Learning Objectives

After completing this lecture, you will be able to:

• Understand the key concepts of minimum risk management practices in a government context
• Participate in structured workshop activities with real-world scenarios
• Connect minimum risk management practices to your agency's AI initiatives
• Identify next steps for applying these concepts in your role

Key Topics Covered

-
Required safeguards under OMB guidance

-
Implementation checklist

-
Gap analysis for your current systems

Why This Matters for Government

Government agencies face unique challenges when it comes to AI adoption. This lecture addresses these challenges head-on by providing analysts, project leads, team supervisors with the knowledge and frameworks needed to navigate AI in the public sector responsibly and effectively.

As part of the L2 (AI Practitioner) curriculum, this lecture builds on the foundational principle that every AI system in government ultimately serves citizens. Whether you are working with AI tools daily or setting strategy for your agency, understanding minimum risk management practices is essential for responsible, effective government AI adoption.

======================================================================

TRANSCRIPT: Minimum Risk Management Practices

======================================================================

Chapter: 3

What you will learn:

• OMB M-24-10 minimum practices requirements
• What safeguards and controls are required for AI systems
• Implementation of governance controls
• Documentation and transparency practices
• Testing and monitoring requirements
• How to implement minimum practices across your agency

OMB M-24-10 doesn't just require agencies to have governance structures and inventories. It requires agencies to implement specific minimum risk management practices--fundamental safeguards that every responsible government AI system should have.

Think of minimum practices as the floor. They're the baseline that every agency must meet. But they're not arbitrary requirements. They're distilled from hard experience--cases where AI systems caused problems that could have been prevented by implementing these basic safeguards.

This lecture covers what these minimum practices are, why each one matters, and how to implement them. By the end, you'll understand the specific controls your agency needs to put in place, and you'll be able to guide implementation.

WHY THIS MATTERS FOR GOVERNMENT

Before OMB M-24-10, agencies approached AI governance inconsistently. Some had thoughtful, comprehensive approaches. Others treated AI like any other IT system, applying frameworks designed for databases and software, not for systems making consequential decisions.

The result was scattered risk management. Some agencies were doing impact assessments. Others weren't. Some were monitoring systems continuously. Others did nothing until problems emerged. Some had human oversight and appeal mechanisms. Others deployed fully-automated systems without safeguards.

OMB M-24-10 leveled the playing field by establishing minimum practices that all federal agencies must implement. These aren't high bars--they're floors. But they ensure that no agency is flying blind with AI.

WHAT ARE MINIMUM PRACTICES?

OMB identifies the following minimum practices that agencies must implement:

• Governance and accountability structures
• Documentation and transparency
• Testing for bias and performance
• Human review and override
• Ongoing monitoring and performance assessment
• Incident response and escalation

Let's explore each one in detail.

GOVERNANCE AND ACCOUNTABILITY STRUCTURES

Minimum practice: Every AI system must have clear governance that establishes decision rights, assigns responsibility, and creates accountability.

What this means:

• Clear ownership: Every AI system must have a designated owner--a specific person or team responsible for the system's performance, updates, and compliance.
• Decision rights: It must be clear who decides what about the system. Who approves deployment? Who approves changes? Who decides to escalate or retire the system?
• Governance review: Systems must be reviewed through governance processes before deployment and periodically afterward. Not every system needs the same level of review, but there must be a process.
• Escalation paths: It must be clear how concerns about the system get escalated. If a team member notices a problem, there must be a way to raise it. If that path leads nowhere, there must be an additional escalation path.

Implementation approach:

• Document role assignments for each system (owner, data steward, fairness lead, etc.)
• Create governance templates (impact assessment template, monitoring plan template)
• Establish standard review cadence (quarterly? annually?)
• Create escalation procedures and communicate them

DOCUMENTATION AND TRANSPARENCY

Minimum practice: AI systems must be documented adequately, and people affected by systems must have transparency about how decisions are made.

What this means:

For system documentation:

• What the system does: Clear description of system purpose and what it's designed to accomplish
• How it works: Technical documentation of how decisions are made (not necessarily source code, but the decision logic)
• What data it uses: Documentation of data sources, data characteristics, known limitations
• How it performs: Performance metrics and their results
• What could go wrong: Known failure modes and limitations
• How it's been tested: What testing was conducted? What were results?

For transparency to affected people:

• Notice: People should know when AI is being used to make decisions affecting them
• Explanation: People should understand how decisions are made (in plain language, not just technical explanations)
• Appeal: People should be able to contest decisions and ask for human review
• Redress: If a system caused harm, there should be a process to address it

Implementation approach:

• Create documentation templates and require completion before deployment
• Publish accessible explanations of how high-impact systems work
• Establish appeal processes and communicate them to affected populations
• Create feedback mechanisms so affected people can report problems
• Respond to complaints and escalate serious issues

TESTING FOR BIAS AND PERFORMANCE

Minimum practice: Before deployment and periodically afterward, AI systems must be tested for performance, accuracy, and bias.

