Our Approach
An algorithmic system includes various components.
A "system" is not purely about tech. An algorithmic system includes:
- manual processes, governance mechanisms, human oversight of decisions, etc.
- data, data flows, algorithms - rules based programs, machine learning algorithms, AI components, etc.
When we review algorithm integrity, we focus on accuracy and/or fairness.
You may decide to include any of the other key aspects of algorithm integrity.
When scoping the audit, based on your objective for the audit, we will work with you to determine which of the other aspects to include.
In some cases, other aspects may have to form part of the audit. For example, "alignment with objectives" is often required. If this is the case, we will discuss this with you upfront and include it.
Evaluating algorithmic systems to help eliminate bias
Examples include: fair algorithmic systems for loan origination, insurance premium calculations or claims fraud triage.
Approach
- Scope definition: work with you to clearly define the audit objectives and scope.
- Base understanding: explore your governance mechanisms, data flow diagrams and how decisions are made.
- Information collection: gather relevant data and documentation, interview key stakeholders.
- Deep dive: review data inputs, models, other system components and outputs to identify potential sources of bias.
- Validation: confirm the sources(s) of potential bias and identify potential ways to resolve or mitigate these.
- Reporting: you receive a comprehensive report with findings and suggestions for resolution or mitigation.
What We Typically Look For
- Equitability
- Proxies
- Unapproved data sources (e.g., external data that is not needed)
- If relevant, an inability to explain how the decisions/outputs are produced.
Analysing algorithmic systems to help eliminate errors
The details vary, depending on what needs to be checked for accuracy.
Approach
- Scope definition: clearly define the audit objectives and scope.
- Base understanding: examine relevant documents that outline expectations (e.g., product disclosure statements, third party contracts) and system architecture/data flows.
- Data collection: gather relevant data: inputs (as close as possible to the source) and targets (the final outputs).
- Reperformance: reperform the calcs, based on agreed contractual terms, then cross-check to your outputs.
- Iterative refinement: if there are differences between the expected and actual, check whether this is a problem with the actual result or the modelled result. For example: a valid exception may apply; or the modelled result has missed a key step or made an incorrect assumption; or a data fix was applied (in the actual process) because of a bug or issue in the source system.
- Root cause identification: once the specific inaccuracies have been confirmed, identify the source(s) of those inaccuracies.
- Reporting: document the result of the review, including how it was performed, what the issues are and how they will be resolved.
What We Typically Look For
- Overpayments or underpayments
- Inconsistencies between calculated results and agreed terms
- Ambiguous contractual terms
- Data flow or algorithm errors affecting calculation accuracy
- Unnecessary complexities in the calculation process
Frequently Asked Questions
What types of businesses do you work with?
Financial services - primarily banks, credit unions and insurance companies.
How long does a review take?
- It depends, of course.
- Reviews rarely take less than 2 months. 4 months is typical, but it can take 6 months for some.
What are your rates?
- Fixed price projects (typically $30k to $150k).
- No hourly/daily rates.
We struggle explaining how our systems work to junior staff - how do you overcome this?
- We do not employ junior staff.
- You will not deal with anyone with less than 10 years of experience.
There has been lots of negative press about independence lately - what's your approach?
- We take independence very seriously.
- Probably more seriously than you would be accustomed to, and certainly more seriously than most big firms.
- We rarely get involved in designing or implementing controls. Where we do, we do not provide audits/reviews.