AAIR Practice Test 16 — 15 Questions

Question 1

An enterprise is establishing its AI Governance Committee. Which stakeholder is most critical to include to ensure alignment between AI technical capabilities and the organization's enterprise risk appetite?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Chief Risk Officer. The Chief Risk Officer (CRO) owns the enterprise risk appetite and framework, so including the CRO ensures AI risks are calibrated to the organization's overall risk tolerance rather than treated as a standalone technical concern. The CRO can translate AI-specific risks (bias, model drift, regulatory exposure) into the enterprise risk taxonomy and ensure governance decisions align with board-approved risk limits. This alignment is the committee's core purpose, making the CRO the most critical stakeholder.

Answer

Head of Legal

Answer

Chief Information Security Officer

Answer

Lead Data Scientist

Question 2

Which document is the primary reference for defining an organization's AI Risk Governance structure?

Accepted Answer

The AI Governance Charter/Policy.. The AI Governance Charter/Policy is the foundational document that defines the organization's AI risk governance structure, including roles, responsibilities, committees, and escalation paths. It is the authoritative reference that establishes how AI risk is owned, reviewed, and controlled across the enterprise. Other documents may reference it but do not define the governance structure itself.

Answer

The IT hardware inventory report.

Answer

The employee handbook.

Answer

The AI project development backlog.

Question 3

How should an 'AI Ethics Committee' interact with the 'AI Risk Governance' body?

Accepted Answer

The Ethics Committee should serve as an advisory body to the governance framework.. An AI Ethics Committee should function as an advisory body that informs and guides the AI Risk Governance framework, providing ethical expertise, stakeholder perspectives, and recommendations on responsible AI use. It does not own the risk decisions or replace governance; instead, it feeds ethical considerations into the governance process so that risk owners can make informed, defensible choices. This separation preserves accountability while ensuring ethics is systematically considered.

Answer

The Ethics Committee should be responsible for coding the AI.

Answer

The Ethics Committee should have final veto power over all projects.

Answer

The Ethics Committee should replace the Risk Governance body.

Question 4

When managing AI lifecycle risk for a model in a regulated industry, which artifact serves as the most important audit trail for the model's provenance?

Accepted Answer

The end-to-end model lineage and version control logs.. The end-to-end model lineage and version control logs provide the complete, traceable record of how the model was built — including data sources, training runs, hyperparameters, code commits, and artifact versions. This is the artifact auditors and regulators rely on to reconstruct the model's provenance and reproduce its behavior. Access logs, latency metrics, and billing statements document operational or financial activity, not the model's origin or derivation.

Answer

The user access logs for the dashboard.

Answer

The model's current latency metrics.

Answer

The cloud provider's billing statement.

Question 5

During a board-level review, a bank needs to demonstrate the effectiveness of its AI Risk Governance. Which metric should be presented to the board to align with the 'Accountability' principle of the AI RMF?

Accepted Answer

The percentage of AI models with documented, independent model risk management (MRM) validation.. The Accountability principle of the AI RMF requires that organizations define, document, and assign responsibility for AI risk management, and demonstrate that those responsibilities are being fulfilled. The percentage of AI models with documented, independent MRM validation is a direct, quantifiable measure of whether independent oversight and accountability controls are operating effectively. This metric shows the board that model risk is being independently challenged and validated, which is the essence of accountability in AI governance.

Answer

The total computational cost of running the models.

Answer

The number of lines of code written for the AI model.

Answer

The frequency of model retraining cycles.

Question 6

An organization is updating its risk appetite statement for AI. Which specific element should be addressed to manage the 'hallucination' risk of LLMs?

Accepted Answer

Require human-in-the-loop for any AI-generated output used in customer-facing content.. Hallucination risk in LLMs — where the model generates plausible but factually incorrect output — is best managed by requiring human-in-the-loop review for any AI-generated content used in customer-facing communications. This ensures a human validates factual accuracy before the output reaches customers, directly mitigating the reputational, legal, and financial harm of hallucinations. This control aligns with the risk appetite principle of defining acceptable risk thresholds and the corresponding controls.

Answer

Set a performance goal to reduce the model parameter count.

Answer

Increase the frequency of periodic penetration testing.

Answer

Limit the training dataset to under 10GB.

Question 7

Which TWO metrics are standard in 'Monitoring' for identifying performance-related AI risks?

Accepted Answer

Inference request latency.. Latency and error rates are the primary operational indicators of model performance risk.

Answer

The number of lines of documentation.

Answer

The color of the deployment dashboard.

Answer

The total number of servers available.

Question 8

Which documentation is necessary to provide to auditors for an AI system?

Accepted Answer

The model card or model documentation. Model cards (and related model documentation such as datasheets for datasets) are the standard artifacts auditors expect for AI systems because they disclose a model's intended use, training data, performance metrics, limitations, ethical considerations, and evaluation results. They provide the transparency and traceability auditors need to assess whether the AI system is being used appropriately and whether its risks are understood and documented. This aligns with NIST AI RMF transparency and accountability principles.

Answer

A list of all employees who attended a conference

Answer

The login credentials for the production environment

Answer

The complete source code without comments

Question 9

Why is 'Model Validation' (distinct from testing) essential in an AI Governance framework?

