AAIA AI Governance And Risk — Timed 20 Questions

Question 1

You are auditing a firm's AI policy and find that the 'Model Inventory' in the enterprise risk management platform lacks versioning metadata. Which specific control gap should be prioritized to align with NIST AI RMF?

20 minute time limit — choose an answer to begin.

Accepted Answer

Lack of immutable audit logs for model architecture changes. NIST AI RMF's Govern and Map functions require maintaining a model inventory with sufficient metadata to trace model lineage, changes, and approvals. Missing versioning metadata means there is no immutable record of architecture changes, so the prioritized control gap is the lack of immutable audit logs for model architecture changes, which directly undermines traceability and accountability.

Answer

Absence of automated model deployment pipelines

Answer

Failure to define the RPO for the primary database

Answer

Insufficient budget for cloud storage of historical data

Question 2

During an audit of AI procurement, you find that the 'Vendor AI Assessment' questionnaire is missing. What is the correct next step?

Accepted Answer

Immediately halt the use of the vendor until a formal risk assessment is completed. An auditor must ensure that third-party AI risks are evaluated using a formal, documented process.

Answer

None of the above

Answer

Update the office building safety guidelines

Answer

Ask the vendor for their marketing presentation

Answer

Ignore the missing document if the vendor is well-known

Question 3

During an audit of Google Cloud Vertex AI, you discover that sensitive PII is being logged during model inference. You need to implement a control that enforces privacy at the model serving layer. Which configuration should you verify?

Accepted Answer

Vertex AI Model privacy and data masking controls. Vertex AI Model privacy and data masking controls are the specific serving-layer feature that lets you redact or mask sensitive fields (such as PII) before they are written to prediction logs. Verifying this configuration ensures that inference requests/responses captured by Vertex AI logging pipelines are sanitized at the model serving layer, satisfying the audit requirement.

Answer

Vertex AI Model Monitoring for data drift

Answer

Vertex AI Feature Store access logs

Answer

Cloud IAM role binding for Vertex AI

Question 4

An organization is using 'Federated Learning' to maintain data privacy while training models. What is the primary audit risk associated with this architecture?

Accepted Answer

Model inversion attacks targeting the central aggregator. In Federated Learning, local model updates (gradients) can potentially reveal information about the underlying training data, necessitating 'Differential Privacy' as a control.

Answer

Increased training latency

Answer

Lack of access to training hardware

Answer

Centralized data breaches

Question 5

Which TWO of the following are legitimate 'AI Governance' concerns regarding third-party AI service providers (SaaS)?

Accepted Answer

Data residency and compliance with local regulations. Option B is correct because AI governance for third-party SaaS providers must address where training data, prompts, and outputs are stored and processed, since data residency directly affects compliance with regulations such as GDPR, HIPAA, or sector-specific data localization laws. Option C is correct because governance requires contractual third-party audit rights and transparency into how the vendor develops, trains, and validates its models, enabling accountability for bias, safety, and provenance. Option A is not a governance concern because the vendor's programming language is an implementation detail that does not affect compliance, risk, or accountability. Option D is not selected because, while model update and retraining frequency can be a technical or operational consideration, it is not one of the two governance concerns identified here. Option E is not selected because the physical location of a corporate office is distinct from data residency and does not by itself determine regulatory compliance.

Answer

The programming language used by the vendor

Answer

Vendor's model update and retraining frequency

Answer

The physical location of the vendor's corporate office

Question 6

When auditing an AI system for regulatory compliance, you find that data lineage is broken between the feature store and the training pipeline. Which control is most likely deficient?

Accepted Answer

Metadata logging and transformation documentation. Feature stores must maintain end-to-end traceability to ensure that data provenance is clear and auditable.

Answer

Access control lists for the model production environment

Answer

Encryption of data at rest in the data warehouse

Answer

Load balancing configuration for the inference API

Question 7

A firm uses a third-party AI service. Which control is most critical to ensure compliance with the firm's own AI governance policy?

