Remediation

Complete lineage sampling across retained training datasets, reconcile retention exceptions, and attach source-to-model provenance evidence to the control test.

Dataset inventory complete; lineage sampling and exception approvals remain.

Re-run protected-class outcome testing on the current credit model, investigate threshold disparities, document mitigations, and obtain Fair Lending approval.

Baseline analysis identified threshold variance; mitigation validation is underway.

Screen production features for direct and correlated proxies, document disposition decisions, remove unsupported variables, and retest model performance.

Feature list has been assembled; correlation review is in progress.

Add protected-class fairness indicators to production monitoring, set escalation thresholds, assign alert ownership, and capture the first monitoring report.

Metric definitions approved; dashboard implementation remains.

Complete independent revalidation, challenge assumptions and performance limits, resolve validation findings, and record Model Risk Committee approval.

Validation testing is halfway complete; committee review follows remediation.

Refresh the model inventory entries with assumptions, constraints, prohibited uses, monitoring triggers, and business-owner attestations.

Templates are updated; owner attestations and final challenge remain.

Document rollback criteria for each production AI service, test one controlled rollback, and attach Change Advisory approval and drill evidence.

Rollback plans are drafted; controlled drill and approval remain.

Patch the failing prompt-injection scenarios, tune output filters, rerun the security suite, and obtain Security sign-off with retained test evidence.

Filter changes are deployed in staging; regression evidence is pending.

Collect current vendor assurance reports, review model and data-processing changes, update residual risk, and renew the third-party approval.

Evidence requests sent to vendors; risk review starts after receipt.

Update the expired procedure for current release gates, rollback ownership and resilience testing, then complete Legal, Risk and Technology approvals before publication.

Draft revision complete; cross-functional approval is in progress.

Resolve draft comments, add model-provider monitoring and exit requirements, obtain Procurement and Risk approval, and publish the controlled version.

Stakeholder comments consolidated; final approval and publication remain.

Create a corrective-action response for every audit exception, validate fairness remediation, submit evidence to Internal Audit, and complete independent closure testing.

Management responses are logged; control retesting and closure validation remain.