What this means:

Pre-deployment testing:

• Accuracy assessment: Does the system produce accurate predictions? Test on representative data.
• Fairness assessment: Does the system produce equitable outcomes across demographic groups? Test for disparate impact.
• Edge case testing: How does the system handle unusual or extreme inputs?
• Adversarial testing: Can the system be tricked or manipulated?
• Data quality validation: Is the training data appropriate? Are there known quality issues?

Ongoing testing:

• Performance monitoring: Does the system continue to perform as expected in production?
• Drift detection: Has performance degraded over time?
• Fairness monitoring: Are outcomes still equitable?

Implementation approach:

• Develop testing plans before deployment (specify what will be tested, success criteria)
• Use testing tools and frameworks (fairness toolkits, model monitoring platforms)
• Document test results and use them to inform decision about deployment
• Establish monitoring dashboards for ongoing assessment
• Create alerts for performance degradation or fairness problems

HUMAN REVIEW AND OVERRIDE

Minimum practice: For consequential decisions, humans must be involved in the decision-making process and must be able to override AI recommendations.

What this means:

• Human-in-the-loop: For high-impact decisions, humans review and approve AI recommendations before implementation
• Override capability: Humans can reject AI recommendations and make different decisions
• Meaningful human review: The human review isn't just rubber-stamping what the AI recommends. Humans must have the tools and training to actually evaluate the AI's recommendation

Implementation approach:

• Define which types of decisions require human review (vs. which can be fully automated)
• Design human review workflows (how is the case presented to the human? what information do they need?)
• Ensure humans have access to AI reasoning (why did the system recommend this?)
• Track how often humans overrides AI (if it's never, maybe humans aren't really reviewing; if it's always, maybe the AI isn't valuable)
• Provide training so humans understand both the AI system's strengths and its limitations

ONGOING MONITORING AND PERFORMANCE ASSESSMENT

Minimum practice: After deployment, AI systems must be continuously monitored to ensure they continue to perform acceptably.

What this means:

• Performance measurement: Regular measurement of accuracy, fairness, and other key metrics
• Drift detection: Early detection of performance degradation
• Outcome tracking: Understanding whether the system is achieving its intended outcomes
• Population-level monitoring: Understanding whether outcomes are equitable across populations
• Feedback loops: Using feedback from people affected by the system to improve it

Implementation approach:

• Establish monitoring dashboards for each high-risk system
• Define alert thresholds (if metric exceeds X, escalate)
• Create feedback mechanisms (how do people report problems?)
• Establish regular review meetings (monthly? quarterly?) to discuss monitoring results
• Use monitoring data to inform updates and improvements

INCIDENT RESPONSE AND ESCALATION

Overview

Minimum practice: When problems are discovered, there must be clear processes for responding and escalating.

What this means:

• Detection: Mechanisms to identify problems (monitoring, user reports, audits)
• Escalation: Clear paths to escalate problems to leadership
• Investigation: Resources to understand what went wrong
• Remediation: Plans to fix problems and prevent recurrence
• Communication: Notification of affected people when problems are discovered
• Learning: Using incidents to improve processes

Implementation approach:

• Document the incident response process and communicate it widely
• Establish incident response teams and define roles
• Create incident tracking systems
• Establish communication templates for affected populations
• Conduct retrospectives to improve processes
• Track incidents to identify patterns and systemic issues

PRACTICAL USE CASE 1: Compliance Implementation

An agency audits its AI systems against OMB minimum practices. They find significant gaps:

• No governance ownership for several systems
• Minimal documentation
• No fairness testing
• No monitoring in place
• No incident response process

Over 12 months, they:

• Assign owners to all systems
• Create and complete documentation for systems
• Conduct fairness audits
• Implement monitoring dashboards for high-risk systems
• Develop incident response procedures

Result: Systems move from unmanaged to managed. Problems can be detected and addressed proactively.

PRACTICAL USE CASE 2: New System Implementation

An agency is deploying a new rights-impacting AI system. They use minimum practices as requirements:

Pre-deployment:

• Document what the system does and how it works
• Test for accuracy and fairness
• Design human review workflows
• Create monitoring plan
• Establish appeal process

Deployment:

• Implement with human review required
• Activate monitoring dashboards
• Communicate to affected populations about the system and appeals process

Post-deployment:

• Monitor performance weekly
• Review monthly with governance team
• Conduct fairness audit quarterly
• Accept and respond to appeals and feedback

Result: System operates with appropriate safeguards and oversight.

ANTI-PATTERNS AND MISUSE RISKS

Risk 1: Minimum as Maximum

Treating minimum practices as sufficient, rather than as a floor. Minimum practices are necessary but not sufficient. Better AI governance exceeds minimums.

