【Risk Management】Cognitive risk management

Commercial Applications of NLP Technology

introduce

Machine learning (ML) applications have become ubiquitous. Every day brings news about artificial intelligence for self-driving cars, online customer support, virtual personal assistants, and more. However, it may not be obvious how to connect existing business practices to all these amazing innovations. An often overlooked area is applying natural language processing (NLP) and deep learning to help process large volumes of business documents quickly and efficiently, thereby finding the needle in the haystack.

One of the areas that allows for the organic application of machine learning is the risk management of financial institutions and insurance companies. Organizations face many questions on how to apply machine learning to improve risk management. Here are just a few of them:

• How to identify impactful use cases that could benefit from using AI?

• · How to bridge the gap between the intuitive expectations of the subject matter experts and the technical capabilities?

• · How to integrate ML into existing enterprise information systems?

• · How to control the behavior of machine learning models in production environment?

This article aims to share the experience of the IBM Data Science and AI Elite (DSE) and IBM Expert Labs teams, based on multiple client engagements in the risk control area. IBM DSE has built various accelerators that can help organizations quickly start adopting ML. Here, we present use cases in the risk management space, introduce cognitive risk control accelerators, and discuss how machine learning is changing enterprise business practices in this space.

Risk Management Sketch

In 2020, many financial institutions were fined more than hundreds of millions of dollars each. The reason for the fine was insufficient risk control status.
This has sparked calls for financial firms to ensure the high quality of the large risk controls they must use. This includes clearly identifying risks, implementing risk controls to prevent their development, and ultimately establishing testing procedures.

Risk control is a bit confusing to the non-professional. What is this about? A simple definition is the implementation of risk controls to monitor the risks of a company's business operations. For example, a security risk could be an intruder guessing a password and thus gaining access to someone's account. Possible risk controls could be designed to establish a policy that requires long and important passwords to be enforced through the organization's systems. As a result of the Sarbanes-Oxley Act (SOX), public companies need ways to effectively manage such risks as part of their efforts to establish risk controls and assess the quality of those controls.
An important factor for risk managers is whether controls are well defined. Assessment of this can be done by answering questions such as who monitors the risk, what should be done to identify or prevent it, how often control procedures should be implemented in the life cycle of the organization, etc. All these questions should be answered. Now we need to realize that the number of such controls in the enterprise ranges from thousands to hundreds of thousands, and it is very difficult to manually evaluate the control corpus. This is where contemporary AI technology can help.
Of course, this type of challenge is just one example and it would be impractical to try to cover the broad area of ​​risk management in one article, so we focus on some specific challenges that practitioners face in their daily practice and already use cognitive risk Control accelerator implementation.
There are not many public risk control databases available, so the solutions in the accelerator are based on security controls from NIST Special Publication 800-53, available at https://nvd.nist.gov/800-53. This database of safety controls is small, but it allows us to demonstrate methods that can be extended to a large number and different domains of risk controls.

Risk Control Using Text Analytics and Deep Learning

One of the key use case categories is rationalizing existing risk controls: The challenge is that there may be many historical aspects to how existing risk controls were developed. For example, some risk controls can be constructed by duplicating other existing controls with minimal modification. As another example, some risk controls can be formed by combining multiple risk controls into one. A common consequence of this approach is the existence of duplicate controls and controls that are no longer relevant to the business. One of the most difficult challenges is assessing the overall quality status of existing risk controls. Therefore, from a business point of view, the first goal is to establish quality assessment: automatic assessment controls the quality of descriptions, saving a lot of time in daily description reading by focusing only on those that really need to be reviewed and improved. A good question is how did artificial intelligence come about here. NLP-based ML models have become very effective in common language-related tasks, especially in challenges such as question answering. One model that can be referenced here is based on the Transformer architecture (for more details see the article on Transformer architecture at https://medium.com/inside-machine-learning/what-is-a-transformer-d07dd1fbec04 ).

