Read a federal AI risk assessment: the missing-evidence test

Read three documents as one decision record

A published impact level answers a narrow question: which risk band did the assessment assign to this system? It does not tell you whether a claimant can challenge an error, whether a reviewer can overrule the software, or whether the assessment still describes the version in use. Those questions need evidence underneath the number.

We compared Treasury Board’s scope guide, Algorithmic Impact Assessment guidance and peer-review guide. They serve different purposes. Start with scope to understand the decision being automated; use the assessment to locate its declared risks; use the review record to see which claims were challenged. The reading method below is our analysis of those documents, not an official assessment or a finding about a department.

The document comparison: applicability, answers and scrutiny

A project description can hide a consequential step behind a mild verb. “Organizes applications” might mean alphabetizing names or assigning a priority that changes how long somebody waits. Ask what happens to a person when the output changes. Preserve the exact workflow description rather than replacing it with a model name.

Scroll the table sideways to see every column.

A person signing the result does not end the scope inquiry

The scope guide covers assistance with judgment in an administrative decision as well as a fully automated outcome. Its applicability conditions also concern the institution, timing and use of the system. A pilot used on real clients needs a different analysis from an isolated experiment with invented records. This is why “a human makes the final call” is an incomplete scope argument.

For your own reading notes, write a single sentence with a subject, action and consequence: “The service uses a score to move an application behind other applications before an officer sees it.” If the public description cannot support that sentence, mark the workflow unknown. Do not fill the gap with a reassuring assumption or declare a breach from missing documentation alone.

Case file: Northern Access Triage

Northern Access Triage is a fictional heating-assistance queue. An invented system reads application notes and suggests which files need follow-up. Officers retain the formal award decision. We have no applicant data, no official questionnaire answers and no measured outcomes; assigning this imaginary project an impact level would pretend to know things we do not.

Consider a note saying that a tenant cannot obtain a document because the landlord is unreachable. If the system turns that explanation into “applicant unresponsive,” the queue can delay the wrong person without ever issuing a refusal. A reviewer needs to see the original note and be able to correct both the label and its effect on the queue. Correcting the text alone leaves the consequence intact.

Scroll the table sideways to see every column.

The arithmetic has a boundary

The official tool contains 65 risk questions and 41 mitigation questions. Its scoring guidance distinguishes raw risk from mitigation and describes when a mitigation score reduces the current score. Use the official questionnaire for that calculation; our invented case is deliberately unscored.

The official instructions say to choose the lowest-score option when an answer is unknown and to be ready to provide documentary evidence on request. Keep a separate unknowns list: a precise score can conceal unanswered factual questions. The guidance also requires reassessment as the system changes. An old published record describes an old workflow until someone establishes that it still matches the deployed system.

Peer review should leave a trail you can follow

The peer-review guide calls for review at impact levels II, III and IV, with at least one expert at levels II and III and at least two at level IV. It also addresses conflicts of interest and supporting documentation. Those are requirements about scrutiny; they are not evidence that a particular implementation passed it.

Read a finding, the department’s response and the remaining condition together. “Improve explanations” is less informative than a finding tied to a specific unsupported label, a change to the interface and a retest. If only a summary is public, note what the summary cannot establish. Do not describe absent technical details as independently verified.

AI purchasing evidence packTurn the unanswered review questions into records to request from a supplier.

A reusable reading note

Keep your conclusion smaller than the available evidence. A reader may be able to confirm that a risk file exists while remaining unable to judge data quality or recourse. That is a useful result: it identifies the next document to request instead of reducing an entire system to a green tick.

• Match the assessment to the live system before interpreting its score.
• Check one consequential answer against its underlying evidence.
• Keep facts you could verify separate from questions you would send to the department.

System and version: __. Decision affected: __. Scope evidence: __. Published AIA date and impact level: __. One material answer and its supporting record: __. Peer-review finding and response: __. What changed since assessment: __. Unanswered question and responsible contact: __.