AAIR Practice Test 5 — 25 Questions

Question 1

Which TWO teams should be involved in the initial risk review for an AI chatbot?

Accepted Answer

Data Science/ML Engineering. Option A (Data Science/ML Engineering) is correct because this team owns the chatbot's model design, training data, and evaluation metrics, so they are best positioned to identify technical risks such as bias, hallucination, prompt injection, and data leakage during an initial risk review. Option B (Legal Department) is correct because legal must assess regulatory compliance (e.g., GDPR, CCPA), intellectual property, liability, and contractual exposure arising from the chatbot's outputs and data handling. The remaining options do not belong: the mailroom staff (C), local fitness coach (D), and custodial cleaning staff (E) have no role in AI system risk assessment, data governance, or regulatory compliance for a chatbot.

Answer

The company mailroom staff

Answer

The local fitness coach

Answer

The custodial cleaning staff

Question 2

When integrating AI risk into the broader ERM (Enterprise Risk Management) framework, which approach is most effective?

Accepted Answer

Map AI risks to existing risk categories (e.g., operational, compliance). Mapping AI risks to existing risk categories such as operational, compliance, and strategic risks integrates AI into the broader ERM framework. This allows the organization to leverage established risk management processes, reporting lines, and mitigation strategies. It ensures AI risks are not siloed and receive appropriate visibility and resourcing.

Answer

Only report AI risks if they result in a financial loss

Answer

Keep AI risks in a separate, isolated tracking system

Answer

Automate the removal of AI risks from the main risk register

Question 3

Which stage of the AI lifecycle should risk management activities begin?

Accepted Answer

During the design and requirements phase. Risk management activities should begin during the design and requirements phase of the AI lifecycle to proactively identify and mitigate potential risks before they materialize. This early integration ensures that ethical, legal, and operational risks are considered from the outset, reducing costly rework and harm. Waiting until later stages increases the likelihood of unintended consequences.

Answer

When the budget is exhausted

Answer

After the model is fully deployed

Answer

Only when a bug is reported

Question 4

Which TWO stakeholders are most important to engage when establishing an AI risk appetite?

Accepted Answer

The Board of Directors or Executive Committee.. The Board of Directors or Executive Committee (B) is essential because setting AI risk appetite is a governance responsibility — this body defines the organization's overall tolerance for risk, approves strategic direction, and holds ultimate accountability for AI-related decisions, so their engagement ensures the appetite aligns with corporate strategy and fiduciary duties. Legal and Compliance officers (D) are equally critical because they translate regulatory obligations (e.g., GDPR, EU AI Act, sector-specific rules), contractual duties, and ethical/legal constraints into concrete risk thresholds and controls, ensuring the stated appetite is lawful and enforceable. The building security personnel (A) focus on physical premises protection, not enterprise AI risk governance, so they are not key stakeholders here. The office cleaning staff (C) have no role in defining strategic risk tolerance. The company's social media followers (E) are external parties whose opinions may inform reputation considerations but who hold no governance authority over risk appetite.

Answer

The building security personnel.

Answer

The office cleaning staff.

Answer

The company's social media followers.

Question 5

When performing an AI risk assessment, which question is most appropriate to ask?

Accepted Answer

What is the potential impact if the model produces biased results?. The most appropriate risk-assessment question probes potential harm and impact, such as the consequences of biased model outputs. This focuses the assessment on likelihood and severity of adverse outcomes, which is the core of risk analysis. Questions about team size, accuracy scores, or library choices are inputs or metrics, not risk-impact questions.

Answer

How many people are on the development team?

Answer

What is the model's highest accuracy score?

Answer

Does the model use open-source libraries?

Question 6

Which action should be taken if a model's performance consistently falls outside the 'Risk Appetite' threshold?

Accepted Answer

Take the model offline for remediation. When a model's performance consistently falls outside the defined Risk Appetite threshold, the organization has exceeded its tolerance for risk, so the model should be taken offline for remediation to prevent potential harm or compliance violations. This action aligns with governance principles that require corrective action when risk limits are breached. Simply ignoring or adjusting the threshold would undermine the risk management framework.

Answer

Only inform the IT team

Answer

Ignore the result as it is just a statistical outlier

Answer

Increase the threshold to match current performance

Question 7

Which TWO documents are essential to include in the AI Risk Project 'Review Pack'?

Accepted Answer

A detailed risk mitigation and action plan.. Option B, a detailed risk mitigation and action plan, is essential because the Review Pack must show how identified AI risks will be treated, including specific controls, owners, timelines, and residual-risk decisions that reviewers can evaluate. Option E, a comprehensive AI Risk Assessment report, is essential because it provides the core evidence of risk identification, analysis, and evaluation, such as model purpose, data sources, affected stakeholders, likelihood/impact ratings, and inherent risk levels. Together, B and E give the Review Pack both the assessment basis and the remediation roadmap needed for governance sign-off. The unmarked options do not belong: A (team lunch schedule) and D (company lease agreement) are unrelated administrative documents, and C (list of all software installed on company laptops) is an IT asset inventory that, while potentially useful elsewhere, is not one of the two essential AI risk review documents in this scenario.

