An automated risk auditing and compliance toolkit for assessing high-risk automated credit scoring systems against the EU AI Act (Annex III), NIST AI RMF, GDPR Article 22, and ISO/IEC 27001 standards.
Automated credit scoring and underwriting systems fall under EU AI Act Annex III (High-Risk AI Systems), creating stringent technical requirements:
- Bias & Discriminatory Impact (NIST AI RMF / EU AI Act Art. 10): Algorithmic scoring models can systematically disadvantage demographic groups if demographic parity is not continuously monitored.
- Lack of Human Oversight (GDPR Art. 22 / EU AI Act Art. 14): Fully automated financial decisions require clear human-in-the-loop override pathways for non-standard credit profiles.
- Security & Over-Privileged Access (ISO/IEC 27001): Pipeline service accounts with excessive cloud permissions create security vulnerabilities and compliance audit failures.
This framework provides an automated technical risk verification layer to audit model logs and cloud access controls prior to production deployment.
+-------------------------------------+ | FinTech Credit Pipeline & Logs | +-------------------------------------+ │ ▼ +-------------------------------------+ | Bias & Fairness Auditor | ──► Audits Selection Rates & 80% Rule Disparate Impact +-------------------------------------+ │ ▼ +-------------------------------------+ | AWS IAM & ISO 27001 Auditor | ──► Flags Wildcard Access & Over-Privileged Roles +-------------------------------------+ │ ▼ +-------------------------------------+ | Risk Register & Compliance Output | ──► Generates Audit Trail for Governance Verification +-------------------------------------+
| Directory | Component | Purpose |
|---|---|---|
| python/ | bias_fairness_auditor.py | Audits credit approval logs for demographic parity and Disparate Impact ratios. |
| python/ | aws_iam_iso27001_auditor.py | Scans AWS IAM policy JSON documents for ISO 27001 least-privilege violations. |
| docs/ | annex_iii_risk_register.md | Formal risk register mapping controls to EU AI Act, GDPR, and ISO 27001. |
| docs/ | audit_summary_sample.json | Sample automated execution log output showing audit results. |
- Python 3.9+
Command to run: python python/bias_fairness_auditor.py
Expected Output: [INFO] Starting Bias & Disparate Impact Audit on Credit Scoring Decisions... [INFO] Selection Rate for [Group_A]: 75.0% [INFO] Selection Rate for [Group_B]: 25.0% [INFO] Disparate Impact Ratio [Group_B vs Group_A]: 0.33 [WARNING] [FLAGGED BIAS] Group 'Group_B' violates 80% rule with Disparate Impact Ratio of 0.33 [ALERT] Model Bias Audit FLAGGED FOR GOVERNANCE REVIEW.
Command to run: python python/aws_iam_iso27001_auditor.py
Expected Output: [INFO] Auditing AWS IAM Policy: 'CreditModelTrainingPipelineRole' against ISO 27001 Least-Privilege Standard... [ERROR] [ISO 27001 VIOLATION] Statement 'OverPrivilegedAccess' grants unrestricted wildcard ('*') access. [WARNING] [FAIL] Over-privileged IAM access flagged. Remediation required before deployment. [ALERT] IAM Security Audit FLAGGED LEAST-PRIVILEGE VIOLATIONS.
- Regulatory Compliance: Establishes verifiable audit evidence for EU AI Act Annex III and GDPR Article 22 requirements.
- Bias Auditing: Proactively flags statistical disparate impact in underwriting approval pipelines.
- Security Alignment: Enforces ISO 27001 least-privilege principles across cloud infrastructure processing training data.