AAIR AI Risk Governance And Framework Integration — 30 Questions

Question 1

You are integrating AI risk into the NIST Risk Management Framework (RMF). Which step requires an explicit evaluation of AI model lineage and data provenance to satisfy the 'Govern' function?

Accepted Answer

Governance mapping during 'Govern' function analysis. The NIST AI RMF 'Govern' function is a cross-cutting function that establishes policies, roles, and accountability for AI risk, and it explicitly calls for documenting model lineage and data provenance as part of governance. Governance mapping during the 'Govern' function analysis is where lineage and provenance are evaluated to satisfy governance requirements. The RMF steps (Categorize, Select, Implement, Assess, Authorize, Monitor) are from the NIST RMF SP 800-37, not the AI RMF, and they do not specifically require AI lineage evaluation.

Answer

Step 2: Select controls

Answer

Step 1: Categorize system

Answer

Continuous Monitoring phase

Question 2

When configuring the Microsoft Purview AI hub for risk management, which setting must be enabled to ensure AI prompt logs are captured for enterprise risk reporting?

Accepted Answer

Configure Microsoft Purview AI activity logging. Microsoft Purview AI hub relies on AI activity logging to capture prompt and response data from AI applications like Copilot and third-party LLMs. This setting, when enabled, ingests interaction logs into Purview for risk reporting, auditing, and compliance. Without it, no prompt logs are available for enterprise risk analysis, regardless of other Purview configurations. Thus, configuring Microsoft Purview AI activity logging is the required step.

Answer

Enable Audit (Premium)

Answer

Set up Data Loss Prevention (DLP) policies

Answer

Enable sensitivity labels

Question 3

A retail company uses an AI model for dynamic pricing. The model's risk score recently exceeded the 'Moderate' threshold. As per the AI Governance framework, what is the mandatory next step?

Accepted Answer

Perform an mandatory AI model risk assessment and escalate to the Governance Committee.. When a model's risk score crosses from 'Low' into 'Moderate' (or higher), the AI Governance framework requires a formal risk assessment and escalation to the Governance Committee so that appropriate controls, oversight, and remediation can be authorized. This is a governance-mandated response, not an automated technical action. Disabling the model, continuing without action, or unilaterally retraining all bypass the required governance process.

Answer

Automatically disable the model.

Answer

Continue operation while monitoring for additional errors.

Answer

Update the training data set to improve the score.

Question 4

What is the primary objective of a 'post-implementation review' in the AI Risk Governance lifecycle?

Accepted Answer

To verify that the model continues to operate within established risk thresholds.. A post-implementation review (PIR) in the AI Risk Governance lifecycle is a structured checkpoint that occurs after a model is deployed into production. Its core purpose is to confirm that the model's actual runtime behavior — including its risk metrics, drift indicators, and control effectiveness — remains within the risk thresholds and tolerances defined during the pre-deployment risk assessment. This validates that the governance controls designed earlier are functioning as intended in the live environment.

Answer

To decommission the model permanently.

Answer

To ensure the developers received their bonuses.

Answer

To increase the model's complexity for better performance.

Answer

To ensure the developers received their bonuses.

Answer

To decommission the model permanently.

Question 5

A firm is using a 'Red Teaming' exercise for its AI model. How does this fit into the AI Risk Governance framework?

Accepted Answer

It serves as a validation technique to identify vulnerabilities and edge-case risks.. Red teaming is a structured adversarial testing technique used to uncover vulnerabilities, biases, and edge-case failures in AI models before deployment. Within an AI Risk Governance framework, it functions as a validation control that provides empirical evidence of model robustness and safety, complementing other governance activities like risk assessment, documentation, and monitoring. It is not a standalone requirement but a critical component of the broader risk management process.

Answer

It is the only requirement for model governance.

Answer

It is a marketing exercise to show off model robustness.

Answer

It should be performed by the same team that developed the model.

Answer

It is the only requirement for model governance.

