Risky algorithms

Risky algorithms

As algorithms become more sophisticated, the risk of spreading hidden bias in organisational decision-making is increasing, according to a recent paper contained in the Canadian Institute of Actuaries’ newsletter Enterprise risk management 2019: the new wave of risks. Alogorithms are becoming increasingly embedded in business processes. Machine-learning algorithms tend to break away from the rules…

As algorithms become more sophisticated, the risk of spreading hidden bias in organisational decision-making is increasing, according to a recent paper contained in the Canadian Institute of Actuaries’ newsletter Enterprise risk management 2019: the new wave of risks.

Alogorithms are becoming increasingly embedded in business processes. Machine-learning algorithms tend to break away from the rules they were initially programmed to follow, and may create novel rules based on the data they have analysed. This can inject opacity in the decision-making process, according to  an article in the newsletter, ‘Algorithms gone wild’, by Saisai Zhang a senior consultant in actuarial, rewards and analytics at Deloitte.

Take away

“The key takeaway is that companies should strive to understand why opacity exists,” writes Zhang, “and situate it in the context where algorithms are deployed, rather than taking opacity as an inherent trait. Targeted risk management strategies, such as algorithm audit or validation, can be devised to effectively mitigate potential losses.”

Algorithms have been found to be at the base of gender and racial baises in a wide range of applications, suggesting that they may reflect the subconscious prejudices of their programmers. Because the way that algorithms come to decisions can be impossible to trace, their use could be restricted under regulations such as the EU’s General Data Protection Regulation (GDPR).

“GDPR poses restrictions on algorithms that make decisions based on user-level inputs, stressing an individual’s ‘right to explanation’ when subjected to an algorithmic decision that significantly affects them,” writes Zhang. “Most importantly, it explicitly states that an individual shall have the right not to be subject to a decision based ‘solely’ on auto- mated processing, including profiling.”

Questions for businesses

Are companies aware of the presence of algorithmic risks?

  • How do companies develop policies and cultivate a corporate culture that ensures algorithmic risks are understood across its functions?
  • What does an effective algorithmic risk management framework look like?
  • What are the ethical considerations surrounding automated decision-making, including data collection and privacy concerns?
  • Who are the right talents in the era of algorithms?
  • How do we retain full control over the technologies that are impacting our lives and making the decisions for us?

Other articles in the newsletter include, reflection and advice on the legalisation of cannabis in Canada; advancing an organisation’s enterprise risk management capabilities; and building a strong risk culture.

To read more, follow this link.





← Previous

Using scenarios to quantify corporate risks
By Lee Coppack Consumer spending comprises more than 50 per cent of gross domestic product…






Next →

Risk maturity lags behind developing threats
Regulatory risk and economic uncertainty have topped a poll conducted by the consultancy Protiviti as…

7 OCTOBER 2026

Key elements of a mature programme risk capability

Hosted by Vinay Shrivastava. Vinay's presentation will cover lessons he has learned over the course of his career. These insights will be shared using the principles of ISO31000 risk management.

Find out more

8 OCTOBER 2026

Pre-deployment agentic risk management

Delivered by Adam Grainger, the outcome of this session is to be able to support an agentic implementation with effective pre-deployment risk identification and mitigation.

Find out more

14 OCTOBER 2026

AI Transforming Enterprise Risk Management Activities

Risk management has changed considerably over the years, with new frameworks, standards and expectations shaping the way organisations manage risk. However, many of the day-to-day activities within Enterprise Risk Management (ERM) functions have remained much the same.

Find out more

Advertisement