AAIR Practice Test 12 — 15 Questions

Question 1

A firm adopts the 'Three Lines of Defense' model for AI. What is the specific responsibility of the 'Third Line' (Internal Audit)?

Accepted Answer

Providing independent assurance on the design and effectiveness of the AI governance framework.. The Third Line of Defense in the Three Lines of Defense model is Internal Audit, which provides independent, objective assurance to the board and senior management on the design and operating effectiveness of the AI governance framework, including risk management and controls. It does not own or operate AI controls; it evaluates them. This independence is what distinguishes it from the First Line (business/IT operations) and Second Line (risk/compliance).

Answer

Approving AI model deployment.

Answer

Developing the AI models.

Answer

Defining the AI risk appetite.

Question 2

A financial institution uses an AI model to approve loans. After deployment, they notice the model is rejecting loan applications from a specific region at a rate 30% higher than historical human benchmarks. What is the most appropriate next step in the risk lifecycle?

Accepted Answer

Conduct a bias investigation by comparing input distribution shifts between training data and current inference requests.. A 30% higher rejection rate for a specific region versus historical human benchmarks is a classic bias/drift signal, so the correct risk-lifecycle step is to investigate by comparing the input distribution at inference time against the training distribution. This determines whether the disparity stems from data drift, a biased feature, or a genuine change in the population, and it produces evidence before any remediation decision. Ignoring, shutting down, or building an override model are premature or inappropriate responses.

Answer

Ignore the shift as it may be a temporary market trend.

Answer

Immediately shut down the system.

Answer

Train a secondary model to override the primary one.

Question 3

You are assessing risk for an AI model that uses 'Transfer Learning'. What is the most critical risk to manage regarding the pre-trained base model?

Accepted Answer

The base model may have been trained on data that contains inherent, unidentifiable biases.. Transfer learning risks include the inheritance of latent biases from the pre-trained weights.

Answer

The base model cannot be used with custom datasets.

Answer

The base model will always run out of memory.

Answer

The base model requires a proprietary operating system.

Question 4

Which metric is useful for measuring the 'Efficiency' of an AI risk program?

Accepted Answer

Time to complete a risk assessment for new models. Time to complete a risk assessment for new models is a direct efficiency metric because it measures the throughput and speed of the risk program's core process — how quickly it can evaluate and onboard AI models. Efficiency metrics compare outputs to inputs (time, cost, effort), and assessment cycle time captures how productively the program converts review effort into completed assessments. Shorter cycle times with consistent quality indicate a more efficient program.

Answer

Number of emails sent

Answer

Total weight of the hardware

Answer

Number of meetings held

Question 5

When reporting AI risk to the board, which approach best demonstrates 'Risk Culture' maturity?

Accepted Answer

Presenting a heatmap showing residual risk levels against the defined enterprise risk appetite.. Presenting a heatmap of residual risk against the enterprise risk appetite demonstrates Risk Culture maturity because it shows the board not just what risks exist, but how they compare to the organization's stated tolerance thresholds. This reflects an integrated, governance-driven approach where risk is quantified, contextualized, and actively managed rather than merely inventoried. Mature risk culture requires translating technical AI risk into business-relevant terms that support informed decision-making at the board level.

Answer

Listing all AI projects currently in production with their budget spend.

Answer

Reporting solely on the number of successful cyber attacks against the AI infrastructure.

Answer

Providing a list of all AI models currently undergoing training.

Question 6

Why is 'Explainability' considered a key risk management control in the AI lifecycle?

Accepted Answer

It enables identification of potential bias, errors, or unexpected behavior in model decision-making.. Explainability provides visibility into how a model arrives at its outputs, which allows teams to detect bias, errors, and unexpected behavior before they cause harm. In risk management terms, it is a detective and preventive control that supports incident investigation, regulatory compliance, and stakeholder trust. Without it, failures can go undiagnosed and accountability becomes impossible.

Answer

It guarantees the model will never fail.

Answer

It increases the inference speed of the model.

Answer

It allows the model to train on less data.

Question 7

You are defining KPIs for an AI project in a regulated industry. Which metric best captures model reliability over time?

Accepted Answer

Model drift (data drift/concept drift). Model drift — encompassing data drift and concept drift — directly measures whether a model's predictive behavior remains aligned with the real-world distribution it was trained on. It is the canonical reliability KPI because it captures degradation over time before it manifests as business harm. Retraining frequency, iteration counts, and compute cost are operational metrics, not reliability indicators.

Answer

Frequency of model retraining

Answer

Number of training iterations

Answer

Total cost of compute resources

Question 8

A company is implementing 'Human-in-the-Loop' (HITL) for its AI decision system. What is the primary risk of relying on HITL?

