AAIA AI Governance And Risk — 25 Questions

Question 1

When auditing an AI system for regulatory compliance, you find that data lineage is broken between the feature store and the training pipeline. Which control is most likely deficient?

Accepted Answer

Metadata logging and transformation documentation. Feature stores must maintain end-to-end traceability to ensure that data provenance is clear and auditable.

Answer

Access control lists for the model production environment

Answer

Encryption of data at rest in the data warehouse

Answer

Load balancing configuration for the inference API

Question 2

A firm uses a third-party AI service. Which control is most critical to ensure compliance with the firm's own AI governance policy?

Accepted Answer

Including AI-specific compliance requirements in the vendor service-level agreement (SLA). Supply chain risk management requires mapping vendor controls to internal governance requirements.

Answer

Conducting weekly penetration tests on the vendor's office premises

Answer

Requesting the vendor's employee turnover rates for the last fiscal year

Answer

Requiring the vendor to submit copies of all their marketing brochures

Question 3

You are auditing a 'Model Monitoring' dashboard. Which metric is most indicative of a potential degradation in the model's reliability over time?

Accepted Answer

Statistical drift between the production input data and training baseline. Data drift and concept drift are primary indicators that a model's performance may be degrading in a production environment.

Answer

The physical location of the cloud server hosting the model

Answer

The number of lines of code in the model deployment script

Answer

The number of users accessing the model API

Question 4

You are auditing a firm's AI policy and find that the 'Model Inventory' in the enterprise risk management platform lacks versioning metadata. Which specific control gap should be prioritized to align with NIST AI RMF?

Accepted Answer

Lack of immutable audit logs for model architecture changes. Traceability and version control are essential to establish accountability and reproducibility in AI risk management.

Answer

Absence of automated model deployment pipelines

Answer

Failure to define the RPO for the primary database

Answer

Insufficient budget for cloud storage of historical data

Question 5

You are assessing a company's 'AI Governance Committee'. Which action best demonstrates effective board-level oversight?

Accepted Answer

Approving the annual AI strategy and corresponding risk mitigation plans. Board oversight must focus on strategic alignment and the establishment of high-level accountability frameworks.

Answer

Managing the day-to-day procurement of data labeling services

Answer

Reviewing individual code commits for AI model training

Answer

Selecting the machine learning framework used by data scientists

Question 6

Which component of an AI policy is most important for establishing organizational accountability?

Accepted Answer

Defining the roles and responsibilities of the AI Governance Committee and model owners. Accountability requires clearly defined roles and responsibilities for AI system oversight.

Answer

Describing the history of artificial intelligence research

Answer

Listing the hardware specifications of the training clusters

Answer

Providing the contact information for the company's PR department

Question 7

During an AI risk assessment, you notice that the 'Model Risk Management' (MRM) framework does not mandate independent validation for models categorized as 'High Impact'. What is the most significant consequence?

Accepted Answer

Increased probability of undetected systemic model bias or failure. Independent validation is a core pillar of model risk governance, especially for high-impact systems.

Answer

Inability to detect model drift in production environments

Answer

Non-compliance with internal cybersecurity patching cycles

Answer

Operational silos between the AI team and the IT department

Question 8

A board of directors asks you to define the 'AI Risk Appetite'. Which approach best satisfies the governance requirement?

Accepted Answer

Defining quantitative thresholds for acceptable model performance and ethical impact. Risk appetite must align with the organization's business objectives and ethical standards.

Answer

Creating a repository of all AI ethical guidelines published by NGOs

Answer

Providing the board with a list of all AI vendors used in the organization

Answer

Restricting all AI development to on-premises environments

Question 9

Which TWO of the following are primary components of an AI model risk management inventory?

Accepted Answer

Training data provenance and lineage information. An inventory must track metadata and lifecycle status for accountability.

Answer

Employee performance review scores

Answer

List of office furniture used by the team

Answer

Marketing budget for the model launch

Question 10

Which THREE factors must be evaluated when assessing the 'Fairness' of an AI model?

