ঝুঁকির স্কোরিং, নিয়ন্ত্রণ ও সিদ্ধান্ত: একটা টয় রিস্ক রেজিস্টার বানানো

# file: risk.py
from dataclasses import dataclass

BANDS = ((16, "very high"), (10, "high"), (5, "medium"), (1, "low"))  # our chosen cut-offs, as on page 1


def band(points):
    return next(name for floor, name in BANDS if points >= floor)


@dataclass
class Risk:
    id: str
    title: str
    level: str               # individual or collective
    likelihood: int
    severity: int
    reversibility: str       # easy, hard, irreversible
    exposed: int
    evidence: str            # none, opinion, internal-test, independent
    res_likelihood: int = 0  # residual CLAIMED after controls; 0 = nothing claimed
    res_severity: int = 0
    owner: str = ""          # a role, not "the team"
    tags: tuple = ()         # what the risk touches: model, data, use, scale, vendor ...

    def inherent(self):
        return self.likelihood * self.severity

    def claimed(self):
        return self.res_likelihood * self.res_severity if self.res_likelihood else self.inherent()

from collections import namedtuple
from risk import Risk, band

# Toy data: the register from page 1, now with an owner and tags per risk. All invented.
RISKS = [Risk(**d) for d in [
    dict(id="R1", title="Score penalises career breaks", level="individual", likelihood=3, severity=4,
         reversibility="hard", exposed=900, evidence="opinion", res_likelihood=2, res_severity=3,
         owner="Head of recruitment", tags=("model", "group")),
    dict(id="R2", title="Recruiters trust the ranking", level="individual", likelihood=4, severity=3,
         reversibility="hard", exposed=4800, evidence="internal-test", res_likelihood=3, res_severity=3,
         owner="Head of recruitment", tags=("model", "use")),
    dict(id="R3", title="Unusual CV layouts parse badly", level="individual", likelihood=3, severity=3,
         reversibility="easy", exposed=600, evidence="internal-test", res_likelihood=3, res_severity=2,
         owner="Operations manager", tags=("model", "data")),
    dict(id="R4", title="CV text kept beyond hiring", level="individual", likelihood=2, severity=4,
         reversibility="irreversible", exposed=6000, evidence="opinion",
         owner="Operations manager", tags=("personal-data", "vendor", "data")),
    dict(id="R5", title="Score reused to rank staff", level="individual", likelihood=2, severity=3,
         reversibility="hard", exposed=250, evidence="none", res_likelihood=1, res_severity=3,
         owner="Agency owner", tags=("use", "employment")),
    dict(id="R6", title="Shortlists drift toward past hires", level="collective", likelihood=3, severity=3,
         reversibility="hard", exposed=6000, evidence="opinion", res_likelihood=3, res_severity=2,
         owner="the team", tags=("group", "scale", "model")),
    dict(id="R7", title="Appeal route unclear", level="individual", likelihood=3, severity=3,
         reversibility="hard", exposed=4800, evidence="none",
         owner="Head of recruitment", tags=("use", "employment")),
]]

Control = namedtuple("Control", "id risk kind what status tested limit")
CONTROLS = [  # Toy data. status: in place or planned. tested: none, internal-test or independent
    Control("C1", "R1", "prevent", "remove the career-gap feature", "in place", "none",
            "other CV fields can stand in for a gap"),
    Control("C2", "R1", "detect", "quarterly score check by group", "planned", "none",
            "needs group labels the agency does not hold"),
    Control("C3", "R2", "detect", "read 50 low-ranked CVs a month", "in place", "internal-test",
            "50 of about 400 a month"),
    Control("C4", "R3", "detect", "parse warning on odd layouts", "in place", "internal-test",
            "sees only failures the parser notices"),
    Control("C5", "R3", "correct", "manual check path", "in place", "none",
            "the applicant must know to ask"),
    Control("C6", "R5", "prevent", "written purpose limit", "in place", "none",
            "a rule on paper, not a block"),
    Control("C7", "R5", "detect", "access log", "in place", "internal-test",
            "shows misuse after the fact"),
    Control("C8", "R6", "detect", "yearly shortlist vs pool check", "planned", "none",
            "slow: once a year"),
]
print(len(RISKS), "risks,", len(CONTROLS), "controls,", sum(c.status == "planned" for c in CONTROLS), "of them only planned")

