You are auditing a firm's AI policy and find that the 'Model Inventory' in the enterprise risk management platform lacks versioning metadata. Which specific control gap should be prioritized to align with NIST AI RMF?
During an audit of Google Cloud Vertex AI, you discover that sensitive PII is being logged during model inference. You need to implement a control that enforces privacy at the model serving layer. Which configuration should you verify?
An organization is using 'Federated Learning' to maintain data privacy while training models. What is the primary audit risk associated with this architecture?
When auditing an AI system for regulatory compliance, you find that data lineage is broken between the feature store and the training pipeline. Which control is most likely deficient?
During an AI risk assessment, you notice that the 'Model Risk Management' (MRM) framework does not mandate independent validation for models categorized as 'High Impact'. What is the most significant consequence?
During an audit, you find that the AI training data includes personally identifiable information (PII) that was not anonymized. Which regulation does this most likely violate?
A company's AI governance policy requires 'Model explainability'. Which tool or technique best satisfies this requirement for complex deep learning models?
You are auditing an organization's AI deployment in Microsoft Azure. The Chief Risk Officer requires a central dashboard to monitor AI model performance drift and data quality metrics across all deployed services. Which tool should you confirm is configured to provide these insights?
An organization uses AWS SageMaker. As an auditor, you need to verify that model lineage and versioning are being captured to satisfy the AI risk assessment requirement for reproducibility. Which feature ensures that every model training job is recorded with its data sources?
A board of directors requests a quarterly report on AI risk exposure. Which component of the NIST AI Risk Management Framework should you prioritize to demonstrate that the board's AI policy is being operationally enforced?
You are reviewing a model risk management (MRM) framework for an AI system using NVIDIA NeMo Guardrails. What is the primary purpose of this tool in a risk mitigation strategy?
When auditing model fairness in a production environment using IBM Watson OpenScale, which metric would you specifically validate to ensure the model is not violating protected class regulations?
An organization is scaling its AI governance program. You need to automate the identification of 'Shadow AI' in the corporate network. Which tool would be the most effective to gain visibility into unauthorized AI model API usage?
As part of an AI audit, you are checking the 'AI Transparency' requirement. Which documentation artifact is essential to provide to external regulators to explain the model's design, intended use, and limitations?
In a financial services firm, you are auditing the 'Explainability' of a credit scoring model. The model uses complex non-linear features. Which technique should you verify is being used to provide local explanations for individual credit decisions?
You are reviewing the AI Incident Response Plan. Which scenario constitutes a 'High' severity AI incident that requires immediate board notification under most enterprise risk frameworks?
You are assessing the risk of 'Data Poisoning' in a retail AI model. Which control should you implement during the data ingestion pipeline to mitigate this risk?
When drafting an AI policy, you need to define the 'Human-in-the-Loop' (HITL) requirement. Which of the following represents a best-practice control for HITL?
An auditor is asked to review the AI model inventory. What information must be present in the inventory for every model to satisfy basic regulatory requirements?
You are auditing a financial institution's AI governance framework. The organization has a documented AI risk appetite statement, but you find that individual AI use cases are approved without any reference to it. Which action should you recommend to remediate this gap?
During an audit of an AI-based fraud detection system, you find that the model's performance is monitored only through overall accuracy. The system processes highly imbalanced data with a fraud rate of 0.5%. Which risk does this monitoring approach most likely fail to detect?
An AI governance committee is reviewing a proposal to deploy a generative AI chatbot for customer service. The committee wants to ensure that the chatbot's responses do not violate company policies or regulatory requirements. Which control should be implemented to provide the highest level of assurance?
You are auditing an organization's AI governance framework and find that AI systems are being developed by various business units without any central oversight. Which governance structure would best address this issue?
An auditor is reviewing an organization's AI risk management process. The organization has identified several AI risks but has not prioritized them. Which TWO factors should the auditor recommend be used to prioritize AI risks? (Choose two.)
A global retailer has deployed an AI-powered dynamic pricing engine across 14 countries. The internal audit team discovers that the system adjusts prices based on inferred customer gender and ethnicity derived from browsing behavior. The organization has a formal AI ethics policy that prohibits discriminatory pricing. Which action should the lead AI auditor recommend FIRST?
An AI auditor is evaluating a natural language processing model used to screen job applicants. The model was trained on five years of historical hiring data. The auditor finds that the model's selection rate for female candidates is 72% of the rate for male candidates. According to the EEOC Uniform Guidelines, what is the auditor's PRIMARY concern?
An organization is deploying an AI system that makes autonomous decisions about credit limit increases. The board asks the AI auditor to explain the concept of 'human in the loop' as it applies to this system. Which statement best describes the auditor's explanation?
During an audit of an AI-based fraud detection system at a bank, the auditor discovers that the model's performance has degraded significantly over the past quarter. The data science team reports that the model was trained on transaction patterns from two years ago and has not been retrained. Which risk does this situation PRIMARILY represent?
An AI auditor is assessing the governance framework for a machine learning model that predicts patient readmission risk in a hospital network. The model informs decisions about post-discharge care. Which TWO of the following are the most critical governance controls the auditor should verify? (Choose two.)