RAIDD = Risks, Assumptions, Issues, Dependencies, Decisions — the single system of record referenced throughout the Governance Model, Program Management Plan, Change Control Log, and Program Charter. Updated weekly by risk owners. Quarterly formal review by all three governance boards. Scoring: Likelihood (1–3) × Impact (1–3) = 1–9 scale. 1–3 Low · 4–6 Medium · 7–9 High.
Risk Register
Description: ACME's claims data is distributed across 4 legacy systems (core claims platform, supplemental benefits system, pharmacy claims adjudication, and a deprecated mainframe still processing ~8% of claims). Data formats, member identifiers, and clinical coding standards differ across systems. Phase 0 data profiling may reveal that integrating and cleansing this data for BRD-01 model training requires substantially more effort than estimated — potentially adding 4–8 weeks to the Phase 1 timeline and $800K–$1.2M to the data remediation budget.
Mitigation Strategy
- Early data profiling initiated in Phase 0, Week 1 — results expected by Week 6. Profiling covers: data volume, format consistency, identifier mapping completeness, clinical coding coverage, and duplicate detection.
- Contingency budget of up to $1.2M pre-approved (Decision D-01, Change Control CN-001) for extended data remediation if profiling identifies scope beyond initial estimate.
- Data remediation team (3 data engineers from Platform Foundation team) pre-allocated for first 4 weeks of remediation; can scale to 6 if profiling results warrant.
Trigger Threshold
If Phase 0 data profiling reveals >15% of claims records require manual remediation (identifier mapping, format conversion, or de-duplication), the risk is considered materialized and contingency activation is initiated.
Contingency / Fallback
If data remediation exceeds $1.2M or 8 weeks, escalate to Executive Steering Board with options: (a) extend Phase 0 by up to 4 weeks with additional contingency draw, (b) proceed with reduced training dataset (accepting lower initial model accuracy), or (c) phase BRD-01 delivery to use the cleanest data subset first and remediate remaining data in parallel.
Description: GenAI compute costs (GPU instances for model training) and LLM inference token costs (API calls to foundation model providers) are volatile and difficult to forecast accurately over a 36.5-month program. Token pricing has dropped significantly since 2023 but remains subject to vendor pricing changes, usage spikes during model training cycles, and unexpected inference volume in production. If actual compute costs exceed the $26.9M cloud/platform budget allocation by >15%, the program would need to either draw contingency or descope compute-intensive features.
Mitigation Strategy
- FinOps governance established in Phase 0: monthly cloud cost tracking by workload, automated cost alerts at 80%/90%/100% of monthly budget, and quarterly cost forecasting.
- Multi-cloud architecture (Decision D-03, CN-003) enables workload placement optimization — train on cheapest available GPU instances; infer on lowest-cost LLM endpoint meeting latency requirements.
- Model architecture decisions favor inference efficiency: BRD-03 uses gradient boosted ensemble (low inference cost) rather than deep learning; BRD-02 uses RAG (retrieval step is cheaper than generative step).
- Year 2 budget includes a 10% compute contingency buffer ($2.7M) within the cloud allocation.
Trigger Threshold
Monthly cloud spend exceeds forecast by >10% for 2 consecutive months, OR cumulative cloud spend reaches 90% of annual allocation before Q3 of any program year.
Contingency / Fallback
If triggered: (a) FinOps team conducts immediate cost audit — identify top 5 cost drivers and optimization opportunities; (b) negotiate volume discounts with cloud provider (Vendor Manager L. Park); (c) if structural overrun, present options to Executive Steering Board: draw contingency, reduce model complexity, or extend training cycles to use spot/preemptible instances.
Description: BRD-02's member-facing virtual assistant could generate a factually incorrect response about a member's coverage, benefits, or PA status — telling a member they are covered for a service when they are not, or providing incorrect cost information. Precedent: Moffatt v. Air Canada (2024) established that organizations are liable for their chatbot's statements regardless of whether the information was accurate. A hallucination incident could result in: financial liability (honoring incorrect coverage statements), regulatory scrutiny, member trust erosion, and potential class-action exposure if the hallucination affected a pattern of members.
Mitigation Strategy
- RAG (Retrieval-Augmented Generation) architecture: virtual assistant retrieves verified source passages before generating responses; generation constrained to retrieved content only (BRD-02 FR-02.005–008).
- Confidence gate: if retrieval confidence < 90%, system does NOT generate a response — escalates to human agent instead (BRD-02 FR-02.006).
- Post-generation citation verification: every factual claim in the response verified against retrieved source passages before delivery to member.