Accepted Answer

Including AI-specific compliance requirements in the vendor service-level agreement (SLA). Supply chain risk management requires mapping vendor controls to internal governance requirements.

Answer

Conducting weekly penetration tests on the vendor's office premises

Answer

Requesting the vendor's employee turnover rates for the last fiscal year

Answer

Requiring the vendor to submit copies of all their marketing brochures

Question 8

You are auditing a 'Model Monitoring' dashboard. Which metric is most indicative of a potential degradation in the model's reliability over time?

Accepted Answer

Statistical drift between the production input data and training baseline. Data drift and concept drift are primary indicators that a model's performance may be degrading in a production environment.

Answer

The physical location of the cloud server hosting the model

Answer

The number of lines of code in the model deployment script

Answer

The number of users accessing the model API

Question 9

You are assessing a company's 'AI Governance Committee'. Which action best demonstrates effective board-level oversight?

Accepted Answer

Approving the annual AI strategy and corresponding risk mitigation plans. Board-level oversight in an AI Governance Committee centers on strategic direction and risk appetite, not operational execution. Approving the annual AI strategy and its corresponding risk mitigation plans is a fiduciary, governance-level action that sets direction, allocates accountability, and ensures risk is managed at the highest level. This mirrors how boards approve corporate strategy and enterprise risk registers rather than getting involved in tactical decisions.

Answer

Managing the day-to-day procurement of data labeling services

Answer

Reviewing individual code commits for AI model training

Answer

Selecting the machine learning framework used by data scientists

Question 10

Which component of an AI policy is most important for establishing organizational accountability?

Accepted Answer

Defining the roles and responsibilities of the AI Governance Committee and model owners. Accountability requires clearly defined roles and responsibilities for AI system oversight.

Answer

Describing the history of artificial intelligence research

Answer

Listing the hardware specifications of the training clusters

Answer

Providing the contact information for the company's PR department

Question 11

During an AI risk assessment, you notice that the 'Model Risk Management' (MRM) framework does not mandate independent validation for models categorized as 'High Impact'. What is the most significant consequence?

Accepted Answer

Increased probability of undetected systemic model bias or failure. Independent validation is a core pillar of model risk governance, especially for high-impact systems.

Answer

Inability to detect model drift in production environments

Answer

Non-compliance with internal cybersecurity patching cycles

Answer

Operational silos between the AI team and the IT department

Question 12

A board of directors asks you to define the 'AI Risk Appetite'. Which approach best satisfies the governance requirement?

Accepted Answer

Defining quantitative thresholds for acceptable model performance and ethical impact. Risk appetite must align with the organization's business objectives and ethical standards.

Answer

Creating a repository of all AI ethical guidelines published by NGOs

Answer

Providing the board with a list of all AI vendors used in the organization

Answer

Restricting all AI development to on-premises environments

Question 13

Which TWO of the following are primary components of an AI model risk management inventory?

Accepted Answer

Training data provenance and lineage information. Option B is correct because training data provenance and lineage information is a core element of an AI model risk management inventory, as it documents where data originated, how it was transformed, and its chain of custody, which is essential for assessing bias, compliance, and reproducibility risks. Option D is correct because the model purpose and business application description defines what the model does, the decisions it informs, and its operational context, which is necessary to scope and prioritize risk assessments. Options A, C, and E are incorrect because employee performance review scores, office furniture lists, and marketing budgets are unrelated to the technical, ethical, and regulatory risk characteristics of AI models and therefore do not belong in a model risk management inventory.

Answer

Employee performance review scores

Answer

List of office furniture used by the team

Answer

Marketing budget for the model launch

Question 14

Which THREE factors must be evaluated when assessing the 'Fairness' of an AI model?

