AAIR AI Risk Governance And Framework Integration — 25 Questions

Question 1

You are mapping AI risks to the NIST AI RMF. Which step is essential when documenting the 'Map' function for a high-risk autonomous system?

Accepted Answer

Identifying and documenting the context and intended use. Identifying and documenting the context and intended use is the foundation of mapping AI risks to an enterprise framework.

Answer

Updating the SOC2 Type II report

Answer

Automating the model deployment pipeline

Answer

Conducting a quarterly penetration test

Question 2

A firm is establishing an AI Governance Committee. Which TWO groups should be represented to ensure comprehensive oversight?

Accepted Answer

Data Privacy Office. Legal/Compliance and Data Privacy are essential for addressing the regulatory and ethical risks inherent in AI deployments.

Answer

Public relations

Answer

Hardware vendors

Answer

External marketing agencies

Question 3

A financial institution is integrating AI risk into its ERM framework. Which action most effectively aligns AI risk appetite with enterprise risk appetite?

Accepted Answer

Defining quantitative risk thresholds in the AI governance policy. Defining quantitative risk thresholds in the AI governance policy ensures alignment with the organization's overall risk capacity.

Answer

Purchasing cybersecurity insurance for AI systems

Answer

Assigning AI risk ownership to the IT department

Answer

Implementing a standalone AI audit program

Question 4

You are integrating AI risk into the NIST Risk Management Framework (RMF). Which step requires an explicit evaluation of AI model lineage and data provenance to satisfy the 'Govern' function?

Accepted Answer

Governance mapping during 'Govern' function analysis. The NIST AI RMF 'Govern' function prioritizes understanding the provenance and lineage to establish accountability and transparency.

Answer

Step 2: Select controls

Answer

Step 1: Categorize system

Answer

Continuous Monitoring phase

Question 5

When configuring the Microsoft Purview AI hub for risk management, which setting must be enabled to ensure AI prompt logs are captured for enterprise risk reporting?

Accepted Answer

Configure Microsoft Purview AI activity logging. Microsoft Purview's AI hub requires activity logging to be enabled to audit interactions with generative AI applications.

Answer

Enable Audit (Premium)

Answer

Set up Data Loss Prevention (DLP) policies

Answer

Enable sensitivity labels

Question 6

During a board meeting, the Chief Risk Officer needs to present AI model performance trends. Which metric is most critical for board-level reporting?

Accepted Answer

Frequency and severity of model drift incidents. The frequency and severity of model drift incidents are direct indicators of operational and reputational risk, which are board-level concerns.

Answer

Data scientists' training hours per quarter

Answer

Computational resource utilization percentage

Answer

Model latency in milliseconds

Question 7

When integrating AI risk into existing ERM, which THREE aspects of an AI model lifecycle must be audited to ensure compliance?

Accepted Answer

Model validation results. Data lineage, model validation results, and incident response logs are critical audit points for enterprise risk accountability.

Answer

Personnel physical security badges

Answer

Office climate control settings

Question 8

Which TWO of the following governance actions should a Chief Risk Officer (CRO) implement to align AI risk with the COSO Enterprise Risk Management (ERM) framework?

Accepted Answer

Establish a cross-functional AI Risk Committee. COSO ERM requires integrating risk into strategy and performance. Governance structures and risk appetite alignment are key.

Answer

Assign AI risk ownership to individual data scientists

Answer

Disable all open-source AI libraries

Answer

Mandate daily model training cycles

Question 9

Which THREE components must be included in an AI Risk Register to satisfy ISO/IEC 42001 requirements?

Accepted Answer

Identification of relevant stakeholders. ISO 42001 requires systematic risk identification, analysis, and treatment planning.

Answer

Hardware procurement schedules

Answer

Technical documentation of model architecture

Question 10

A board of directors requests a dashboard view of AI model drift. Which metric is most appropriate for a board-level risk report?

Accepted Answer

Feature drift threshold violations. The board requires high-level risk indicators rather than granular performance metrics like F1 scores.

Answer

Mean Squared Error (MSE)

Answer

GPU utilization percentage

Answer

Latency per inference request

Question 11

A financial firm is integrating AI risk into its ERM. The Chief Risk Officer asks for a mapping between the NIST AI Risk Management Framework (RMF) and the existing COSO ERM framework. Which action most effectively facilitates this alignment?

