AI Governance And Risk

When auditing an AI system for regulatory compliance, you find that data lineage is broken between the feature store and the training pipeline. Which control is most likely deficient?

A firm uses a third-party AI service. Which control is most critical to ensure compliance with the firm's own AI governance policy?

You are auditing a 'Model Monitoring' dashboard. Which metric is most indicative of a potential degradation in the model's reliability over time?

You are assessing a company's 'AI Governance Committee'. Which action best demonstrates effective board-level oversight?

Which component of an AI policy is most important for establishing organizational accountability?

During an AI risk assessment, you notice that the 'Model Risk Management' (MRM) framework does not mandate independent validation for models categorized as 'High Impact'. What is the most significant consequence?

A board of directors asks you to define the 'AI Risk Appetite'. Which approach best satisfies the governance requirement?

Which TWO of the following are primary components of an AI model risk management inventory?

Which THREE factors must be evaluated when assessing the 'Fairness' of an AI model?

A data scientist proposes using a 'black-box' model for a high-stakes loan approval process. Which action does your AI audit framework require?

What is the goal of a 'Human-in-the-loop' (HITL) control in an AI system?

Which document is the primary source for establishing the scope of an AI audit?

During an audit, you find that the AI training data includes personally identifiable information (PII) that was not anonymized. Which regulation does this most likely violate?

You are reviewing the 'AI Incident Response Plan'. Which element is essential for compliance?

Which technique is most appropriate for mitigating 'Concept Drift' in a production model?

You are assessing 'Model Security'. Which attack vector specifically exploits the AI training phase?

Which artifact should an auditor request to verify 'Model Governance' during the model life cycle?

What is the primary function of an 'AI Ethics Board'?

In the context of 'AI Compliance', what is a 'Model Card'?

Which THREE components are critical for a robust 'AI Governance' framework?

Which TWO of the following are essential when performing an 'AI Risk Assessment'?

You are auditing a model's 'Data Pre-processing' step. Which practice is a major concern regarding data privacy?

Which role is primarily responsible for ensuring that the AI governance framework is followed in daily operations?

When auditing an 'AI Model Lifecycle', which phase occurs immediately after the 'Model Training' phase?

What is the purpose of 'Model Versioning' in an AI audit context?

You find that the 'Inference API' for a model allows 'Prompt Injection' attacks. Which governance failure is most likely?

Which AI risk is best mitigated by conducting a 'bias audit' on the training dataset?

A firm uses a 'Federated Learning' approach. Which governance benefit does this provide?

What is the main role of the 'AI Risk Assessment' document in a project lifecycle?

Which TWO of the following are typical 'Model Risk Management' (MRM) pillars?

Which THREE criteria are necessary for an AI system to be deemed 'Trustworthy' under most governance frameworks?

What is the key difference between 'AI Ethics' and 'AI Compliance'?

What is the primary function of an 'AI Audit Log'?

What is the purpose of an 'AI Policy' within an organization?

A company's AI governance policy requires 'Model explainability'. Which tool or technique best satisfies this requirement for complex deep learning models?

You are auditing a firm using LLMs (Large Language Models). Which risk is most specific to generative AI compared to traditional predictive models?

Which 'AI Risk Mitigation' strategy is most effective for reducing 'Data Leakage' in training sets?

Which action is required when a model is found to be 'Non-compliant' with the internal AI Governance policy?

You are auditing a model's 'Robustness' against adversarial attacks. Which test is most appropriate?

Which TWO of the following are examples of AI governance 'Inputs'?

Which THREE risks should be explicitly managed in an 'AI Governance' program?

What is the primary objective of 'Board-level AI Governance'?

During an audit of an AI system, you notice that 'Model validation' is performed by the same team that developed the model. Why is this a concern?

You are auditing a 'Model Lifecycle' and find that the decommissioning process is not defined. What is the impact?

You are auditing an organization's AI deployment in Microsoft Azure. The Chief Risk Officer requires a central dashboard to monitor AI model performance drift and data quality metrics across all deployed services. Which tool should you confirm is configured to provide these insights?

An organization uses AWS SageMaker. As an auditor, you need to verify that model lineage and versioning are being captured to satisfy the AI risk assessment requirement for reproducibility. Which feature ensures that every model training job is recorded with its data sources?