Accepted Answer

Disparities in model error rates across protected groups. Fairness assessment requires examining disparities in model error rates across protected groups (B), because unequal false-positive or false-negative rates (e.g., via equalized odds or error-rate parity) directly reveal discriminatory performance. Historical bias present in the training datasets (C) must be evaluated since biased or unrepresentative data propagates and amplifies unfair outcomes in the model. Demographic parity metrics for the model's predictions (D) are also essential, as they quantify whether favorable outcomes are distributed equally across groups (e.g., via disparate impact ratio). The programming language used to build the model (A) is irrelevant to fairness, as fairness depends on data, features, and evaluation metrics rather than implementation language. The number of CPU cores allocated for training (E) affects computational performance only, not the fairness of the model's predictions.

Answer

The programming language used to build the model

Answer

The number of CPU cores allocated for training

Question 15

A data scientist proposes using a 'black-box' model for a high-stakes loan approval process. Which action does your AI audit framework require?

Accepted Answer

Mandating the use of XAI (Explainable AI) tools to interpret model decisions. In high-stakes domains like loan approval, regulations (e.g., ECOA, GDPR) and ethical AI principles require that decisions be explainable to affected individuals and auditors. XAI tools (e.g., LIME, SHAP, counterfactual explanations) provide post-hoc interpretability for black-box models, enabling justification of denials and detection of bias. Thus, an AI audit framework would mandate XAI to ensure transparency and accountability, making option A correct.

Answer

Requiring the data scientist to publish the code on an internal repository

Answer

Allowing the model if it achieves 99% accuracy on the test set

Answer

Asking the marketing team to verify the model's fairness

Question 16

What is the goal of a 'Human-in-the-loop' (HITL) control in an AI system?

Accepted Answer

To provide human oversight for automated decisions to mitigate risk and error. HITL ensures that a human makes final decisions for high-stakes AI outputs, reducing the risk of automation error.

Answer

To reduce the time spent on manual data entry

Answer

To replace all human employees with automated systems

Answer

To increase the speed of model training

Question 17

Which document is the primary source for establishing the scope of an AI audit?

Accepted Answer

The internal AI Policy and the organization's Risk Management Framework. The internal AI Policy defines the rules, boundaries, and requirements for AI use, while the Risk Management Framework establishes how risks are identified, assessed, and mitigated. Together they define what an AI audit must cover, including scope, criteria, and risk areas. Auditors use these documents to determine which systems, processes, and controls fall within the audit boundary.

Answer

A list of all employees who have taken an AI training course

Answer

The company's social media posting guidelines

Answer

The employee handbook for the engineering department

Question 18

During an audit, you find that the AI training data includes personally identifiable information (PII) that was not anonymized. Which regulation does this most likely violate?

Accepted Answer

GDPR (General Data Protection Regulation). GDPR Article 5(1)(f) and Article 32 require appropriate technical measures to protect personal data, and Article 6 requires a lawful basis for processing — training an AI on unanonymized PII without consent or another lawful basis violates these principles. GDPR also grants data subjects rights (access, erasure, objection) that are difficult to honor once PII is baked into model weights. This makes GDPR the clear regulatory fit.

Answer

The Model Building Standards Act

Answer

The Sarbanes-Oxley Act

Answer

The Internal Server Maintenance Code

Question 19

You are reviewing the 'AI Incident Response Plan'. Which element is essential for compliance?

Accepted Answer

Defined escalation paths for ethical or performance incidents. An AI Incident Response Plan must specify clear escalation paths for ethical or performance incidents to ensure that issues such as bias, safety violations, or model failures are promptly reported and addressed by the appropriate stakeholders. This is essential for compliance with regulations like the EU AI Act, which mandates incident reporting and accountability. Without defined escalation paths, organizations cannot demonstrate timely and effective response, risking legal and reputational damage.

Answer

The history of the company's founding

Answer

A log of all office supply purchases

Answer

A list of all cafeteria menus in the building

Question 20

Which technique is most appropriate for mitigating 'Concept Drift' in a production model?

Accepted Answer

Implementing an automated re-training pipeline based on performance threshold triggers. Continuous re-training or fine-tuning based on recent data is the standard mitigation for concept drift.

Answer

Increasing the number of neurons in the hidden layers

Answer

Moving the model to a larger GPU cluster

Answer

Restricting access to the training dataset