Question 6

You are configuring the NIST AI Risk Management Framework (AI RMF) 'Govern' function for a high-risk autonomous system. Which activity specifically fulfills the 'Govern' function's requirement for establishing accountability?

Accepted Answer

Formalizing the AI System Model Owner role with defined risk acceptance and oversight accountabilities.. The NIST AI RMF 'Govern' function (GV) establishes the policies, roles, and accountability structures for AI risk management. Formalizing the AI System Model Owner role with defined risk acceptance and oversight accountabilities directly fulfills GV 1.2 (accountability structures) and GV 1.4 (documented roles). The other options are Map, Measure, or Manage function activities, not Govern.

Answer

Performing a red-teaming exercise on the model inputs.

Answer

Configuring automated PII scrubbing in the data pipeline.

Answer

Reviewing the training dataset for bias using statistical sampling.

Question 7

Which governance mechanism is most effective for ensuring that AI ethical risks are addressed during the 'Design' phase of the AI Lifecycle?

Accepted Answer

Conducting a formal 'Ethics by Design' review as part of the AI project's stage-gate approval process.. 'Ethics by Design' is a proactive governance approach that integrates ethical considerations into the earliest stages of AI development, specifically the Design phase. Embedding this review within the stage-gate approval process ensures that ethical risks are formally assessed and mitigated before the project progresses, aligning with governance frameworks that emphasize early intervention. This mechanism directly addresses the requirement to ensure ethical risks are addressed during design, rather than relying on after-the-fact detection or legal review.

Answer

Scanning the source code for hardcoded credentials.

Answer

multi_select

Answer

Requiring a legal sign-off on the final model deployment.

Answer

multi_select

Answer

Reviewing the production logs for anomalies.

Question 8

The organization is updating its 'AI Risk Management Policy'. Which THREE components are essential to ensure it aligns with the 'Manage' function of the NIST AI RMF?

Accepted Answer

A defined mechanism for reporting and remediating non-compliant AI systems.. The NIST AI RMF 'Manage' function focuses on allocating resources to identified risks, treating them, and monitoring residual risk, so option B is correct because a defined mechanism for reporting and remediating non-compliant AI systems operationalizes risk treatment and response. Option D is correct because risk-based prioritization using impact and likelihood is central to the Manage function's requirement to prioritize and allocate resources to the most significant AI risks. Option E is correct because documenting model performance monitoring and recalibration cycles supports ongoing risk management, tracking, and the continuous improvement expected under Manage. Option A is incorrect because marketing budget planning is a business/commercial activity unrelated to AI risk treatment under the RMF. Option C is incorrect because a list of source-code repository users is an access-control artifact, not a Manage-function component for treating and monitoring AI risks.

Answer

The marketing budget for upcoming AI product launches.

Answer

A list of all employees who have access to the source code repository.

Question 9

When assessing the organizational readiness for AI risk governance, which TWO areas must be evaluated to ensure the framework is sustainable?

Accepted Answer

The availability of cross-functional expertise (e.g., legal, compliance, ethics) within the AI governance body.. Sustainable governance requires both the human element (culture/skills) and the procedural element (integration into existing systems).

Answer

The speed of the network bandwidth between training sites.

Answer

The capability of the internal audit team to audit AI models.

Answer

The total number of GPUs available in the data center.

Question 10

You are mapping AI risks to the NIST AI RMF. Which step is essential when documenting the 'Map' function for a high-risk autonomous system?

Accepted Answer

Identifying and documenting the context and intended use. Identifying and documenting the context and intended use is the foundation of mapping AI risks to an enterprise framework.

Answer

Updating the SOC2 Type II report

Answer

Automating the model deployment pipeline

Answer

Conducting a quarterly penetration test

Question 11

A firm is establishing an AI Governance Committee. Which TWO groups should be represented to ensure comprehensive oversight?

