Counting remediation shrinks a $5m fraud saving to $4m of actual value

Eighty-one per cent is doing a great deal of aggregating. The survey puts respondents who called AI model risk critical into the same bucket as those who called it high and those who called it moderate ^[2], so the share treating it as a first-order threat never reaches the page ^[16]. The fraud question has the same shape, with "somewhat or very likely" covering both a probability you would reprice a project over and one you would merely minute ^[3]. That is a sentiment reading, and turning it into an expected cost still takes a severity figure the survey doesn't supply.

Which is the trouble with the third term. The formula on offer, financial benefits less full lifecycle cost less the expected costs of errors and control failures ^[4], is unobjectionable as accounting and awkward as practice, because an expected cost is a probability times a severity and the survey supplies a word for the first and nothing at all for the second ^[15]. The one place a number appears is the worked example: five million dollars of avoided fraud losses, one million of investigation and customer remediation, four million of value ^[5], so twenty per cent of the headline benefit is gone ^[6] before anyone has allocated data, compute, integration staff, or the costs shared across teams ^[12]. Any project whose modelled return sits within 20 per cent of the hurdle rate goes unranked on this arithmetic.

The error-tolerance point is the sharper one. Ninety-nine per cent right is one wrong in every hundred ^[8], which the piece says is not cut out for many banking operations ^[7], and at bank volumes scale enlarges the downside as readily as the upside ^[9]. Hence the reframing of model choice as an economic decision, where the question is which model delivers the best business result inside the budget rather than which performs best in the abstract ^[13]. A bank that prices errors buys narrower systems, and the control expense it would otherwise have left outside the business case moves inside it ^[1].

The counter-argument sits inside the same formula, which haircuts the new system's errors and says nothing about the error costs of the process being displaced ^[4], so a bank applying it strictly to AI and never to the manual workflow underneath will go on paying for defects nobody has costed. The lending illustration is the tell: this is ordinary discipline, the kind that counts incremental revenue while ignoring the incremental credit losses ^[14], a mistake a credit committee already knows how to catch. So the honest read is narrow. The survey establishes that bank risk officers expect losses ^[3], not what those losses cost, and until a bank publishes realised remediation spend against realised benefit, the downside term is a governance requirement rather than a figure anyone can put in a spreadsheet.