Avoid by: Using minimums as baseline. Build beyond them. Invest in additional practices that improve outcomes.

Risk 2: Compliance Without Understanding

Implementing minimum practices to check boxes for compliance, without understanding why each practice matters. Documentation is created but not useful. Monitoring happens but drives no decisions.

Avoid by: Teaching your team why each practice exists. Connect practices to outcomes.

Risk 3: Practice Without Support

Establishing minimum practices but not providing resources or support for implementation. Busy teams are expected to document, test, and monitor without being given time or tools.

Avoid by: Allocating resources. If monitoring is required, provide monitoring tools or staff time. If testing is required, provide testing frameworks and training.

Risk 4: Uneven Implementation

Implementing minimum practices for some systems but not others. Over time, unmanaged systems create problems that undermine trust in the overall AI program.

Avoid by: Ensuring minimum practices are applied consistently. Start with highest-risk systems, then expand. All systems should eventually be in scope.

PRACTICE AND REFLECTION PROMPTS

Prompt 1: Minimum Practice Audit

Audit one of your AI systems against the seven minimum practices. Document where it meets requirements and where gaps exist.

Prompt 2: Implementation Plan

For one of the gaps from Prompt 1, design an implementation plan. What would be required to meet that practice? Who would do the work? How long would it take?

Prompt 3: Governance Integration

How would you integrate minimum practices into your agency's governance structures (from lecture 2.3.1)? What governance decisions enforce minimum practices?

Prompt 4: Escalation Design

Design an escalation and incident response process for your agency. What's the first step when someone reports a problem? Where does it go if not resolved locally?

Prompt 5: Staffing and Resources

Design a staffing plan for implementing minimum practices. What roles are needed? How many people? What skills?

KEY TAKEAWAYS

• Minimum practices are required, not optional. OMB M-24-10 establishes baseline safeguards that all federal agencies must implement.
• Seven core minimum practices cover governance, documentation, testing, human oversight, monitoring, and incident response.
• Each practice addresses real risks that emerged from real failures. They're not arbitrary requirements.
• Minimum practices are a floor, not a ceiling. Agencies should exceed them.
• Implementation requires resources. Governance staff, tools, training, and capacity must be allocated.
• Consistency matters. Minimum practices should apply to all systems, not just some.
• Continuous improvement flows from implementation. As you implement practices, you learn and improve.

GLOSSARY

Minimum practices -- Fundamental risk management practices that OMB requires all agencies to implement for AI systems.

Human-in-the-loop -- Governance model where humans review and can override AI recommendations before implementation.

Bias testing -- Systematic evaluation of whether an AI system produces equitable outcomes across demographic groups.

Performance monitoring -- Continuous measurement of AI system performance metrics and alerting when degradation occurs.

Incident response -- Process for detecting, escalating, investigating, and remediating problems with AI systems.

Minimum practices are where theory becomes practice. They're the specific things agencies do, week in and week out, to ensure AI systems operate responsibly.

Everything you've learned in prior lectures (governance structures, mapping, measuring, classification) supports implementing minimum practices. And implementing minimum practices requires all of those governance components to work together.

As you move through subsequent lectures on specific governance challenges (privacy impact assessments, data governance, validation), remember that they're all part of the ecosystem supporting minimum practices.

Take three minutes to assess your organization's implementation:

Which minimum practices are you strongest in? Why? What can you learn from your success?

Which practice is weakest? What's preventing implementation? What would be required to improve?

If you implemented all seven practices fully, what would change about how AI is governed? Would leadership support that level of governance?

This lecture covered OMB M-24-10 minimum risk management practices--the concrete safeguards that responsible government AI adoption requires. These practices are foundational. Everything else you do in governance builds on them.

In the next lecture (2.3.6), we'll explore privacy impact assessments: a specific governance process required for systems that process personal information.

Minimum practices provide the scaffold. PIAs, data governance, validation processes--these are specific instantiations of the broader minimum practices framework.

End of Transcript

Source: GOVT.CLUB

Visit: https://govt.club/learn/lectures/l2/235-minimum-risk-management-practices.html

Government AI CLUB Certification Program

Level 2: AI Ready | Minimum Risk Management Practices | Lecture 2.3.5

A GOVT.CLUB initiative

<- 2.3.5 Risk Classification: Safety-Impacting vs. Rights-Impacting
2.3.7 Data Governance for AI ->

Start Your CLUB Certification

This lecture is part of L2: AI Practitioner -- 40 hours of comprehensive government AI training.

Explore CLUB Certification

Related Lectures

L2
2.3.1 -- NIST AI RMF: The GOVERN Function
60 min - Video + Workshop

L2
2.3.2 -- NIST AI RMF: MAP, MEASURE, MANAGE
60 min - Video + Workshop

L2
2.3.3 -- Your Agency's AI Governance Structure
60 min - Reading + Discussion