AI Program Metrics: Performance, Risk, and Business Value

This tenth episode of the ISACA Advanced in AI Audit (AAIA) exam prep series tackles one of governance’s trickiest jobs — measuring whether an AI program is actually trustworthy. It walks through why universal metrics are hard to define, the objectives that define a healthy AI program, and the recognized framework used to manage hazards from initial design through retirement.

Frequently Asked Questions

Why is it so hard to agree on AI program metrics?

There are four main reasons. First, there is no standardized rulebook that everyone in the world follows. Second, the technology evolves so rapidly and varies so wildly between applications that a one-size-fits-all test is nearly impossible. Third, people try to simplify highly complex behaviors into a basic math equation, which fails to capture the big picture. Fourth, different organizations have vastly different internal philosophies and ethical priorities, making common ground hard to find.

What are the eight objectives for trustworthy AI systems?

The eight major objectives are accountability, fairness, human wellbeing, performance, privacy and data governance, robustness and digital security, safety, and transparency and explainability. These technical metrics translate abstract concepts into measurable formulas covering who is responsible, whether the system picks favorites, whether it improves life, whether it does its job, how data is protected, how it withstands attacks, whether it prevents physical harm, and whether its reasoning can be understood.

Should human safety or business value come first in AI metrics?

Human safety must always be the absolute top priority. You must first ask whether the technology could physically or emotionally harm a person. Only after confirming human safety should you look at business factors, such as whether staff are comfortable using the tool, whether the buyer enjoys the interaction, and whether the software actually saves the money or time it promised to save.

What are the four functions of the NIST AI risk management framework?

The framework from the US National Institute of Standards and Technology breaks the risk journey into four core, interconnected functions: Govern, which writes the constitution and establishes oversight rules; Map, which scouts the terrain to identify context and what could go wrong; Measure, which quantifies and tracks the severity of risks; and Manage, which prioritizes the most dangerous threats, takes action to neutralize them, and continuously oversees the system.

Reference: This article is based on concepts discussed in AI Program Metrics: Performance, Risk & Business Value.