AAIA AI Governance And Risk Practice Test 5 — 15 Questions

Question 1

An auditor is asked to review the AI model inventory. What information must be present in the inventory for every model to satisfy basic regulatory requirements?

Accepted Answer

Model owner, business purpose, and status. For basic regulatory compliance, an AI model inventory must capture accountability (model owner), the reason the model exists (business purpose), and its current lifecycle stage (status). These three elements are consistently required by frameworks like the EU AI Act, NIST AI RMF, and ISO/IEC 42001 to ensure traceability, risk management, and governance. Without them, an auditor cannot determine who is responsible, why the model is deployed, or whether it should still be in use.

Answer

The complete list of all training algorithms used

Answer

The total number of GPUs used during training

Answer

All hyperparameter values

Question 2

Which THREE of the following are core components of a robust AI Governance and Risk Assessment Framework?

Accepted Answer

Standardized model risk assessment templates. A robust AI Governance and Risk Assessment Framework requires standardized model risk assessment templates (B) so that every AI/ML model is evaluated consistently against the same criteria, such as fairness, explainability, robustness, and data quality, enabling comparable and auditable risk scoring across the model portfolio. It also requires defined AI risk appetite and threshold levels (D), because governance depends on explicit, approved boundaries that determine which risks are acceptable and trigger escalation, mitigation, or rejection decisions. Finally, it requires clearly assigned roles and responsibilities for model ownership and accountability (E), since frameworks such as NIST AI RMF and ISO/IEC 42001 rely on named accountable owners (e.g., model owners, validators, and oversight committees) to enforce controls and remediation. Network bandwidth optimization plans (A) are an infrastructure/performance concern, not a governance or risk-assessment component, and automated model training hyperparameter tuning (C) is an MLOps/model-development activity that improves model performance but does not establish governance, risk appetite, or accountability structures.

Answer

Network bandwidth optimization plans

Answer

Automated model training hyperparameter tuning

Question 3

Which TWO of the following are examples of 'Model Risk Management' (MRM) controls that must be validated during an audit?

Accepted Answer

Post-deployment performance and drift monitoring. Option B is correct because post-deployment performance and drift monitoring is a core MRM control: it continuously tracks live model behavior against baselines (e.g., PSI, KS statistic, or accuracy degradation thresholds) to detect data drift, concept drift, and performance decay, and auditors must verify these monitoring mechanisms are in place and effective. Option E is correct because independent model validation post-development is a foundational MRM control requiring a party separate from the model developers to assess conceptual soundness, data quality, assumptions, and outcomes; audit validation confirms this independence and rigor exist. Option A is not an MRM control but a CI/CD engineering practice, option C concerns developer tooling standards rather than model risk, and option D is a data/training change that may affect a model but is not itself a validation control.

Answer

Automated deployment pipeline triggers

Answer

Standardized IDE choice for developers

Answer

Increasing training dataset size by 50%

Question 4

Which THREE of the following should be included in an AI Policy document to ensure compliance and ethical alignment?

Accepted Answer

Requirements for bias assessment and mitigation. Option A is correct because an AI policy must mandate bias assessment and mitigation to prevent discriminatory or unfair model outcomes, typically requiring testing across demographic groups and documented remediation steps. Option B is correct because transparency and disclosure requirements for automated decisions ensure stakeholders and affected users can understand when and how AI-driven decisions are made, supporting accountability and regulatory compliance. Option E is correct because data privacy and security protections are essential to safeguard personal and sensitive data used in AI systems, aligning with regulations such as GDPR and frameworks like ISO/IEC 27001. Option C is not appropriate because renaming local variables is a low-level coding style concern, not a policy-level compliance or ethics requirement. Option D is not appropriate because specific hardware purchase limits are an IT procurement or budgeting matter and do not address ethical alignment or regulatory compliance in AI governance.

Answer

Instructions for renaming local variables

Answer

Specific hardware purchase limits

Question 5

Which THREE of the following are potential risks associated with AI model 'Drift' that an auditor must account for?

Accepted Answer

Bias against specific demographic groups that emerged post-deployment. Drift impacts operational accuracy, fairness, and compliance, making it a critical governance risk.

Answer

Increased electricity consumption of servers

Answer

Inability to access the source code of the model

Question 6

Which TWO of the following are core components of an AI incident response strategy?