Accepted Answer

To provide independent assurance that the model performs as expected and within risk thresholds.. Model Validation provides independent assurance that a model performs as expected and stays within defined risk thresholds. Unlike testing (which is typically performed by developers to check functional correctness), validation is an independent governance control that confirms the model meets business, ethical, and regulatory requirements before and after deployment. It is a core pillar of AI governance frameworks because it creates an auditable, objective checkpoint that separates the builder from the assessor.

Answer

To ensure the developers have followed the coding standards.

Answer

To save money on cloud hosting.

Answer

To speed up the coding process.

Question 10

A firm is integrating AI into its ERM (Enterprise Risk Management). What is the primary benefit of a 'Common Risk Taxonomy' for AI?

Accepted Answer

It ensures consistent risk identification, communication, and reporting across the organization.. A common taxonomy ensures that AI risk is understood and communicated consistently across the enterprise.

Answer

It forces all AI models to be identical.

Answer

It makes AI code easier to write.

Answer

It eliminates the need for risk assessments.

Question 11

An organization is establishing an AI governance framework. Which approach is most effective for aligning AI risk appetite with enterprise-wide risk management (ERM)?

Accepted Answer

Map AI-specific risk metrics to existing enterprise risk categories like operational, financial, and reputational risk.. Mapping AI-specific risk metrics to existing enterprise risk categories (operational, financial, reputational) integrates AI risk into ERM rather than treating it as a silo. This lets the organization express AI risk appetite in the same language and scales used for other risks, enabling consistent aggregation, reporting, and board-level oversight. It is the approach most aligned with COSO ERM and ISO 31000 integration principles.

Answer

Establish a top-down mandate that ignores business unit input to ensure uniformity.

Answer

Focus solely on technical model performance metrics to define the organizational risk appetite.

Answer

Create a separate AI-specific risk register that operates independently of the corporate risk register.

Question 12

A financial services firm is integrating the NIST AI Risk Management Framework (AI RMF) into its existing governance structure. The AI governance lead is tasked with ensuring that the 'Govern' function is properly implemented. Which two actions are essential for establishing effective AI risk governance? (Choose two.)

Accepted Answer

Establishing a process for regular review and update of AI risk policies and procedures.. The essential actions for effective AI risk governance under the Govern function are defining and documenting roles and responsibilities, and establishing a process for regular review and update of AI risk policies. These ensure accountability, clarity, and adaptability. The other options are either technical details, centralize authority inappropriately, or represent excessive risk avoidance, none of which are required by the AI RMF Govern function.

Answer

Ensuring that all AI models are developed using a single, standardized programming language.

Answer

Requiring that all AI risk decisions be made by the Chief Technology Officer.

Answer

Implementing a policy that prohibits the use of AI in any customer-facing applications.

Question 13

A multinational corporation is aligning its AI risk governance with the NIST AI Risk Management Framework (AI RMF). The Chief Risk Officer wants to ensure that the organization's risk appetite for AI is clearly articulated and integrated into decision-making. Which action best supports this objective?

Accepted Answer

Developing a statement of AI risk appetite that defines acceptable levels of risk for different categories of AI systems, approved by the board.. The correct action is to develop a board-approved statement of AI risk appetite that defines acceptable risk levels for different AI categories. This directly articulates risk appetite and integrates it into decision-making by providing clear guidance. It aligns with the AI RMF Govern function, which requires a risk appetite framework to guide AI risk management. Board approval ensures authority and alignment with enterprise strategy.

Answer

Adopting the risk appetite of a leading technology company without modification to save time.

Answer

Delegating AI risk appetite definition to the data science team to ensure technical feasibility.

Answer

Requiring all AI projects to undergo a full quantitative risk assessment using Monte Carlo simulation.

Question 14

An insurer deploys a claims-triage model built by an external vendor. The contract grants the insurer use rights but the vendor refuses to disclose training data composition or feature engineering logic, citing trade secrets. Internal audit must document residual risk before the model enters production. Which action best fulfills the AI risk management obligation given these constraints?

Accepted Answer

Document the opacity as a residual risk, obtain contractual attestations and independent testing rights, and set compensating controls such as challenger models and outcome monitoring.. Third-party opacity is a governance risk that must be recorded, not silently accepted. The defensible path is to document the limitation as residual risk, strengthen the contract with attestations and testing rights, and apply compensating controls such as challenger models and ongoing outcome monitoring. This preserves the business capability while giving audit and the risk committee visibility and enforceable levers.

Answer

Reject the vendor outright and rebuild the model internally using the insurer's own historical claims data.

Answer

Request the vendor's model card and treat its published performance metrics as the primary validation evidence.

Answer

Accept the vendor's position and rely on the vendor's SOC 2 report as sufficient third-party assurance.

Question 15

A multinational bank has assigned its AI governance responsibilities across the Three Lines of Defense. The second line has drafted an AI risk appetite statement, but the board wants assurance that the first line's AI use cases remain within that appetite. Which activity should the second line perform to provide this assurance while preserving its independence?

Accepted Answer

Independently review first-line AI risk assessments and challenge whether residual risk remains within the approved appetite.. Second-line assurance over AI risk appetite is delivered through independent review and credible challenge of first-line assessments, not by taking over operational controls or audit functions. This keeps risk ownership with the first line while giving the board objective evidence that residual AI risk is being managed within the approved appetite.

Answer

Directly approve or reject each first-line AI use case before deployment.

Answer

Operate the AI monitoring dashboards and tune alert thresholds for model drift.

Answer

Commission an external audit of the AI governance program and report findings to the board.