- Independent Model Validation includes adversarial hallucination testing: 500+ questions designed to provoke hallucination; target ≤ 0.5% hallucination rate.
- Weekly production monitoring: automated scan of virtual assistant responses for hallucination indicators; weekly human review of 100 sampled interactions.
Trigger Threshold
Any confirmed hallucination in production (a response containing information not traceable to the verified source corpus that could have misled a member about coverage, benefits, or costs).
Contingency / Fallback
If a hallucination is confirmed in production: (a) virtual assistant paused for affected inquiry type within 4 hours; (b) incident investigation initiated; (c) AI Governance Board notified within 24 hours; (d) Executive Sponsor and General Counsel notified; (e) affected member(s) contacted with corrected information; (f) root-cause analysis and model remediation before service restoration. If hallucination rate exceeds 1% in any weekly monitoring period, full virtual assistant service paused pending investigation.
Description: If the BRD-01 PA AI model's denial rate is significantly higher than the historical manual-review denial rate, or if human clinical reviewers override the AI's recommendation at a high rate, CMS or state regulators may scrutinize the model's clinical validity. Multiple state attorneys general have investigated health insurers' use of AI in claims decisions (2024–2026). A regulatory inquiry could trigger: mandated model audit, temporary reversion to manual processing, public reporting of AI decision patterns, and reputational damage.
Mitigation Strategy
- Fairness and bias testing mandatory pre-production (BRD-01 Section 11): no demographic group's approval/denial rate deviates >5% from population mean without documented clinical justification.
- Mandatory human review for ALL adverse determinations (denials and partial denials) — the AI cannot deny a PA without a licensed clinical reviewer confirming the decision.
- Override rate monitoring: if human reviewers override the AI recommendation >15% of the time in any service category, the model for that category is flagged for retraining.
- Denial-rate benchmarking: BRD-01 model's denial rate compared against ACME's historical manual-review denial rate. If AI denial rate exceeds historical rate by >5 percentage points, investigation triggered.
- Proactive regulatory engagement: quarterly briefings to state regulators (R. Thorne) demonstrating governance maturity and transparency.
Trigger Threshold
AI denial rate exceeds historical manual rate by >5 percentage points for 2 consecutive months, OR override rate exceeds 15% in any service category for 3 consecutive months, OR a formal regulatory inquiry is received.
Contingency / Fallback
If triggered: (a) AI Governance Board convenes within 48 hours; (b) model tuning targets adjusted conservatively (lower confidence threshold for auto-approval, more cases routed to human review); (c) if regulatory inquiry received, General Counsel leads response with AI governance documentation package; (d) contingency to add clinical reviewer capacity (2–4 additional reviewers at $135K/year each) if human review volume increases significantly.
Description: Hyperscaler cloud provider (AWS/GCP/Azure) or LLM partner (OpenAI/Anthropic) delays infrastructure provisioning, changes API terms, experiences outages, or discontinues a service that the program depends on. Given the 36.5-month program duration, the probability of at least one significant vendor disruption is moderate.
Mitigation Strategy
- Multi-cloud architecture adopted (Decision D-03, CN-003): no single-vendor lock-in for compute or storage. Workloads can be migrated between providers.
- Vendor agreements include escalation clauses, SLA commitments, and penalty provisions for delivery failures. Contracts reviewed by Legal (S. Patel).
- Vendor contingency plan maintained for single-source vendors (LLM providers): alternative provider identified, estimated switching cost and timeline documented, updated annually.
- Vendor performance reviewed monthly by Vendor Manager (L. Park); issues escalated to Program Director within 48 hours.
Trigger Threshold
Vendor SLA breach >4 hours for critical infrastructure, OR vendor announces pricing change >20%, OR vendor announces service discontinuation affecting program workloads.
Contingency / Fallback
Activate vendor contingency plan: initiate migration to alternative provider per documented plan. If migration timeline exceeds 4 weeks, escalate to Executive Steering Board with schedule impact assessment.
Description: Independent Model Validation discovers that BRD-03's underwriting risk-scoring model produces systematically different risk scores for demographically similar populations — disparate pricing impact that would violate the NAIC Model AI Bulletin and state anti-discrimination statutes. This is the most consequential fairness finding the program could produce: it means the model, as trained, would cause ACME to charge different rates to demographically similar groups without actuarial justification.
Mitigation Strategy
- BRD-03 uses the strictest fairness threshold in the program: ≤3% demographic score deviation (vs. ≤5% for BRD-01/02).
