AI Algorithm Denies Housing to Voucher Holder, Highlighting Vendor Risk and Governance Failures

The Perils of Opaque Algorithmic Decision-Making

The case of Mary Louis and SafeRent Solutions serves as a stark warning about the risks associated with relying on black-box algorithms for critical decisions. SafeRent's tenant-screening algorithm, the "SafeRent Score," denied housing to an applicant with a federal housing voucher and a strong payment history, primarily because the model was not designed to account for such a crucial factor. This highlights a fundamental governance failure: an organization outsourced a consequential decision to a vendor's algorithm without understanding its internal workings or ensuring it considered all relevant data points. Internal audit professionals must recognize that simply adopting a vendor's tool does not absolve the organization of liability; rather, it transfers the risk of algorithmic bias and flawed decision-making directly to the adopting entity.

Vendor Accountability and the Need for Independent Validation

The lawsuit revealed that SafeRent's algorithm, while marketed to automate judgment, was opaque to both landlords and applicants. Housing providers could not see how the score was calculated, adjust its factors, or override its output. This lack of transparency and control is a significant red flag for internal auditors. Organizations must demand documented disparate-impact testing from vendors, broken down by protected classes, and not merely accept assurances of compliance. Furthermore, contracts with algorithmic tool providers should include the right to independent validation, especially when models are updated or applied to new populations. Without such provisions, organizations are essentially inheriting a liability they cannot inspect or control.

Navigating a Shifting Regulatory Landscape

The SafeRent case was significantly bolstered by the legal theory of disparate impact under the Fair Housing Act. However, the article notes a current trend of federal agencies dismantling or deprioritizing disparate-impact liability. This regulatory shift means that the burden of identifying and mitigating algorithmic bias increasingly falls on private litigation, state law, and, crucially, an organization's internal audit and governance frameworks. Internal audit functions must proactively establish robust processes for ongoing monitoring of algorithmic outcomes, comparing acceptance and denial rates across protected classes within their own applicant pools. They must also ensure clear human-review paths for cases where algorithms fail to account for obviously relevant factors, like housing vouchers, to prevent governance failures from becoming costly legal battles.

Key Questions for Internal Audit

To prevent similar incidents, internal audit and assurance professionals should ask critical questions:

• Can the organization produce its own testing evidence of non-disparate impact for every vendor-supplied algorithmic score or decisioning tool, rather than relying solely on vendor assurances?
• Does the organization have visibility into the inputs and weighting of vendor algorithms, and can it adjust or override their outputs when necessary?
• Is there a documented process for human review when an algorithm fails to consider a known, obviously relevant factor?
• Does the board or compliance team receive aggregate outcome data on decisions made by third-party algorithms on the organization's behalf?

Addressing these questions proactively is essential for managing AI risk and ensuring ethical, compliant, and fair decision-making within the organization.