Answer

A summary of the team's lunch schedule.

Answer

A list of all software installed on company laptops.

Answer

A copy of the company's lease agreement.

Question 8

Which TWO of the following scenarios represent 'Data Quality Risk'?

Accepted Answer

Training data is from a 5-year-old dataset that is no longer representative.. Option A is correct because a 5-year-old dataset that is no longer representative introduces staleness and distribution drift, meaning the training data no longer reflects the current population or environment — a classic data quality risk affecting model validity. Option D is correct because inconsistent units (mixing meters and feet) are a data integrity/consistency defect that corrupts feature values and can cause the model to learn incorrect relationships, directly harming data quality. Option B does not belong because slow network deployment is an infrastructure/operational performance concern, not a property of the data itself. Option C does not belong because the programming language used to write the model is an implementation/engineering choice unrelated to data quality. Option E does not belong because using a popular open-source library is a technology/dependency decision, not a data quality issue.

Answer

The model is deployed on a slow network.

Answer

The model is written in a new programming language.

Answer

The model uses a popular open-source library.

Question 9

The board requires a new reporting structure for AI risk. Which TWO of the following should be included in the quarterly AI Risk Report to effectively communicate risk posture?

Accepted Answer

The status of the AI risk control roadmap and effectiveness of implemented mitigations.. Option C is correct because a quarterly AI Risk Report must communicate governance progress, so reporting the status of the AI risk control roadmap and the measured effectiveness of implemented mitigations shows whether planned controls are on track and actually reducing risk. Option E is correct because risk posture is defined by what remains after treatment, so an overview of current AI-related residual risks that exceed the organization's defined risk appetite gives the board the decision-relevant exceptions requiring acceptance, escalation, or further mitigation. Option A is not appropriate because raw training-iteration output is low-level engineering telemetry, not a risk-posture metric, and it does not map to risk appetite or control effectiveness. Option B is not appropriate because daily CPU and memory metrics for inference clusters are operational performance data with no direct bearing on AI risk exposure at a quarterly governance level. Option D is not appropriate because listing all model parameters and weights is an unmanageable technical artifact dump that conveys no meaningful risk or control information to the board.

Answer

The raw output from the model's most recent training iteration.

Answer

The daily CPU and memory metrics for the inference clusters.

Answer

A list of all individual model parameters and weights.

Question 10

When implementing an AI Risk Management program, which THREE components are necessary for effective monitoring?

Accepted Answer

A mechanism for logging and auditing model outputs.. Option B is correct because effective AI risk monitoring requires a mechanism for logging and auditing model outputs, which provides traceability, supports incident investigation, and enables detection of anomalies or policy violations over time. Option D is correct because a process for human intervention or override ensures that when a model behaves unexpectedly or produces harmful outputs, a human can step in to halt, correct, or escalate the issue, which is a core control in AI risk frameworks. Option E is correct because automated real-time monitoring of model performance and drift detects degradation, data drift, and concept drift as they occur, allowing timely remediation before risks materialize. Option A does not belong because requiring all staff to undergo coding training is not a monitoring control and is irrelevant to observing model behavior. Option C does not belong because a daily newsletter about AI advancements is informational only and does not provide any monitoring, logging, or intervention capability.

Answer

A requirement that all staff undergo coding training.

Answer

A daily newsletter for employees about AI advancements.

Question 11

An organization is considering outsourcing its AI development. How should the 'AI Risk Governance' policy be adjusted for third-party vendors?

Accepted Answer

Include mandatory audit rights, model validation requirements, and risk-sharing clauses in the vendor contract.. Third-party risk management must include audit rights and clear accountability for the vendor's models.

Answer

Assume that the vendor's own governance is sufficient.

Answer

Only evaluate the vendor for financial stability.

Answer

Exclude outsourced AI from the internal risk assessment.

Question 12

A team notices that an AI model's performance decreases when the input data contains abbreviations that were not present in the training set. This is a risk associated with which lifecycle stage?

Accepted Answer

Data preprocessing and training design.. Abbreviations absent from the training set are a vocabulary/coverage gap introduced during data collection and feature engineering. Because the model never learned representations for those tokens, it cannot generalize to them at inference — this is a data preprocessing and training design risk (B), not an infrastructure, monitoring, or deployment issue. The root cause is upstream of deployment: the training corpus did not represent the input distribution the model now sees.

Answer

Infrastructure provisioning.

Answer

Monitoring phase.

Answer

Deployment phase.

Question 13

When drafting a vendor management policy for AI, what is the most important clause to include?

Accepted Answer

Right-to-audit the vendor's AI training practices. The most important clause in an AI vendor management policy is the right-to-audit the vendor's AI training practices, as it ensures transparency and accountability for the vendor's data handling, model development, and compliance with ethical standards. This clause allows the organization to verify that the vendor's AI systems meet regulatory and contractual requirements. Without it, the organization has limited visibility into potential risks.