In risk management drafting, the ability to answer questions about risk control descriptions is key to assessing the quality of control descriptions. From a bird's-eye view, the number of unanswered questions is a good indicator for controlling the quality of descriptions. The best news is that, with the power of contemporary AI models such as Transformers and additional practical rules, this technique of asking the right questions becomes an effective mechanism for controlling large numbers of control descriptions by a small team with the help of AI.

• Controls Quality Assessment (image by authors)

Often, finding duplicates in documents is considered an easy task, and Levenshtein Distance can help find items expressed with similar wording. However, it becomes a more challenging task if we want to find semantically similar descriptions. This is another area where contemporary AI can help - embeddings built using large neural networks (e.g. autoencoders, language models, etc.) can capture semantic similarity. From a practical outcome standpoint, our experience is that duplicate and overlapping identifications can lead to control volume reductions of up to 30%.

• Analysis of Overlaps (image by authors)

Furthermore, it has become a common practice to analyze the internal structure of information through machine learning techniques such as clustering. This enables business practitioners to better understand the larger-scale control content and see whether existing risk and control taxonomies align with the content, or what may be missing in both.

• Clustering Example (image by authors)

Previous use cases have mainly focused on the analysis of existing controls. Another use case focuses on helping risk managers create new risk controls. Using semantic similarity to recommend controls for a given risk can significantly reduce manual work and provide flexible templates for building controls. Machine learning can help analyze risk profiles and figure out the correct set of controls to address each risk.
In large organizations, teams often work on solutions and best practices that other teams may use. Adopting best practices across an organization requires extensive training. Machine learning is very useful in this situation. An example might be to classify controls as preventive or detective. In this use case, we use supervised machine learning to extend control classification to the entire set of controls by using an existing set of labels from a specific team, i.e. using machine learning to accomplish knowledge transfer rather than time-consuming human training.
The cognitive technologies in the IBM DSE Risk Control Accelerator enable us to structure risk controls, recommend risk controls expressed in natural language, identify overlaps in controls, and analyze the quality of controls.
The accelerator provides a Cognitive Control Analytics application that integrates developed models and applies them to unstructured risk control content.

Implement cognitive risk controls with IBM Cloud Pak for Data

Logically, the Cognitive Risk Control Accelerator consists of several components:

• The first is the so-called Cognitive Assistant – an application that applies ML models to facilitate content processing, for example, by identifying risk control priorities, categories and evaluating the quality of control descriptions. As part of productization, cognitive assistants become part of enterprise information systems.

• The second component is content analysis: when data is enriched by machine learning models, Watson Discovery content mining can be used to find insights in the enriched content

Content Analysis with Watson Discovery (image by authors)

• Another component is a set of Jupyter notebooks supporting data science models

• Jupyter Notebook in Watson Studio (image by authors)

Let's look under the hood of an accelerator-based implementation using IBM Cloud Pak for Data.
Before we do so, let's briefly review the IBM platform and approach. IBM has a prescriptive approach for the AI ​​journey called the AI ​​Ladder. In his "The AI ​​Ladder: Demystifying AI Challenges," Rob Thomas (Senior Vice President, IBM Cloud and Cognitive Software) confirms that to turn your data into insights, your organization should follow the stage:

• Collection – the ability to easily access data, including data virtualization

• Organization—the method of cataloging data, building a data dictionary, and ensuring rules and policies for accessing data

• Analytics - This includes delivering machine learning models, using data science to identify insights using cognitive tools and artificial intelligence techniques. This naturally entails building, deploying and managing your machine learning models

• Injection - This is a critical stage from many perspectives. This refers to the ability to operate AI models in a way that allows the business to trust the results, i.e. use your machine learning models in enterprise systems in production mode, while being able to ensure the continued performance of these models and their interpretability.

Cloud Pak for Data is IBM's multi-cloud data and AI platform that provides the information architecture and provides all the outlined capabilities. The diagram below captures the details of an implementation developed in the context of AI Ladder.

• Phases (image by authors)

It captures the stages of implementing a cognitive risk control project based on the DSE Accelerator:

• The first two phases of implementing a risk control project are acquiring and cataloging datasets—for example, in the accelerator, we use the NIST control dataset. Controls here are represented as free text descriptions.