- Proxy variable audit mandatory before model enters production: every input variable tested for correlation with protected characteristics (BRD-03 §6.3). Variables with Pearson r > 0.40 correlation are removed, adjusted, or retained only with documented actuarial justification approved by CMO and General Counsel.
- Counterfactual testing: model re-scored with demographic characteristics perturbed; score stability verified within 3% threshold.
- Embedded Fairness Testing Specialist (F. Solberg5) on the BRD-03 delivery team provides continuous fairness assessment during development — not just at the formal validation gate.
- Shadow-mode pilot (8+ weeks, 500+ cases) produces real-world fairness data before model influences actual pricing.
Trigger Threshold
Any demographic group's average risk score deviates >3% from actuarially expected score without documented justification during Independent Model Validation OR shadow-mode pilot.
Contingency / Fallback
If bias is found: (a) model does NOT proceed to production — this is a blocking validation gate; (b) root-cause analysis identifies the source of bias (training data, feature selection, or model architecture); (c) retraining cycle initiated with corrected data/features; (d) re-validation required before production re-submission; (e) if retraining does not resolve bias within 2 cycles, escalate to AI Governance Board for model architecture review or scope adjustment.
Description: Frontline operational staff (clinical PA reviewers, call-center agents, underwriters) may resist adopting AI-assisted tools due to job-displacement concerns, distrust of AI recommendations, workflow disruption, or inadequate training. If adoption is low, the program's operational benefits (PA cycle time reduction, call-center efficiency, underwriting consistency) will not materialize even if the technology works correctly.
Mitigation Strategy
- Phased opt-in rollout (not mandatory go-live): users adopt the AI tool alongside their existing workflow before the existing workflow is retired. Opt-in period: minimum 8 weeks per BRD.
- Change Management & Training team (G. Okonkwo, 8 people) dedicated to adoption support: training program development, workflow integration coaching, feedback collection, and resistance identification.
- Internal communications strategy explicitly frames AI as augmentation, not replacement: "The AI handles the routine so you can focus on the complex."
- Early adopter program: identify 10–15 enthusiastic frontline users per BRD as champions who help peers adopt the tools.
- Adoption metrics tracked weekly during rollout: tool usage rate, time-to-first-use, feedback sentiment, and escalation patterns.
Trigger Threshold
Adoption rate below 40% at 4 weeks post-opt-in launch for any BRD, OR more than 3 formal resistance complaints submitted to HR within any 2-week period.
Contingency / Fallback
If triggered: (a) Change Management team conducts rapid assessment (focus groups, 1:1 interviews with non-adopters); (b) identify specific resistance drivers (training gap? workflow friction? trust issue?); (c) adjust training program and/or tool UX based on feedback; (d) if structural resistance persists after 8 weeks, escalate to Executive Steering Board with options: extend opt-in period, increase Change Management budget (contingency draw), or adjust BRD scope to reduce workflow disruption.
Description: A privacy audit (internal or regulatory) discovers that offshore team members have access to PHI data that should be restricted to onshore US environments, forcing a pause on offshore development work until access controls are remediated.
Mitigation Strategy
- Data residency architecture designed in Phase 0: PHI is onshore-only by design; offshore resources work exclusively with synthetic/anonymized datasets.
- Access controls enforced through RBAC + network segmentation: offshore environments physically cannot reach PHI data stores.
- Data residency verified by Data Privacy Office (E. Sato) at Phase 0 and re-verified at each annual review.
- Offshore personnel complete mandatory data-residency briefing during onboarding.
Trigger Threshold
Any audit finding (internal or external) indicating that offshore personnel have accessed or could access PHI data.
Contingency / Fallback
If triggered: (a) offshore access to all program systems suspended within 4 hours pending investigation; (b) scope of exposure assessed; (c) HIPAA breach notification procedures activated if PHI was actually accessed; (d) access control remediation implemented and verified before offshore access restored; (e) incident report to Executive Steering Board and AI Governance Board.
Description: Executive Sponsor M. Kavanagh (ACME COO) departs mid-program due to career move, reorganization, or retirement. Replacement sponsor may not prioritize the AI investment, may not understand the governance structure, or may seek to re-scope the program — creating organizational uncertainty and potential budget/authority disruption.
Mitigation Strategy
- Governance structure (Charter, Governance Model) is documented thoroughly enough that a new sponsor can understand the program's authority framework without relying on institutional memory.
- Phase-gate authority is vested in the three boards, not in the sponsor individually — governance continues even during sponsor transition.
- New sponsor briefing process documented: a structured 90-minute briefing package (program overview, current status, governance structure, risk posture, budget position) ready for delivery within 48 hours of a successor announcement.
