OP-014Inadequate System Alignment AIR-OP-016Bias and Discrimination AIR-OP-017Lack of Explainability AIR-OP-018Model Overreach / Expanded Use AIR-OP-019Data Quality and Drift AIR-OP-020Reputational Risk AIR-RC-022Regulatory Compliance and Oversight AIR-SEC-002Information Leaked to Vector Store AIR-OP-004Hallucination and Inaccurate Outputs AIR-OP-005Foundation Model Versioning AIR-OP-006Non-Deterministic Behaviour AIR-SEC-009Data Poisoning

BCM: III Risk Management

Risks

AIR-OP-020Reputational Risk

BCM: IV Business Continuity Strategies

Risks

AIR-OP-007Availability of Foundational Model

BCM: V Business Continuity Plan

Risks

AIR-OP-007Availability of Foundational Model

DAM: III Risk Management of Development, Acquisition, and Maintenance

Risks

AIR-OP-014Inadequate System Alignment AIR-OP-016Bias and Discrimination AIR-OP-017Lack of Explainability AIR-OP-019Data Quality and Drift AIR-OP-004Hallucination and Inaccurate Outputs AIR-OP-006Non-Deterministic Behaviour AIR-SEC-008Tampering With the Foundational Model AIR-SEC-009Data Poisoning

DAM: IV Common Development, Acquisition, and Maintenance Risk Topics

Risks

AIR-SEC-010Prompt Injection

DAM: V Development

Risks

AIR-SEC-010Prompt Injection AIR-OP-014Inadequate System Alignment

DAM: VI Acquisition

Risks

AIR-RC-023Intellectual Property (IP) and Copyright AIR-SEC-008Tampering With the Foundational Model

DAM: VII Maintenance

Risks

AIR-OP-019Data Quality and Drift AIR-OP-005Foundation Model Versioning

MGT: I Governance

Risks

AIR-OP-018Model Overreach / Expanded Use AIR-RC-022Regulatory Compliance and Oversight AIR-RC-023Intellectual Property (IP) and Copyright

MGT: II Risk Management

Risks

AIR-OP-016Bias and Discrimination AIR-OP-017Lack of Explainability AIR-OP-018Model Overreach / Expanded Use AIR-OP-020Reputational Risk AIR-RC-022Regulatory Compliance and Oversight AIR-RC-023Intellectual Property (IP) and Copyright AIR-OP-004Hallucination and Inaccurate Outputs

OTS: Risk Management

Risks

AIR-RC-001Information Leaked To Hosted Model AIR-RC-023Intellectual Property (IP) and Copyright AIR-OP-005Foundation Model Versioning AIR-OP-007Availability of Foundational Model AIR-SEC-008Tampering With the Foundational Model

SEC: II Information Security Program Management

Risks

AIR-RC-001Information Leaked To Hosted Model

SEC: III Security Operations

Risks

AIR-SEC-010Prompt Injection AIR-RC-001Information Leaked To Hosted Model AIR-SEC-002Information Leaked to Vector Store AIR-SEC-008Tampering With the Foundational Model AIR-SEC-009Data Poisoning

SEC: IV Information Security Program Effectiveness

Risks

AIR-SEC-002Information Leaked to Vector Store