Accepted Answer

Defined communication protocols for internal and external stakeholders. Option B is correct because a core part of any AI incident response strategy is having defined communication protocols that specify how internal teams (e.g., security, legal, engineering) and external stakeholders (e.g., customers, regulators) are notified during an AI-related incident, ensuring timely and coordinated disclosure. Option D is correct because procedures for rolling back or disabling the model are essential containment and remediation mechanisms—if an AI model behaves harmfully or is compromised, responders must be able to revert to a prior version or shut it down to stop the impact. In contrast, option A (marketing campaigns for AI product launches) relates to go-to-market activities, not incident response. Option C (software license management for all developers) is a compliance and asset-management concern, not an incident response component. Option E (automated email server maintenance) is routine IT operations and unrelated to handling AI incidents.

Answer

Marketing campaigns for AI product launches

Answer

Software license management for all developers

Answer

Automated email server maintenance

Question 7

You are auditing a financial institution's AI governance framework. The organization has a documented AI risk appetite statement, but you find that individual AI use cases are approved without any reference to it. Which action should you recommend to remediate this gap?

Accepted Answer

Require each AI use case to be mapped to the enterprise AI risk appetite and approved by the AI governance committee.. The correct remediation is to embed the enterprise AI risk appetite into the approval workflow for each AI use case. This ensures that risk tolerance is actively applied at the point of decision, and that the AI governance committee provides necessary oversight. Simply updating the statement or adding post-hoc reviews does not close the gap of use cases being approved without reference to the appetite.

Answer

Delegate AI use case approval to the data science team to speed up innovation.

Answer

Implement a post-implementation review process to assess AI use cases after deployment.

Answer

Update the AI risk appetite statement to include more granular risk categories and thresholds.

Question 8

During an audit of an AI-based fraud detection system, you find that the model's performance is monitored only through overall accuracy. The system processes highly imbalanced data with a fraud rate of 0.5%. Which risk does this monitoring approach most likely fail to detect?

Accepted Answer

A high number of false negatives, where fraudulent transactions are missed.. Monitoring only overall accuracy on a highly imbalanced dataset can hide poor performance on the minority class. In fraud detection, missing fraudulent transactions (false negatives) is a critical risk. A model that predicts 'no fraud' for all cases would still show high accuracy. Therefore, the monitoring approach fails to detect a high number of false negatives. Auditors should recommend metrics like recall or precision-recall AUC to properly evaluate such models.

Answer

Model drift due to changes in fraud patterns over time.

Answer

Data leakage from the training set into the production environment.

Answer

Bias in the model's predictions against certain customer segments.

Question 9

An AI governance committee is reviewing a proposal to deploy a generative AI chatbot for customer service. The committee wants to ensure that the chatbot's responses do not violate company policies or regulatory requirements. Which control should be implemented to provide the highest level of assurance?

Accepted Answer

Implement real-time content filtering and human-in-the-loop review for high-risk interactions.. The highest assurance is achieved through a combination of real-time content filtering and human-in-the-loop review for high-risk interactions. This provides continuous monitoring and intervention, ensuring that the chatbot's responses align with policies and regulations. One-time exercises or disclaimers do not offer ongoing protection, and relying on the foundation model provider does not transfer compliance accountability.

Answer

Publish a disclaimer that the chatbot's responses are not official company statements.

Answer

Rely on the chatbot's foundation model provider to ensure compliance.

Answer

Conduct a one-time red teaming exercise before deployment.

Question 10

You are auditing an organization's AI governance framework and find that AI systems are being developed by various business units without any central oversight. Which governance structure would best address this issue?

Accepted Answer

Establish a centralized AI governance committee with representation from legal, risk, compliance, and business units.. Establishing a centralized AI governance committee with cross-functional representation is the most effective way to address decentralized AI development. It provides the necessary oversight, policy framework, and accountability to ensure that AI systems are developed and used in line with organizational risk appetite and regulatory requirements. Other options either fail to address the lack of oversight or do not provide a sustainable governance structure.

Answer

Outsource all AI development to a third-party vendor to ensure consistency.

Answer

Implement a mandatory training program on AI ethics for all employees.

Answer

Allow each business unit to continue developing AI independently to foster innovation.

Question 11

An auditor is reviewing an organization's AI risk management process. The organization has identified several AI risks but has not prioritized them. Which TWO factors should the auditor recommend be used to prioritize AI risks? (Choose two.)