Accepted Answer

The 'automation bias' or 'rubber stamping' of decisions by human reviewers.. Human fatigue and cognitive bias can lead to poor oversight, potentially creating a false sense of security.

Answer

It requires expensive API calls.

Answer

It causes the model to become slower.

Answer

It forces the model to use a specific programming language.

Question 9

What is the primary benefit of documenting 'AI Model Lineage'?

Accepted Answer

It provides transparency, auditability, and the ability to reproduce models.. Documenting AI Model Lineage provides transparency, auditability, and reproducibility by capturing the full chain of data sources, transformations, hyperparameters, code versions, and dependencies used to produce a model. This record allows auditors and regulators to trace how a model was built, verify compliance with policies, and reproduce or re-validate the model when needed. It is a foundational governance artifact rather than a performance optimization.

Answer

It ensures the model is smaller in file size.

Answer

It helps the marketing team write better ads.

Answer

It makes the model run faster.

Question 10

Which department is primarily responsible for ensuring AI models comply with data protection regulations like GDPR?

Accepted Answer

The Compliance/Legal Department and the Data Protection Officer.. GDPR compliance for AI models requires legal interpretation of lawful basis, data subject rights, DPIA obligations, and cross-border transfer rules, which sit with the Compliance/Legal Department and the Data Protection Officer. The DPO is specifically mandated under GDPR Articles 37-39 to monitor compliance, advise on DPIAs, and act as the contact point with supervisory authorities. Engineering, sales, and finance teams may implement or consume the model, but they do not own the regulatory interpretation.

Answer

The Sales force.

Answer

The Accounting Department.

Answer

The Janitorial staff.

Question 11

In the context of AI model risk management, what is the role of an 'AI Model Inventory' within the governance framework?

Accepted Answer

To track model metadata, risk ratings, and owners for oversight and audit purposes.. An AI Model Inventory is the governance system of record that catalogs every model in production or development, capturing metadata such as purpose, owner, version, risk rating, validation status, and dependencies. Its role is to enable oversight, audit, and regulatory reporting by giving risk and compliance teams a single view of the AI estate. This is why option A is correct.

Answer

To store the actual training data sets for backup.

Answer

To limit the number of AI developers in the company.

Answer

To serve as a marketing catalog for external clients.

Question 12

During a board meeting, the Chief Risk Officer needs to present AI model performance trends. Which metric is most critical for board-level reporting?

Accepted Answer

Frequency and severity of model drift incidents. Model drift directly affects model reliability, business outcomes, and risk exposure — it signals that a deployed model's predictions may no longer be valid, which is a material risk the board must understand. Frequency and severity of drift incidents quantify both how often models degrade and how impactful those degradations are, making it the most decision-relevant metric for board-level risk reporting.

Answer

Data scientists' training hours per quarter

Answer

Computational resource utilization percentage

Answer

Model latency in milliseconds

Question 13

An organization is using a centralized AI Governance structure. What is the biggest risk of this approach compared to a decentralized one?

Accepted Answer

Operational bottlenecks and delayed AI project timelines.. A centralized AI Governance structure concentrates decision-making, policy approval, and review authority in a single body. While this ensures consistency, it creates a single queue through which all AI projects must pass, producing operational bottlenecks and delayed project timelines. The other options describe risks more associated with decentralized or ungoverned structures.

Answer

Higher infrastructure costs.

Answer

Lack of standardized policy.

Answer

Increased risk of shadow AI.

Question 14

What is 'Bias' in the context of AI risk?

Accepted Answer

Systematic prejudice in model outputs leading to unfair results. In AI risk taxonomy, bias refers to systematic and unfair prejudice in model outputs that disadvantages individuals or groups based on protected attributes like race, gender, or age. It arises from skewed training data, flawed feature selection, or proxy variables, and manifests as disparate impact in decisions such as hiring, lending, or healthcare. It is a fairness risk, not a documentation, cost, or performance issue.

Answer

The model is missing documentation

Answer

The model is too expensive to maintain

Answer

The model is running too fast

Question 15

A board of directors requests a dashboard view of AI model drift. Which metric is most appropriate for a board-level risk report?

Accepted Answer

Feature drift threshold violations. Feature drift threshold violations are the most appropriate board-level metric because they directly signal when input data distributions have shifted beyond acceptable bounds, which is the leading indicator of model risk. Boards need a governance-level signal of emerging model unreliability, not raw performance numbers. Threshold violations translate technical drift into a risk posture that non-technical directors can act on.

Answer

Mean Squared Error (MSE)

Answer

GPU utilization percentage

Answer

Latency per inference request