Accepted Answer

Data Privacy Office. Legal/Compliance and Data Privacy are essential for addressing the regulatory and ethical risks inherent in AI deployments.

Answer

Public relations

Answer

Hardware vendors

Answer

External marketing agencies

Question 12

A financial institution is integrating AI risk into its ERM framework. Which action most effectively aligns AI risk appetite with enterprise risk appetite?

Accepted Answer

Defining quantitative risk thresholds in the AI governance policy. Defining quantitative risk thresholds in the AI governance policy is correct because it translates the enterprise's stated risk appetite into measurable, enforceable limits that AI initiatives must respect. Risk appetite only becomes operational when expressed as concrete metrics (e.g., maximum acceptable bias score, error rate, or financial exposure), allowing AI risk to be aggregated and compared alongside other enterprise risks in the ERM framework. This creates direct traceability between board-level tolerance and day-to-day AI decisions.

Answer

Purchasing cybersecurity insurance for AI systems

Answer

Assigning AI risk ownership to the IT department

Answer

Implementing a standalone AI audit program

Question 13

During a board meeting, the Chief Risk Officer needs to present AI model performance trends. Which metric is most critical for board-level reporting?

Accepted Answer

Frequency and severity of model drift incidents. Model drift directly affects model reliability, business outcomes, and risk exposure — it signals that a deployed model's predictions may no longer be valid, which is a material risk the board must understand. Frequency and severity of drift incidents quantify both how often models degrade and how impactful those degradations are, making it the most decision-relevant metric for board-level risk reporting.

Answer

Data scientists' training hours per quarter

Answer

Computational resource utilization percentage

Answer

Model latency in milliseconds

Question 14

When integrating AI risk into existing ERM, which THREE aspects of an AI model lifecycle must be audited to ensure compliance?

Accepted Answer

Model validation results. Model validation results (C) must be audited because they document whether the AI model meets its stated performance, fairness, and robustness criteria before and after deployment, which is a core control for AI risk within ERM. Incident response logs (D) are essential because they provide evidence that AI-related failures, bias events, or security incidents were detected, escalated, and remediated according to the organization's risk response procedures. Data lineage and provenance (E) must be audited to verify that training, validation, and production data sources are authorized, traceable, and compliant with privacy and quality requirements, which directly affects model reliability and regulatory compliance. Personnel physical security badges (A) and office climate control settings (B) are facility and environmental controls unrelated to the AI model lifecycle, so they do not belong in an audit of AI risk integration into ERM.

Answer

Personnel physical security badges

Answer

Office climate control settings

Question 15

Which TWO of the following governance actions should a Chief Risk Officer (CRO) implement to align AI risk with the COSO Enterprise Risk Management (ERM) framework?

Accepted Answer

Establish a cross-functional AI Risk Committee. Option A is correct because the COSO ERM framework emphasizes governance and operating structures, and a cross-functional AI Risk Committee establishes the oversight body needed to integrate AI risk across the enterprise and align it with strategic objectives. Option E is correct because COSO ERM requires defining risk appetite and tolerance, so AI-specific risk appetite statements embedded in the ERM policy ensure AI risks are governed within the organization's overall risk posture. Option B is incorrect because assigning AI risk ownership solely to individual data scientists fragments accountability and ignores COSO's principle of enterprise-level ownership and oversight. Option C is incorrect because disabling all open-source AI libraries is a blunt technical control, not a governance action, and would impede innovation without addressing risk alignment. Option D is incorrect because mandating daily model training cycles is an operational/technical decision unrelated to COSO ERM governance alignment.

Answer

Assign AI risk ownership to individual data scientists

Answer

Disable all open-source AI libraries

Answer

Mandate daily model training cycles

Question 16

Which THREE components must be included in an AI Risk Register to satisfy ISO/IEC 42001 requirements?