Accepted Answer

The likelihood of the risk materializing and its potential impact on business objectives.. AI risks should be prioritized based on their likelihood and potential impact, including regulatory and legal consequences. These factors help determine which risks pose the greatest threat to the organization and should be addressed first. Other factors like team size, popularity, or cloud costs are not relevant to risk prioritization and could lead to misallocation of resources.

Answer

The popularity of the AI model among end users.

Answer

The number of data scientists assigned to the AI project.

Answer

The cost of the AI project's cloud infrastructure.

Question 12

A global retailer has deployed an AI-powered dynamic pricing engine across 14 countries. The internal audit team discovers that the system adjusts prices based on inferred customer gender and ethnicity derived from browsing behavior. The organization has a formal AI ethics policy that prohibits discriminatory pricing. Which action should the lead AI auditor recommend FIRST?

Accepted Answer

Document the policy violation and escalate it through the AI governance committee for a formal risk assessment and remediation decision.. The auditor's role is to identify and escalate governance failures, not to remediate them directly. Escalating through the AI governance committee ensures the violation is evaluated against risk appetite and that remediation is properly authorized. This maintains auditor independence and triggers the organization's formal response mechanisms, which is the correct first action when a deployed AI system violates stated ethical policy.

Answer

Immediately suspend the pricing engine in all 14 countries until a full bias audit is completed by an independent third party.

Answer

Reconfigure the model to remove gender and ethnicity variables and revalidate it before reporting the finding to management.

Answer

Issue a qualified audit opinion on the AI ethics program and schedule a follow-up review in the next audit cycle.

Question 13

An AI auditor is evaluating a natural language processing model used to screen job applicants. The model was trained on five years of historical hiring data. The auditor finds that the model's selection rate for female candidates is 72% of the rate for male candidates. According to the EEOC Uniform Guidelines, what is the auditor's PRIMARY concern?

Accepted Answer

The selection rate disparity indicates potential disparate impact, and the auditor should investigate whether the model uses proxies for gender.. The EEOC four-fifths rule provides a benchmark: a selection rate below 80% of the highest group's rate suggests disparate impact. With a 72% ratio, the auditor must investigate potential proxy discrimination. The primary concern is the legal and ethical risk of disparate impact, not model accuracy or immediate retraining. The auditor's finding should trigger a deeper review of features, training data, and validation results.

Answer

The model's use of historical hiring data is acceptable because it reflects actual past outcomes and therefore is objective.

Answer

The model should be retrained immediately using a balanced dataset with equal numbers of male and female applicants.

Answer

The model's overall accuracy metric is below the 90% threshold required for employment decisions.

Question 14

An organization is deploying an AI system that makes autonomous decisions about credit limit increases. The board asks the AI auditor to explain the concept of 'human in the loop' as it applies to this system. Which statement best describes the auditor's explanation?

Accepted Answer

Human in the loop means a human is involved in the decision-making process, either by reviewing, approving, or having the ability to override the AI's output.. Human in the loop is a governance control that ensures a human has meaningful involvement in AI-driven decisions, whether through review, approval, or override capability. It is not limited to manual approval of every case, nor is it about training data or annual audits. The auditor's explanation should convey that the principle provides accountability and a safeguard against unintended automated outcomes.

Answer

Human in the loop means the AI system must be trained on data that was labeled by human annotators.

Answer

Human in the loop means the AI system's decisions are audited annually by an external firm.

Answer

Human in the loop means a person must manually approve every individual credit limit decision before it takes effect.

Question 15

During an audit of an AI-based fraud detection system at a bank, the auditor discovers that the model's performance has degraded significantly over the past quarter. The data science team reports that the model was trained on transaction patterns from two years ago and has not been retrained. Which risk does this situation PRIMARILY represent?

Accepted Answer

Concept drift risk, because the statistical properties of the target variable have changed over time.. Concept drift is the change in the statistical relationship between input data and the target over time. In fraud detection, adversarial adaptation by fraudsters causes the model's learned patterns to become outdated. The degradation after two years without retraining is a textbook example. The auditor should identify this as a model risk and recommend a retraining schedule and performance monitoring to detect drift early.

Answer

Model bias risk, because the training data may underrepresent certain customer demographics.

Answer

Data leakage risk, because the training data may contain information from the future.

Answer

Overfitting risk, because the model has memorized the training data and cannot generalize.