7 risks, 8 controls, 2 of them only planned

for c in CONTROLS:
    print(f"{c.id} {c.risk} {c.kind:<8}{c.status:<10}tested: {c.tested:<14}{c.what}")
    print(f"           limit: {c.limit}")

C1 R1 prevent in place  tested: none          remove the career-gap feature
           limit: other CV fields can stand in for a gap
C2 R1 detect  planned   tested: none          quarterly score check by group
           limit: needs group labels the agency does not hold
C3 R2 detect  in place  tested: internal-test read 50 low-ranked CVs a month
           limit: 50 of about 400 a month
C4 R3 detect  in place  tested: internal-test parse warning on odd layouts
           limit: sees only failures the parser notices
C5 R3 correct in place  tested: none          manual check path
           limit: the applicant must know to ask
C6 R5 prevent in place  tested: none          written purpose limit
           limit: a rule on paper, not a block
C7 R5 detect  in place  tested: internal-test access log
           limit: shows misuse after the fact
C8 R6 detect  planned   tested: none          yearly shortlist vs pool check
           limit: slow: once a year

def in_place(risk):
    return [c for c in CONTROLS if c.risk == risk.id and c.status == "in place"]


def supported(risk):
    """Residual points we can defend today: a planned control does not count."""
    return risk.claimed() if in_place(risk) else risk.inherent()


def doubt(risk):
    live = in_place(risk)
    if risk.claimed() < risk.inherent() and not live:
        return "claim rests on planned controls only"
    if live and all(c.tested == "none" for c in live):
        return "no in-place control has been tested"
    return ""


print("id  inherent  claimed  supported  band       doubt")
for r in RISKS:
    s = supported(r)
    print(f"{r.id:<4}{r.inherent():>6}{r.claimed():>9}{s:>10}  {band(s):<11}{doubt(r)}")

id  inherent  claimed  supported  band       doubt
R1      12        6         6  medium     no in-place control has been tested
R2      12        9         9  medium
R3       9        6         6  medium
R4       8        8         8  medium
R5       6        3         3  low
R6       9        6         9  medium     claim rests on planned controls only
R7       9        9         9  medium

APPLICATIONS, MINUTES = 6000, 5   # Toy data: per year; minutes per CV
top = APPLICATIONS // 5
sample = (APPLICATIONS - top) // 20
WORKFLOWS = {  # name: (CVs a person reads in full, who makes the call on a CV nobody read)
    "human-only": (APPLICATIONS, "not applicable"),
    "AI-assisted": (top + sample, "the ranking, by default"),
    "automated": (0, "the cut-off, always"),
}
print(f"{'workflow':<13}{'read by a person':>17}{'hours':>7}{'never read':>12}  who decides on those")
for name, (read, who) in WORKFLOWS.items():
    print(f"{name:<13}{read:>17}{read * MINUTES / 60:>7.0f}{APPLICATIONS - read:>12}  {who}")

workflow      read by a person  hours  never read  who decides on those
human-only                6000    500           0  not applicable
AI-assisted               1440    120        4560  the ranking, by default
automated                    0      0        6000  the cut-off, always

def route(r):
    """Our invented policy. Returns (route, reasons)."""
    points = supported(r)
    why = []
    if band(points) == "very high":
        return "stop", ["residual very high"]
    if band(points) == "high":
        why.append("residual high")
    if r.reversibility == "irreversible":
        why.append("irreversible")
    if r.severity >= 4 and r.evidence in ("none", "opinion"):
        why.append("severe+weak evidence")
    if r.level == "collective":
        why.append("collective")
    if r.exposed >= 3000 and band(points) != "low":
        why.append("wide reach")
    return ("escalate" if why else "owner may accept"), why


for r in RISKS:
    decision, why = route(r)
    print(f"{r.id}  {band(supported(r)):<8}{decision:<18}{'; '.join(why)}")

