AAIR AI Risk Governance And Framework Integration Practice Test 2 — 15 Questions

Question 1

Which THREE components must be included in an AI Risk Register to satisfy ISO/IEC 42001 requirements?

Accepted Answer

Identification of relevant stakeholders. ISO/IEC 42001 requires an AI risk register to capture the context and scope of each AI system, so option E (AI system description and intended use) is correct because the register must document what the system does, its purpose, and boundaries to properly frame the associated risks. Option C (identification of relevant stakeholders) is correct because ISO/IEC 42001 emphasizes accountability and interested-party considerations, requiring the register to name the parties affected by or responsible for the AI system. Option D (assessment of AI risk levels with likelihood and impact) is correct because the standard follows a risk-based approach where each identified risk must be evaluated for likelihood and impact to prioritize treatment. Option A (hardware procurement schedules) is not part of the risk register content under ISO/IEC 42001, as procurement logistics are operational records rather than risk documentation. Option B (technical documentation of model architecture) is also not a required register component, since architecture details belong to technical documentation and model cards, not the risk register itself.

Answer

Hardware procurement schedules

Answer

Technical documentation of model architecture

Question 2

A board of directors requests a dashboard view of AI model drift. Which metric is most appropriate for a board-level risk report?

Accepted Answer

Feature drift threshold violations. Feature drift threshold violations are the most appropriate board-level metric because they directly signal when input data distributions have shifted beyond acceptable bounds, which is the leading indicator of model risk. Boards need a governance-level signal of emerging model unreliability, not raw performance numbers. Threshold violations translate technical drift into a risk posture that non-technical directors can act on.

Answer

Mean Squared Error (MSE)

Answer

GPU utilization percentage

Answer

Latency per inference request

Question 3

A financial firm is integrating AI risk into its ERM. The Chief Risk Officer asks for a mapping between the NIST AI Risk Management Framework (RMF) and the existing COSO ERM framework. Which action most effectively facilitates this alignment?

Accepted Answer

Map NIST AI RMF 'Govern' and 'Map' functions to COSO 'Governance and Culture' components.. Mapping the NIST AI RMF 'Govern' and 'Map' functions to COSO's 'Governance and Culture' component is the most effective alignment action because both address oversight, accountability, and risk context. COSO ERM's Governance and Culture component parallels the AI RMF's emphasis on governance structures and risk mapping, enabling the firm to integrate AI risk into existing ERM processes without replacing them. This mapping preserves the firm's investment in COSO while satisfying NIST AI RMF expectations.

Answer

Replace the COSO risk taxonomy with the NIST AI RMF taxonomy entirely.

Answer

Automate all AI model monitoring using only the NIST RMF 'Measure' function.

Answer

Assign AI model owners to report directly to the NIST oversight board.

Question 4

A multinational corporation is establishing an AI Risk Governance Committee. Who should chair this committee to ensure alignment with enterprise-wide risk appetite?

Accepted Answer

The Chief Risk Officer (CRO).. The Chief Risk Officer (CRO) owns the enterprise risk management framework and is the executive accountable for aligning all risk domains — including AI risk — with the organization's stated risk appetite. Chairing the AI Risk Governance Committee ensures AI-specific risks (bias, model drift, regulatory exposure) are evaluated through the same lens as financial, operational, and strategic risks. This preserves a single, coherent risk taxonomy across the enterprise.

Answer

The Chief Technology Officer (CTO).

Answer

The Lead AI Data Scientist.

Answer

The Head of Marketing.

Question 5

During a board-level review, a bank needs to demonstrate the effectiveness of its AI Risk Governance. Which metric should be presented to the board to align with the 'Accountability' principle of the AI RMF?

Accepted Answer

The percentage of AI models with documented, independent model risk management (MRM) validation.. The Accountability principle of the AI RMF requires that organizations define, document, and assign responsibility for AI risk management, and demonstrate that those responsibilities are being fulfilled. The percentage of AI models with documented, independent MRM validation is a direct, quantifiable measure of whether independent oversight and accountability controls are operating effectively. This metric shows the board that model risk is being independently challenged and validated, which is the essence of accountability in AI governance.

Answer

The total computational cost of running the models.

Answer

The number of lines of code written for the AI model.

Answer

The frequency of model retraining cycles.

Question 6

The AI Governance Committee is defining the roles for AI Risk oversight. Which TWO functions are essential for the 'Three Lines of Defense' model in AI Risk?

Accepted Answer

AI development teams performing self-assessments.. In the Three Lines of Defense model, the first line consists of the operational teams that own and manage risk directly, so option A (AI development teams performing self-assessments) is correct because these teams are the ones building and running AI systems and must perform self-assessments as their first-line risk ownership responsibility. The second line provides independent oversight, monitoring, and challenge to the first line, so option E (the AI Risk Management function providing independent oversight) is correct because it is the dedicated risk function that establishes policies, frameworks, and independent review over AI risks. Option B is incorrect because drafting external press releases is a communications activity, not a risk oversight function within the Three Lines of Defense. Option C is incorrect because managing AI infrastructure is an operational/technology responsibility that would sit in the first line, not a distinct defense layer for AI risk oversight. Option D is incorrect because external vendors supplying cloud infrastructure are third parties, not an internal line of defense in the model.