Trigger Threshold
Executive Sponsor announces departure or is replaced; OR ACME announces C-suite reorganization that could affect the COO role.
Contingency / Fallback
If triggered: (a) Program Director delivers new-sponsor briefing within first week; (b) CIO (R. Chen) serves as interim governance authority until new sponsor is established (pre-agreed with Executive Steering Board); (c) if new sponsor seeks material program changes (scope, budget, timeline), those changes go through formal change control — no informal re-scoping.
Description: Individual departments, business units, or IT teams deploy AI or ML initiatives outside the program's governance perimeter — either unaware of the governance requirement or deliberately circumventing it. Shadow AI creates regulatory exposure (ungoverned models making decisions without validation or audit trails), data governance gaps (PHI potentially exposed to unvetted tools), and architectural fragmentation (incompatible platforms, duplicated data pipelines). As enterprise AI awareness grows during the program, the pressure to "just deploy something quickly" outside governance will intensify.
Mitigation Strategy
- AI Governance CoE authority explicitly defined in the Charter and Governance Model: all AI initiatives at ACME must register with the CoE and comply with enterprise AI standards.
- Quarterly architecture reviews to detect unregistered AI workloads (IT Ops monitors cloud resource provisioning for AI/ML workloads not tagged to approved projects).
- Any ACME employee may report suspected shadow AI to the CoE — reports treated confidentially and assessed within 5 business days.
- Disposition process: identified shadow AI is evaluated within 10 business days and classified as fold-in (bring under governance), defer (halt and queue for post-program), or reject (halt permanently with documented justification).
- Escalation to Executive Sponsor for persistent non-compliance after notification.
Trigger Threshold
Any AI/ML workload identified in production or active development that is not registered in the program's model inventory; OR any department head resists CoE governance authority after formal notification.
Contingency / Fallback
If shadow AI is found in production: (a) assess risk exposure immediately (is it processing PHI? making decisions affecting members?); (b) if high-risk, recommend suspension to Executive Sponsor; (c) if low-risk, bring under governance with minimal disruption; (d) document the incident and root cause (awareness gap vs. deliberate circumvention) and adjust prevention approach accordingly.
Assumptions
| ID | Assumption | Owner | Validation Point |
|---|---|---|---|
| A-01 | ACME member volume and PA case mix remain stable: approximately 4M members, 800K annual PA cases. Material volume changes (>10%) would require re-baselining model training data and capacity planning. | C. Tyrrell | Quarterly volume check against Charter baseline |
| A-02 | State regulatory environment remains stable within current risk envelope. New AI-in-insurance mandates or CMS guidance changes are absorbed through CoE standards updates, not model redesigns (unless mandated). | R. Thorne | Quarterly regulatory tracker review |
| A-03 | Cloud/LLM vendor ecosystem remains viable and accessible through program duration. No major platform discontinuations, pricing shocks (>20%), or access restrictions requiring platform migration. | W. Kumar | Monthly vendor performance reviews |
| A-04 | ACME executive commitment (budget, staffing, governance participation) remains through all three years. Budget re-authorization for Years 2 and 3 proceeds as planned at respective Phase 4 gates. | M. Kavanagh | Annual budget re-authorization at Phase 4 gates |
| A-05 | ACME's separate CMS-0057-F baseline compliance project delivers FHIR API endpoints on schedule, independent of Project Catalyst. BRD-01 integration testing depends on these endpoints being available. | R. Thorne | Monthly dependency check with baseline project PM |
| A-06 | Historical data (claims, PA, underwriting, call transcripts) is available at sufficient volume and quality for model training — minimum 3-year history, covering seasonal and demographic variation. | W. Kumar | Phase 0 data profiling results (validates or invalidates) |
Issue Log
| ID | Issue | Owner | Status | Target Resolution | Resolution |
|---|---|---|---|---|---|
| I-01 | Phase 0 data profiling revealed higher-than-expected data quality gaps in legacy claims system — approximately 12% of claims records require identifier mapping remediation, approaching the 15% trigger threshold for R-01. | T. Valdez | Open | Phase 0 Gate (06 Nov 2026) | Remediation scope under assessment; 3 data engineers allocated; decision pending on D-01 contingency utilization. |