R1  medium  escalate          severe+weak evidence
R2  medium  escalate          wide reach
R3  medium  owner may accept
R4  medium  escalate          irreversible; severe+weak evidence; wide reach
R5  low     owner may accept
R6  medium  escalate          collective; wide reach
R7  medium  escalate          wide reach

PILOT = {  # Invented plan
    "scope": "one job family, 8 weeks, at most 600 applications, no automatic rejection",
    "review_date": "2027-01-11",
    "conditions": [  # (condition, measure, stop if, owner)
        ("read a random sample of low-ranked CVs every week", "wrongly low-ranked, per 50 read",
         "3 or more", "Head of recruitment"),
        ("read the vendor contract: how long is CV text kept", "retention period written in R4",
         "unknown at start", "Operations manager"),
        ("tell applicants that a tool orders the CVs", "notice text approved", "", "Agency owner"),
        ("answer every query about a rank within 5 working days", "", "", ""),
    ],
}
print("scope:", PILOT["scope"])
print("review:", PILOT["review_date"])
for n, (what, measure, stop, owner) in enumerate(PILOT["conditions"], 1):
    gaps = [name for name, value in (("measure", measure), ("stop rule", stop), ("owner", owner)) if not value]
    print(n, "complete" if not gaps else "MISSING " + ", ".join(gaps), "-", what)

scope: one job family, 8 weeks, at most 600 applications, no automatic rejection
review: 2027-01-11
1 complete - read a random sample of low-ranked CVs every week
2 complete - read the vendor contract: how long is CV text kept
3 MISSING stop rule - tell applicants that a tool orders the CVs
4 MISSING measure, stop rule, owner - answer every query about a rank within 5 working days

SPECIALISTS = {
    "group": "statistician or fairness reviewer",
    "personal-data": "privacy or data-protection adviser",
    "vendor": "contract reviewer",
    "employment": "employment-law adviser",
}
for r in RISKS:
    need = [SPECIALISTS[t] for t in r.tags if t in SPECIALISTS]
    print(r.id, "; ".join(need) if need else "-")

R1 statistician or fairness reviewer
R2 -
R3 -
R4 privacy or data-protection adviser; contract reviewer
R5 employment-law adviser
R6 statistician or fairness reviewer
R7 employment-law adviser

from collections import Counter

VAGUE = ("", "the team", "everyone", "tbd")
load = Counter(r.owner for r in RISKS)
for owner, n in sorted(load.items()):
    print(f"{owner:<22}owns {n}")
print("no named owner:", [r.id for r in RISKS if r.owner.lower() in VAGUE])

Agency owner          owns 1
Head of recruitment   owns 3
Operations manager    owns 2
the team              owns 1
no named owner: ['R6']

TRIGGERS = [  # Invented examples: (what changed, which tags it touches)
    ("vendor ships a new scoring model", {"model", "vendor"}),
    ("applications double after a new office opens", {"scale"}),
    ("a manager asks to rank current staff", {"use"}),
    ("a new CV source brings a different file type", {"data"}),
]
for change, touched in TRIGGERS:
    reopen = [r.id for r in RISKS if touched & set(r.tags)]
    print(f"{change:<46}-> {', '.join(reopen)}")

vendor ships a new scoring model              -> R1, R2, R3, R4, R6
applications double after a new office opens  -> R6
a manager asks to rank current staff          -> R2, R5, R7
a new CV source brings a different file type  -> R3, R4