Accepted Answer

Disparities in model error rates across protected groups. Fairness assessment requires looking at demographic parity, historical bias, and error rate disparities.

Answer

The programming language used to build the model

Answer

The number of CPU cores allocated for training

Question 11

A data scientist proposes using a 'black-box' model for a high-stakes loan approval process. Which action does your AI audit framework require?

Accepted Answer

Mandating the use of XAI (Explainable AI) tools to interpret model decisions. Explainability is a prerequisite for models that have significant impact on individuals, as per most AI governance frameworks.

Answer

Requiring the data scientist to publish the code on an internal repository

Answer

Allowing the model if it achieves 99% accuracy on the test set

Answer

Asking the marketing team to verify the model's fairness

Question 12

What is the goal of a 'Human-in-the-loop' (HITL) control in an AI system?

Accepted Answer

To provide human oversight for automated decisions to mitigate risk and error. HITL ensures that a human makes final decisions for high-stakes AI outputs, reducing the risk of automation error.

Answer

To reduce the time spent on manual data entry

Answer

To replace all human employees with automated systems

Answer

To increase the speed of model training

Question 13

Which document is the primary source for establishing the scope of an AI audit?

Accepted Answer

The internal AI Policy and the organization's Risk Management Framework. The AI Policy and the AI Risk Management Framework (RMF) define the boundaries and expectations for the audit.

Answer

A list of all employees who have taken an AI training course

Answer

The company's social media posting guidelines

Answer

The employee handbook for the engineering department

Question 14

During an audit, you find that the AI training data includes personally identifiable information (PII) that was not anonymized. Which regulation does this most likely violate?

Accepted Answer

GDPR (General Data Protection Regulation). Handling PII without proper anonymization violates privacy regulations like GDPR or CCPA.

Answer

The Model Building Standards Act

Answer

The Sarbanes-Oxley Act

Answer

The Internal Server Maintenance Code

Question 15

You are reviewing the 'AI Incident Response Plan'. Which element is essential for compliance?

Accepted Answer

Defined escalation paths for ethical or performance incidents. Incident response must include specific triggers for escalation and communication regarding AI failures.

Answer

The history of the company's founding

Answer

A log of all office supply purchases

Answer

A list of all cafeteria menus in the building

Question 16

Which technique is most appropriate for mitigating 'Concept Drift' in a production model?

Accepted Answer

Implementing an automated re-training pipeline based on performance threshold triggers. Continuous re-training or fine-tuning based on recent data is the standard mitigation for concept drift.

Answer

Increasing the number of neurons in the hidden layers

Answer

Moving the model to a larger GPU cluster

Answer

Restricting access to the training dataset

Question 17

You are assessing 'Model Security'. Which attack vector specifically exploits the AI training phase?

Accepted Answer

Data poisoning. Data poisoning involves injecting malicious data into the training set to influence the model's behavior.

Answer

Man-in-the-middle attack

Answer

Denial-of-service attack

Answer

Phishing attack

Question 18

Which artifact should an auditor request to verify 'Model Governance' during the model life cycle?

Accepted Answer

Independent model validation reports. Model validation reports provide evidence that the model was checked against performance and safety standards.

Answer

The personal notes of the lead developer

Answer

A photograph of the development team

Answer

A list of office keys issued to employees

Question 19

What is the primary function of an 'AI Ethics Board'?

Accepted Answer

Reviewing AI projects for alignment with corporate values and societal norms. The ethics board ensures that AI projects align with corporate values and societal standards.

Answer

Managing the HR payroll systems

Answer

Fixing bugs in the server infrastructure

Answer

Writing the code for all production models

Question 20

In the context of 'AI Compliance', what is a 'Model Card'?

Accepted Answer

A document providing transparency regarding model features, limitations, and training data. A model card provides transparency by documenting the model's intended use, limitations, and performance metrics.

Answer

A physical access card for the data center

Answer

A credit card used for paying cloud compute bills

Answer

A list of all users authorized to access the AI