Answer

Requirement for vendor to provide coffee

Answer

Requirement to use a specific font

Answer

Vendor must provide free hardware

Question 14

An organization is using 'AI Model Monitoring' to track 'Concept Drift'. Why is this a risk governance issue?

Accepted Answer

It signals that the model's predictive accuracy is degrading due to changes in the data context.. Concept drift occurs when the statistical properties of the target variable change over time, causing the model's predictions to become less accurate. This is a risk governance issue because degraded model performance can lead to poor business decisions, compliance violations, or harm to stakeholders. Monitoring for concept drift is essential to maintain model reliability and trustworthiness.

Answer

It indicates the model is running out of memory.

Answer

It is not a risk issue; it is a maintenance issue.

Answer

It shows that the model is 'thinking' too slowly.

Question 15

Which THREE roles should have oversight authority in the AI Risk Program?

Accepted Answer

Chief Technology Officer. The Chief Technology Officer (B) is correct because the CTO owns the technology strategy and AI systems architecture, so they must ensure AI risk controls are technically feasible, implemented, and aligned with the organization's engineering standards. The Chief Risk Officer (C) is correct because the CRO leads enterprise risk management, owns the risk framework and reporting to the board, and must ensure AI risks are identified, assessed, and mitigated consistently with other enterprise risks. The Head of Business Unit where AI is used (E) is correct because that leader is accountable for the business outcomes, operational use, and day-to-day risk decisions of the AI system, and must own residual risk within their unit. The company's social media influencer (A) and the office receptionist (D) do not belong because neither role has the governance mandate, decision rights, or accountability for AI risk oversight in the organization.

Answer

The company's social media influencer

Answer

The office receptionist

Question 16

A firm adopts the 'Three Lines of Defense' model for AI. What is the specific responsibility of the 'Third Line' (Internal Audit)?

Accepted Answer

Providing independent assurance on the design and effectiveness of the AI governance framework.. The Third Line of Defense in the Three Lines of Defense model is Internal Audit, which provides independent, objective assurance to the board and senior management on the design and operating effectiveness of the AI governance framework, including risk management and controls. It does not own or operate AI controls; it evaluates them. This independence is what distinguishes it from the First Line (business/IT operations) and Second Line (risk/compliance).

Answer

Approving AI model deployment.

Answer

Developing the AI models.

Answer

Defining the AI risk appetite.

Question 17

A financial institution uses an AI model to approve loans. After deployment, they notice the model is rejecting loan applications from a specific region at a rate 30% higher than historical human benchmarks. What is the most appropriate next step in the risk lifecycle?

Accepted Answer

Conduct a bias investigation by comparing input distribution shifts between training data and current inference requests.. A 30% higher rejection rate for a specific region versus historical human benchmarks is a classic bias/drift signal, so the correct risk-lifecycle step is to investigate by comparing the input distribution at inference time against the training distribution. This determines whether the disparity stems from data drift, a biased feature, or a genuine change in the population, and it produces evidence before any remediation decision. Ignoring, shutting down, or building an override model are premature or inappropriate responses.

Answer

Ignore the shift as it may be a temporary market trend.

Answer

Immediately shut down the system.

Answer

Train a secondary model to override the primary one.

Question 18

You are assessing risk for an AI model that uses 'Transfer Learning'. What is the most critical risk to manage regarding the pre-trained base model?

Accepted Answer

The base model may have been trained on data that contains inherent, unidentifiable biases.. Transfer learning risks include the inheritance of latent biases from the pre-trained weights.

Answer

The base model cannot be used with custom datasets.

Answer

The base model will always run out of memory.

Answer

The base model requires a proprietary operating system.

Question 19

Which metric is useful for measuring the 'Efficiency' of an AI risk program?

Accepted Answer

Time to complete a risk assessment for new models. Time to complete a risk assessment for new models is a direct efficiency metric because it measures the throughput and speed of the risk program's core process — how quickly it can evaluate and onboard AI models. Efficiency metrics compare outputs to inputs (time, cost, effort), and assessment cycle time captures how productively the program converts review effort into completed assessments. Shorter cycle times with consistent quality indicate a more efficient program.

Answer

Number of emails sent

Answer

Total weight of the hardware

Answer

Number of meetings held

Question 20

When reporting AI risk to the board, which approach best demonstrates 'Risk Culture' maturity?

Accepted Answer

Presenting a heatmap showing residual risk levels against the defined enterprise risk appetite.. Presenting a heatmap of residual risk against the enterprise risk appetite demonstrates Risk Culture maturity because it shows the board not just what risks exist, but how they compare to the organization's stated tolerance thresholds. This reflects an integrated, governance-driven approach where risk is quantified, contextualized, and actively managed rather than merely inventoried. Mature risk culture requires translating technical AI risk into business-relevant terms that support informed decision-making at the board level.

Answer

Listing all AI projects currently in production with their budget spend.

Answer

Reporting solely on the number of successful cyber attacks against the AI infrastructure.

Answer

Providing a list of all AI models currently undergoing training.