| I-02 | Initial hyperscaler platform quote ($31.4M) exceeded the $26.9M cloud/platform budget allocation by 17%. Requires either vendor negotiation or architecture adjustment. | W. Kumar | Open | Phase 0 Gate | Multi-cloud strategy adopted (CN-003) to enable competitive pricing. L. Park negotiating volume discount with primary vendor. Fallback: reduce reserved-instance commitment and use more spot/preemptible instances. |
| I-03 | Two BRD-01 ML engineer candidates (offshore) declined offers due to competing opportunities. Replacement sourcing in progress — 2-week delay to team ramp-up. | C. Tyrrell | In Progress | 01 Oct 2026 | Pulaski recruiting team sourcing replacements. Backup: reallocate 2 platform engineers temporarily during Phase 0 while recruitment completes. |
| I-04 | ACME's medical policy documents are stored as PDF files without machine-readable structure. BRD-01 and BRD-02 require these policies in structured format for NLP and RAG retrieval. Conversion effort not originally scoped. | F. Bennett | Open | Phase 1 Gate (28 Feb 2027) | Assessing scope of conversion effort. Options: (a) manual conversion by ACME Medical Policy team, (b) automated PDF-to-structured conversion using NLP, (c) hybrid approach. Scope and cost estimate due by 15 Oct 2026. |
Dependency Log
| ID | Dependency | Owner | Status | Impact if Missed |
|---|---|---|---|---|
| DEP-01 | CMS-0057-F prior-auth interoperability mandate (effective Jan 2027) is an external regulatory driver. ACME's separate baseline compliance project must deliver FHIR API endpoints independently of Project Catalyst. | R. Thorne | On Track | BRD-01 integration testing delayed; PA API features cannot be verified against live endpoints |
| DEP-02 | AI Governance & CoE Charter completion (Phase 0) is prerequisite for BRD-01 JAD sessions and model governance gate setup (Phase 1). | S. Khurana | On Track | JAD sessions cannot proceed; Phase 1 gate delayed |
| DEP-03 | Data & Cloud Platform Foundation must go live (target Mar 2027) before BRD-01 model build accelerates in Phase 2. | W. Kumar | On Track | BRD-01 development constrained to local/sandbox environments; production deployment blocked |
| DEP-04 | Hyperscaler vendor infrastructure provisioning must meet Phase 0 timelines (environments available by Oct 2026). | L. Park | At Risk | Platform Foundation delayed; cascade to BRD-01 build timeline. Related to I-02 (vendor pricing issue). |
| DEP-05 | LLM provider API access and terms must remain stable through Year 1 for BRD-01 and BRD-02 model development. Significant pricing changes or service discontinuation would disrupt model architecture. | W. Kumar | On Track | Model architecture changes; potential vendor switch; 4-8 week delay if migration required |
Decision Log
| ID | Decision | Decided By | Date | Rationale |
|---|---|---|---|---|
| D-01 | Pre-approve contingency utilization of up to $1.2M for extended data remediation if Phase 0 profiling identifies scope beyond initial estimate. Activation requires Program Director + CFO approval with documented root cause. | Executive Steering Board | 03 Aug 2026 | R-01 is highest-scored risk (9/9); pre-approval avoids decision latency if the risk materializes during Phase 0. See CN-001. |
| D-02 | Establish Independent Model Validation (P. Okafor, separate team) as the second line of defense in the two-line-of-defense model risk structure. No model reaches production without clean validation sign-off. Validation team reports to AI Governance Board, NOT to BRD delivery leads. | AI Governance Board | 10 Aug 2026 | Structural separation eliminates conflict of interest between delivery schedule and validation rigor. Modeled on OCC SR 11-7 (financial services model risk guidance). See CN-002. |
| D-03 | Adopt multi-cloud strategy for Platform Foundation: workloads distributed across AWS/GCP/Azure based on cost and capability rather than single-vendor commitment. Primary vendor selected for default workloads; secondary vendors for cost optimization and contingency. | Enterprise Architecture Board | 24 Aug 2026 | Initial single-vendor quote ($31.4M) exceeded budget by 17%. Multi-cloud reduces negotiating-leverage risk and enables cost optimization. See CN-003 and I-02. |
| D-04 | BRD-03 (Underwriting & Risk AI) will use gradient boosted ensemble (GBE) model architecture rather than deep learning, based on explainability requirements, regulatory defensibility, actuarial acceptance, and data scale appropriateness. | AI Governance Board | 17 Aug 2026 | GBE produces native feature importance (SHAP); more interpretable to actuarial examiners and state regulators than neural networks; performs well at ACME's data scale without overfitting. See BRD-03 §6.2. |
Update cadence: Risk owners update their assigned risks weekly. PMO flags stale entries (>14 days without update). Quarterly formal review by all 3 governance boards refreshes the entire log. This log is the system of record referenced by the Program Management Plan (§12), Governance Model (§10.4), and Change Control Log.