Accepted Answer

Map NIST AI RMF 'Govern' and 'Map' functions to COSO 'Governance and Culture' components.. Mapping functions like 'Govern' and 'Map' in NIST AI RMF directly correlate to COSO's 'Governance and Culture' and 'Strategy and Objective-Setting' components.

Answer

Replace the COSO risk taxonomy with the NIST AI RMF taxonomy entirely.

Answer

Automate all AI model monitoring using only the NIST RMF 'Measure' function.

Answer

Assign AI model owners to report directly to the NIST oversight board.

Question 12

A multinational corporation is establishing an AI Risk Governance Committee. Who should chair this committee to ensure alignment with enterprise-wide risk appetite?

Accepted Answer

The Chief Risk Officer (CRO).. The Chief Risk Officer (CRO) or equivalent enterprise risk lead ensures AI risk is treated as a component of overall enterprise risk.

Answer

The Chief Technology Officer (CTO).

Answer

The Lead AI Data Scientist.

Answer

The Head of Marketing.

Question 13

During a board-level review, a bank needs to demonstrate the effectiveness of its AI Risk Governance. Which metric should be presented to the board to align with the 'Accountability' principle of the AI RMF?

Accepted Answer

The percentage of AI models with documented, independent model risk management (MRM) validation.. Board oversight requires metrics on accountability, such as the auditability of model decision-making trails.

Answer

The total computational cost of running the models.

Answer

The number of lines of code written for the AI model.

Answer

The frequency of model retraining cycles.

Question 14

The AI Governance Committee is defining the roles for AI Risk oversight. Which TWO functions are essential for the 'Three Lines of Defense' model in AI Risk?

Accepted Answer

AI development teams performing self-assessments.. The 1st line (Model Owners) and 2nd line (Risk/Compliance) are critical for effective AI risk management.

Answer

The AI Ethics Committee drafting external press releases.

Answer

The Chief Information Officer managing all AI infrastructure.

Answer

External vendors providing cloud infrastructure.

Question 15

A retail company uses an AI model for dynamic pricing. The model's risk score recently exceeded the 'Moderate' threshold. As per the AI Governance framework, what is the mandatory next step?

Accepted Answer

Perform an mandatory AI model risk assessment and escalate to the Governance Committee.. When an AI risk score crosses a predefined threshold, escalation to the risk committee or manual oversight is required.

Answer

Automatically disable the model.

Answer

Continue operation while monitoring for additional errors.

Answer

Update the training data set to improve the score.

Question 16

An organization is integrating AI risk into its existing ISO 31000 framework. How should the 'Risk Assessment' process be modified to account for AI-specific 'black box' issues?

Accepted Answer

Add a model explainability and interpretability assessment step to the process.. Inclusion of model explainability assessments is necessary to address the opacity inherent in deep learning models.

Answer

Remove the risk identification step, as AI risks are too unpredictable.

Answer

Replace the qualitative assessment with a purely quantitative financial impact model.

Answer

Delegate all risk assessments to the external software vendor.

Question 17

When reporting AI risks to the Board of Directors, which THREE elements should be included to ensure informed decision-making?

Accepted Answer

Qualitative overview of ethical AI alignment with company values.. Board-level reports must focus on strategic impact, compliance posture, and high-level risk exposure.

Answer

List of all developers who worked on the model.

Answer

Granular technical logs of model inference errors.

Question 18

Which document is the primary reference for defining an organization's AI Risk Governance structure?

Accepted Answer

The AI Governance Charter/Policy.. The AI Governance Policy or Charter establishes the roles, responsibilities, and decision-making authorities for AI risk.

Answer

The IT hardware inventory report.

Answer

The employee handbook.

Answer

The AI project development backlog.

Question 19

A manufacturing firm is adopting a 'Privacy by Design' approach for AI. How does this integrate with the AI Risk Governance framework?

Accepted Answer

Privacy controls are integrated into the MLOps pipeline as automated gates.. Integrating privacy controls into the development lifecycle (DevOps/MLOps) is a key requirement of modern AI governance frameworks.

Answer

Privacy becomes the responsibility of the vendor, not the company.

Answer

Privacy is only reviewed after the model is deployed.

Answer

Privacy impact assessments are excluded to speed up model deployment.

Question 20

Which THREE factors are essential to consider when determining the 'AI Risk Appetite' for an enterprise?

Accepted Answer

The organization's tolerance for legal and reputational damage.. Risk appetite must consider the organization's business strategy, regulatory environment, and technical capability.

Answer

The current market share of the company.

Answer

Historical data volume.