Accepted Answer

Identification of relevant stakeholders. ISO/IEC 42001 requires an AI risk register to capture the context and scope of each AI system, so option E (AI system description and intended use) is correct because the register must document what the system does, its purpose, and boundaries to properly frame the associated risks. Option C (identification of relevant stakeholders) is correct because ISO/IEC 42001 emphasizes accountability and interested-party considerations, requiring the register to name the parties affected by or responsible for the AI system. Option D (assessment of AI risk levels with likelihood and impact) is correct because the standard follows a risk-based approach where each identified risk must be evaluated for likelihood and impact to prioritize treatment. Option A (hardware procurement schedules) is not part of the risk register content under ISO/IEC 42001, as procurement logistics are operational records rather than risk documentation. Option B (technical documentation of model architecture) is also not a required register component, since architecture details belong to technical documentation and model cards, not the risk register itself.

Answer

Hardware procurement schedules

Answer

Technical documentation of model architecture

Question 17

A board of directors requests a dashboard view of AI model drift. Which metric is most appropriate for a board-level risk report?

Accepted Answer

Feature drift threshold violations. Feature drift threshold violations are the most appropriate board-level metric because they directly signal when input data distributions have shifted beyond acceptable bounds, which is the leading indicator of model risk. Boards need a governance-level signal of emerging model unreliability, not raw performance numbers. Threshold violations translate technical drift into a risk posture that non-technical directors can act on.

Answer

Mean Squared Error (MSE)

Answer

GPU utilization percentage

Answer

Latency per inference request

Question 18

A financial firm is integrating AI risk into its ERM. The Chief Risk Officer asks for a mapping between the NIST AI Risk Management Framework (RMF) and the existing COSO ERM framework. Which action most effectively facilitates this alignment?

Accepted Answer

Map NIST AI RMF 'Govern' and 'Map' functions to COSO 'Governance and Culture' components.. Mapping the NIST AI RMF 'Govern' and 'Map' functions to COSO's 'Governance and Culture' component is the most effective alignment action because both address oversight, accountability, and risk context. COSO ERM's Governance and Culture component parallels the AI RMF's emphasis on governance structures and risk mapping, enabling the firm to integrate AI risk into existing ERM processes without replacing them. This mapping preserves the firm's investment in COSO while satisfying NIST AI RMF expectations.

Answer

Replace the COSO risk taxonomy with the NIST AI RMF taxonomy entirely.

Answer

Automate all AI model monitoring using only the NIST RMF 'Measure' function.

Answer

Assign AI model owners to report directly to the NIST oversight board.

Question 19

A multinational corporation is establishing an AI Risk Governance Committee. Who should chair this committee to ensure alignment with enterprise-wide risk appetite?

Accepted Answer

The Chief Risk Officer (CRO).. The Chief Risk Officer (CRO) owns the enterprise risk management framework and is the executive accountable for aligning all risk domains — including AI risk — with the organization's stated risk appetite. Chairing the AI Risk Governance Committee ensures AI-specific risks (bias, model drift, regulatory exposure) are evaluated through the same lens as financial, operational, and strategic risks. This preserves a single, coherent risk taxonomy across the enterprise.

Answer

The Chief Technology Officer (CTO).

Answer

The Lead AI Data Scientist.

Answer

The Head of Marketing.

Question 20

During a board-level review, a bank needs to demonstrate the effectiveness of its AI Risk Governance. Which metric should be presented to the board to align with the 'Accountability' principle of the AI RMF?

Accepted Answer

The percentage of AI models with documented, independent model risk management (MRM) validation.. The Accountability principle of the AI RMF requires that organizations define, document, and assign responsibility for AI risk management, and demonstrate that those responsibilities are being fulfilled. The percentage of AI models with documented, independent MRM validation is a direct, quantifiable measure of whether independent oversight and accountability controls are operating effectively. This metric shows the board that model risk is being independently challenged and validated, which is the essence of accountability in AI governance.

Answer

The total computational cost of running the models.

Answer

The number of lines of code written for the AI model.

Answer

The frequency of model retraining cycles.