AAIR Practice Test 1 — 10 Questions

Question 1

A bank's AI Governance policy requires a 'bias test' for all customer-facing models. What is the most important element to document in the audit trail?

Accepted Answer

The test methodology, criteria for success, and the specific mitigation steps taken.. For an AI bias test audit trail, the defensible record must show how the test was conducted, what threshold defined pass/fail, and what was done when bias was detected — this is what regulators and auditors need to reconstruct the decision. Documenting methodology, success criteria, and mitigation steps demonstrates due diligence and reproducibility, which is the core purpose of an audit trail. Operational trivia like hours, salaries, or tool names does not establish that the model was actually tested for fairness.

Answer

The number of hours the test took to run.

Answer

The salary of the testers.

Answer

The name of the software used for the test.

Question 2

What is the primary risk objective of 'Model Versioning' in the AI lifecycle?

Accepted Answer

To ensure auditability, reproducibility, and the ability to roll back to a known stable state.. Model versioning exists to provide auditability (who changed what and when), reproducibility (recreate any past model and its results), and rollback capability (revert to a known stable version when a new release degrades). These properties are foundational for incident response, regulatory review, and safe continuous delivery of AI systems.

Answer

To prevent unauthorized users from viewing the code.

Answer

To reduce the amount of disk space used.

Answer

To increase the model's speed in production.

Question 3

What is the primary purpose of an 'AI Risk Dashboard' for executive leadership?

Accepted Answer

To provide high-level visibility into AI risk posture and trends. An AI Risk Dashboard aggregates key risk indicators, model performance metrics, and compliance status into a concise executive view. Its primary purpose is to give leadership high-level visibility into the organization's AI risk posture and emerging trends so they can make informed strategic decisions. It does not replace governance bodies or expose raw technical logs.

Answer

To replace the need for an AI ethics committee

Answer

To provide raw model logs to the public

Answer

To monitor individual developer productivity

Question 4

What is the 'Accountability' principle in the NIST AI RMF intended to address?

Accepted Answer

Ensuring that there is clear ownership and responsibility for AI system performance and safety.. The Accountability principle in the NIST AI RMF (part of the Govern function) is about ensuring clear ownership and responsibility for AI system performance, safety, and outcomes throughout the lifecycle. It answers 'who is responsible?' so that risks are managed, issues are escalated, and redress is possible. It is not about explainability, bug-freeness, or speed.

Answer

Ensuring the AI can explain itself.

Answer

Making sure the model is free of bugs.

Answer

Ensuring that the AI system is fast.

Question 5

Which of the following is a key component of 'AI Risk Governance'?

Accepted Answer

The definition of roles and responsibilities. A key component of AI Risk Governance is the definition of roles and responsibilities, which establishes accountability for risk management across the organization. This includes specifying who owns AI risks, who approves deployments, and who monitors ongoing performance. Without clear roles, governance breaks down and risks go unmanaged.

Answer

The choice of programming language

Answer

The vendor of the cloud hosting platform

Answer

The speed of model deployment

Question 6

In the context of AI Supply Chain risk, what is the primary governance objective when evaluating a vendor's AI model transparency?

Accepted Answer

To confirm the vendor's model satisfies the internal 'Model Card' and transparency requirements for risk assessment.. The primary governance objective when evaluating a vendor's AI model transparency is to ensure the vendor provides sufficient documentation — such as model cards, datasheets, and transparency reports — to assess risks related to bias, explainability, and compliance. Confirming that the vendor's model satisfies internal Model Card and transparency requirements enables the organization to perform due diligence and integrate the model into its risk management framework.

Answer

To minimize the number of API calls made to the vendor.

Answer

To verify the vendor's financial stability and market share.

Answer

To ensure the vendor's training data includes proprietary internal company data.

Question 7

You are auditing the integration of AI risk into the Enterprise Risk Management (ERM) system. Which finding indicates a failure in the governance structure?

Accepted Answer

AI models deployed in production are missing from the centralized enterprise risk register.. A centralized enterprise risk register is the authoritative inventory of organizational risks; if production AI models are absent from it, the governance structure has failed to integrate AI risk into ERM — meaning those models are unmanaged, unreviewed, and invisible to executive and Board oversight. This is a structural governance failure because it breaks the linkage between AI risk identification and enterprise-level risk aggregation, violating the principle that all material risks must flow into the ERM.

Answer

The risk assessment template is 20 pages long.

Answer

The AI risk register is updated annually instead of monthly.

Answer

The AI risk committee meets quarterly rather than monthly.

Question 8

When coordinating between Legal and Data Science teams, what is the best way to handle 'Explainability' requirements?

Accepted Answer

Require Data Science to translate technical model output into plain language documentation. Explainability requirements exist so that non-technical stakeholders — Legal, compliance, regulators, and affected individuals — can understand how a model reaches decisions. The Data Science team owns the technical model and is best positioned to translate its behavior into plain-language documentation that Legal can review and rely on. This preserves the division of labor: Data Science explains, Legal interprets and applies.

Answer

Restrict Legal from reviewing AI model outputs

Answer

Let Legal define the technical parameters of the models

Answer

Only document model logic when a lawsuit occurs

Question 9

When setting KPIs for an AI risk program, which metric is a leading indicator of potential model bias?

Accepted Answer

Demographic parity ratio in training data samples. Demographic parity ratio in training data samples is a leading indicator because it measures the representation of protected groups before the model is deployed. A skewed ratio (e.g., far from 1.0) signals that the model may learn biased patterns, allowing proactive mitigation. Unlike lagging metrics such as complaints, it provides early warning during data collection and preprocessing.

Answer

Average model inference latency

Answer

Percentage of customer complaints regarding AI decisions

Answer

Number of model updates per quarter

Question 10

Which THREE actions should be taken when integrating AI risk into the broader ERM (Enterprise Risk Management) framework?

Accepted Answer

Establish aligned risk scoring criteria across all business functions.. Option B is correct because integrating AI risk into ERM requires a consistent, enterprise-wide risk scoring methodology so AI risks can be compared, aggregated, and prioritized alongside operational, financial, and compliance risks in the same register. Option D is correct because a shared risk taxonomy must be extended to capture AI-specific concepts such as model bias, data drift, hallucination, and model opacity; without common definitions, AI risks cannot be consistently identified, classified, or reported across functions. Option E is correct because AI risk owners must sit within the same governance and escalation channels (e.g., the same risk committee and reporting lines) as other risk owners, ensuring AI risk is not siloed and receives the same oversight, accountability, and board visibility as traditional risks. Option A does not belong because outsourcing all AI risk management removes internal ownership and accountability, which contradicts ERM principles of retained responsibility and integrated oversight. Option C does not belong because prohibiting every AI initiative with any inherent risk is an avoid-or-eliminate approach rather than risk-based management, and it would block innovation instead of treating, transferring, or accepting AI risk within defined tolerances.

Answer

Outsource all AI risk management to a third-party consultant.

Answer

Prohibit all AI initiatives that carry any inherent risk.