IMPACT ASSESSMENT RECORD     depth: light | standard | full     version: __   date: ____-__-__
1 Situation       feature, purpose in one sentence, boundary, out of scope
2 Who is affected users | affected non-users | other stakeholders
3 Benefits/harms  benefits (how we would notice) | misuse | harms: individual and collective
4 Options         do not use AI | non-AI alternative | human-only | AI-assisted | automated
5 Controls        id | risk | kind | in place or planned | tested? | its limit
6 Risk register   inherent | claimed residual | supported residual | evidence | assumptions
7 Decision        approve | approve with conditions (pilot scope, measures, stop rules) | stop
8 Accountability  escalation rule that fired | who decided, accepted until | specialists | owners
9 Review          date | change triggers and the risks each one reopens

def depth(risks, about_people):
    """Our invented rule for how much assessment a feature needs."""
    bands = {band(supported(r)) for r in risks}
    hard_cases = any(r.reversibility == "irreversible" or r.level == "collective" for r in risks)
    if bands & {"high", "very high"} or (about_people and hard_cases):
        return "full"
    if about_people or "medium" in bands:
        return "standard"
    return "light"


print("ShortlistHelper:", depth(RISKS, about_people=True))
typo = Risk("X1", "Typo in a reminder email", "individual", 2, 1, "easy", 100, "opinion")
print("reminder-email helper (invented, one low risk):", depth([typo], about_people=False))

ShortlistHelper: full
reminder-email helper (invented, one low risk): light

routes = {r.id: route(r) for r in RISKS}
gaps = [n for n, cond in enumerate(PILOT["conditions"], 1) if not all(cond)]
print("escalate:", [i for i, (d, _) in routes.items() if d == "escalate"])
print("owner may accept:", [i for i, (d, _) in routes.items() if d == "owner may accept"])
print("claims to re-check:", [r.id for r in RISKS if doubt(r)])
print("pilot conditions with gaps:", gaps)
print("risks without a named owner:", [r.id for r in RISKS if r.owner.lower() in VAGUE])
print("specialists to ask:", sorted({SPECIALISTS[t] for r in RISKS for t in r.tags if t in SPECIALISTS}))

escalate: ['R1', 'R2', 'R4', 'R6', 'R7']
owner may accept: ['R3', 'R5']
claims to re-check: ['R1', 'R6']
pilot conditions with gaps: [3, 4]
risks without a named owner: ['R6']
specialists to ask: ['contract reviewer', 'employment-law adviser', 'privacy or data-protection adviser', 'statistician or fairness reviewer']

r8 = Risk("R8", "Rejection emails sent by mistake", "individual", 2, 5, "hard", 300, "opinion")
print(r8.inherent(), band(r8.inherent()), route(r8))

10 high ('escalate', ['residual high', 'severe+weak evidence'])

TRIGGERS.append(("an applicant says a rank was unfair", {"model", "group"}))
change, touched = TRIGGERS[-1]
print(change, "->", [r.id for r in RISKS if touched & set(r.tags)])

an applicant says a rank was unfair -> ['R1', 'R2', 'R3', 'R6']

Decision record: ShortlistHelper pilot (invented)   depth: full   date: 2026-10-12 (invented)
Decision:   approve with conditions: an 8-week pilot, one job family, at most 600 applications.
            Not approved: rollout to all jobs; any automatic rejection; any use on current staff.
Why:        saves reading time (about 500 h to about 120 h a year at full volume, toy numbers);
            the unread 4560 are the main harm, so a weekly sample of low-ranked CVs is a condition.
Not settled: R4 retention (contract unread), R6 owner, privacy and employment-law review,
            tests for the career-gap control (C1) and the group check (C2, only planned).
Accountable: Agency owner for the decision; Head of recruitment for the pilot conditions.
Review:     2027-01-11, or earlier if the vendor changes the model or the pilot stops itself.