An AI incident post-mortem should include?

An AI incident post-mortem should include?

• A. Root cause, impact assessment, corrective actions, lessons learned, and governance actions to prevent recurrence.
• B. The incident's impact on stock price.
• C. The weather on incident day.
• D. A summary of future marketing plans.

Answer: (A)

The main concept is that a robust AI incident post-mortem records what happened, why it happened, and how to prevent recurrence by detailing root cause, impact, corrective actions, lessons learned, and governance actions. Documenting the root cause is essential because it identifies the underlying failure or gap in design, data, processes, or safeguards that allowed the incident to occur. The impact assessment matters to understand who or what was affected, the severity, and the scope of harm or risk, which guides prioritization of fixes and accountability. Corrective actions translate insights into concrete steps to fix the issue and reduce the chance of recurrence, addressing both technical remediation and process changes. Lessons learned capture knowledge that can improve future responses, ensuring the team retains experience and avoids repeating mistakes. Governance actions tie the incident to organizational policies, standards, and oversight, ensuring changes are integrated into risk management, remaining auditable, and enforced across teams. Other options don’t fit because a post-mortem is not about external financial metrics like stock price, nor about weather conditions on the day, nor about future marketing plans. Those elements are outside the incident analysis and learning focus.

The main concept is that a robust AI incident post-mortem records what happened, why it happened, and how to prevent recurrence by detailing root cause, impact, corrective actions, lessons learned, and governance actions.

Documenting the root cause is essential because it identifies the underlying failure or gap in design, data, processes, or safeguards that allowed the incident to occur. The impact assessment matters to understand who or what was affected, the severity, and the scope of harm or risk, which guides prioritization of fixes and accountability. Corrective actions translate insights into concrete steps to fix the issue and reduce the chance of recurrence, addressing both technical remediation and process changes. Lessons learned capture knowledge that can improve future responses, ensuring the team retains experience and avoids repeating mistakes. Governance actions tie the incident to organizational policies, standards, and oversight, ensuring changes are integrated into risk management, remaining auditable, and enforced across teams.

Other options don’t fit because a post-mortem is not about external financial metrics like stock price, nor about weather conditions on the day, nor about future marketing plans. Those elements are outside the incident analysis and learning focus.