• The next stage is to enrich acquired unstructured data in Watson Studio: clustering is used as a way to understand the internal structure of the content. Risk control narratives can be long and may discuss multiple topics, so mechanisms may be needed to track changing topics as the description progresses. In our clustering practice, we use K-means on top of embeddings and Latent Dirichlet Allocation (LDA). It does require careful coordination of data scientists and subject matter experts, as the math may not match the expectations of SMEs. Broader enrichment can also be done here - a good example is categorizing the quality of descriptions.

Topic Modeling (image by authors)

• After augmentation is complete, we need to understand the resulting dataset. This leads us to the exploration phase. In practice, the challenge is volume. Content review is one of the most time-consuming processes as it requires perusing large volumes of text. How do we explore vast amounts of unstructured information? Watson Discovery content mining is the tool that makes this possible and greatly reduces the effort.

• After the content has been vetted by SMEs, it forms the basis for building supervised machine learning models. The IBM platform provides the means to deploy models, monitor for bias, and gain explainability for complex model decisions. All included in Operationalization of Machine Learning, powered by IBM Cloud Pak For Data.

in conclusion

This article introduces one of the growing areas of application of machine learning in contemporary business - cognitive risk control.

This article: https://architect.pub/cognitive-risk-management
Discussion: Knowledge Planet [Chief Architect Circle] or add WeChat trumpet [ca_cto] or add QQ group [792862318]
No public	【jiagoushipro】 【Super Architect】 Brilliant graphic and detailed explanation of architecture methodology, architecture practice, technical principles, and technical trends. We are waiting for you, please scan and pay attention.
WeChat trumpet	[ca_cea] Community of 50,000 people, discussing: enterprise architecture, cloud computing, big data, data science, Internet of Things, artificial intelligence, security, full-stack development, DevOps, digitalization.
QQ group	[285069459] In-depth exchange of enterprise architecture, business architecture, application architecture, data architecture, technical architecture, integration architecture, security architecture. And various emerging technologies such as big data, cloud computing, Internet of Things, artificial intelligence, etc. Join the QQ group to share valuable reports and dry goods.
video number	[Super Architect] Quickly understand the basic concepts, models, methods, and experiences related to architecture in 1 minute. 1 minute a day, the structure is familiar.
knowledge planet	[Chief Architect Circle] Ask big names, get in touch with them, or get private information sharing.
Himalayas	[Super Architect] Learn about the latest black technology information and architecture experience on the road or in the car.	[Intelligent moments, Mr. Architecture will talk to you about black technology]
knowledge planet	Meet more friends, workplace and technical chat.	Knowledge Planet【Workplace and Technology】
LinkedIn	Harry	https://www.linkedin.com/in/architect-harry/
LinkedIn group	LinkedIn Architecture Group	https://www.linkedin.com/groups/14209750/
Weibo‍‍	【Super Architect】	smart moment‍
Bilibili	【Super Architect】
Tik Tok	【cea_cio】Super Architect
quick worker	【cea_cio_cto】Super Architect
little red book	[cea_csa_cto] Super Architect
website	CIO (Chief Information Officer)	https://cio.ceo
website	CIOs, CTOs and CDOs	https://cioctocdo.com
website	Architect practical sharing	https://architect.pub
website	Programmer cloud development sharing	https://pgmr.cloud
website	Chief Architect Community	https://jiagoushi.pro
website	Application development and development platform	https://apaas.dev
website	Development Information Network	https://xinxi.dev
website	super architect	https://jiagou.dev
website	Enterprise technical training	https://peixun.dev
website	Programmer's Book	https://pgmr.pub
website	developer chat	https://blog.developer.chat
website	CPO Collection	https://cpo.work
website	chief security officer	https://cso.pub    ‍
website	CIO cool	https://cio.cool
website	CDO information	https://cdo.fyi
website	CXO information	https://cxo.pub

Thank you for your attention, forwarding, likes and watching.