A board of directors requests a quarterly report on AI risk exposure. Which component of the NIST AI Risk Management Framework should you prioritize to demonstrate that the board's AI policy is being operationally enforced?

You are reviewing a model risk management (MRM) framework for an AI system using NVIDIA NeMo Guardrails. What is the primary purpose of this tool in a risk mitigation strategy?

When auditing model fairness in a production environment using IBM Watson OpenScale, which metric would you specifically validate to ensure the model is not violating protected class regulations?

An organization is scaling its AI governance program. You need to automate the identification of 'Shadow AI' in the corporate network. Which tool would be the most effective to gain visibility into unauthorized AI model API usage?

As part of an AI audit, you are checking the 'AI Transparency' requirement. Which documentation artifact is essential to provide to external regulators to explain the model's design, intended use, and limitations?

In a financial services firm, you are auditing the 'Explainability' of a credit scoring model. The model uses complex non-linear features. Which technique should you verify is being used to provide local explanations for individual credit decisions?

You are reviewing the AI Incident Response Plan. Which scenario constitutes a 'High' severity AI incident that requires immediate board notification under most enterprise risk frameworks?

You are assessing the risk of 'Data Poisoning' in a retail AI model. Which control should you implement during the data ingestion pipeline to mitigate this risk?

When drafting an AI policy, you need to define the 'Human-in-the-Loop' (HITL) requirement. Which of the following represents a best-practice control for HITL?

An auditor is asked to review the AI model inventory. What information must be present in the inventory for every model to satisfy basic regulatory requirements?

Which THREE of the following are core components of a robust AI Governance and Risk Assessment Framework?

Which TWO of the following are examples of 'Model Risk Management' (MRM) controls that must be validated during an audit?

Which THREE of the following should be included in an AI Policy document to ensure compliance and ethical alignment?

Which THREE of the following are potential risks associated with AI model 'Drift' that an auditor must account for?

Which TWO of the following are core components of an AI incident response strategy?

You are auditing a financial institution's AI governance framework. The organization has a documented AI risk appetite statement, but you find that individual AI use cases are approved without any reference to it. Which action should you recommend to remediate this gap?

During an audit of an AI-based fraud detection system, you find that the model's performance is monitored only through overall accuracy. The system processes highly imbalanced data with a fraud rate of 0.5%. Which risk does this monitoring approach most likely fail to detect?

An AI governance committee is reviewing a proposal to deploy a generative AI chatbot for customer service. The committee wants to ensure that the chatbot's responses do not violate company policies or regulatory requirements. Which control should be implemented to provide the highest level of assurance?

You are auditing an organization's AI governance framework and find that AI systems are being developed by various business units without any central oversight. Which governance structure would best address this issue?

An auditor is reviewing an organization's AI risk management process. The organization has identified several AI risks but has not prioritized them. Which TWO factors should the auditor recommend be used to prioritize AI risks? (Choose two.)

A global retailer has deployed an AI-powered dynamic pricing engine across 14 countries. The internal audit team discovers that the system adjusts prices based on inferred customer gender and ethnicity derived from browsing behavior. The organization has a formal AI ethics policy that prohibits discriminatory pricing. Which action should the lead AI auditor recommend FIRST?

An AI auditor is evaluating a natural language processing model used to screen job applicants. The model was trained on five years of historical hiring data. The auditor finds that the model's selection rate for female candidates is 72% of the rate for male candidates. According to the EEOC Uniform Guidelines, what is the auditor's PRIMARY concern?

An organization is deploying an AI system that makes autonomous decisions about credit limit increases. The board asks the AI auditor to explain the concept of 'human in the loop' as it applies to this system. Which statement best describes the auditor's explanation?

During an audit of an AI-based fraud detection system at a bank, the auditor discovers that the model's performance has degraded significantly over the past quarter. The data science team reports that the model was trained on transaction patterns from two years ago and has not been retrained. Which risk does this situation PRIMARILY represent?

An AI auditor is assessing the governance framework for a machine learning model that predicts patient readmission risk in a hospital network. The model informs decisions about post-discharge care. Which TWO of the following are the most critical governance controls the auditor should verify? (Choose two.)