Answer

The AI Ethics Committee drafting external press releases.

Answer

The Chief Information Officer managing all AI infrastructure.

Answer

External vendors providing cloud infrastructure.

Question 7

An organization is integrating AI risk into its existing ISO 31000 framework. How should the 'Risk Assessment' process be modified to account for AI-specific 'black box' issues?

Accepted Answer

Add a model explainability and interpretability assessment step to the process.. Inclusion of model explainability assessments is necessary to address the opacity inherent in deep learning models.

Answer

Remove the risk identification step, as AI risks are too unpredictable.

Answer

Replace the qualitative assessment with a purely quantitative financial impact model.

Answer

Delegate all risk assessments to the external software vendor.

Question 8

When reporting AI risks to the Board of Directors, which THREE elements should be included to ensure informed decision-making?

Accepted Answer

Qualitative overview of ethical AI alignment with company values.. Option C is correct because a qualitative overview of ethical AI alignment with company values gives the Board the governance-level context needed to judge whether AI use is consistent with the organization's stated principles and risk culture. Option D is correct because reporting the current AI risk appetite together with any threshold breaches tells the Board whether actual risk exposure remains within the limits they approved, which is essential for informed oversight and escalation. Option E is correct because a strategic assessment of regulatory compliance and potential legal exposure highlights material obligations, enforcement trends, and liabilities that could affect strategy, reputation, and financial standing. Options A and B are not appropriate for Board-level reporting: a list of developers is an operational staffing detail, and granular technical logs of model inference errors are too low-level and tactical, belonging instead to engineering or model-risk teams rather than the Board.

Answer

List of all developers who worked on the model.

Answer

Granular technical logs of model inference errors.

Question 9

Which document is the primary reference for defining an organization's AI Risk Governance structure?

Accepted Answer

The AI Governance Charter/Policy.. The AI Governance Charter/Policy is the foundational document that defines the organization's AI risk governance structure, including roles, responsibilities, committees, and escalation paths. It is the authoritative reference that establishes how AI risk is owned, reviewed, and controlled across the enterprise. Other documents may reference it but do not define the governance structure itself.

Answer

The IT hardware inventory report.

Answer

The employee handbook.

Answer

The AI project development backlog.

Question 10

A manufacturing firm is adopting a 'Privacy by Design' approach for AI. How does this integrate with the AI Risk Governance framework?

Accepted Answer

Privacy controls are integrated into the MLOps pipeline as automated gates.. Privacy by Design (PbD) is a proactive principle that requires embedding privacy protections into systems from the outset, not as an afterthought. In an AI Risk Governance framework, this translates to operationalizing privacy controls—such as data minimization, consent checks, and anonymization—as automated gates within the MLOps pipeline. This ensures that every model training, evaluation, and deployment step adheres to privacy requirements before progressing, making privacy an integral, continuous part of the AI lifecycle rather than a one-time or post-hoc review.

Answer

Privacy becomes the responsibility of the vendor, not the company.

Answer

Privacy is only reviewed after the model is deployed.

Answer

Privacy impact assessments are excluded to speed up model deployment.

Question 11

Which THREE factors are essential to consider when determining the 'AI Risk Appetite' for an enterprise?

Accepted Answer

The organization's tolerance for legal and reputational damage.. Option B is correct because AI risk appetite must be calibrated to how much legal exposure and reputational harm the organization is willing to absorb, since these are the primary consequence categories of AI failures and directly bound the acceptable risk threshold. Option C is correct because the complexity and degree of autonomy of the deployed AI models determine the severity and likelihood of adverse outcomes, so higher autonomy or opacity requires a more conservative appetite. Option D is correct because the applicable regulatory landscape and sector-specific compliance obligations (for example, EU AI Act risk tiers, HIPAA, or financial-services rules) set non-negotiable limits that the risk appetite cannot exceed. Option A is not essential because market share is a business-performance metric that does not define risk tolerance boundaries. Option E is not essential because historical data volume is an input to model development and data-governance decisions, not a determinant of how much AI risk the enterprise is willing to accept.

Answer

The current market share of the company.

Answer

Historical data volume.

Question 12

In the context of AI model risk management, what is the role of an 'AI Model Inventory' within the governance framework?

Accepted Answer

To track model metadata, risk ratings, and owners for oversight and audit purposes.. An AI Model Inventory is the governance system of record that catalogs every model in production or development, capturing metadata such as purpose, owner, version, risk rating, validation status, and dependencies. Its role is to enable oversight, audit, and regulatory reporting by giving risk and compliance teams a single view of the AI estate. This is why option A is correct.

Answer

To store the actual training data sets for backup.

Answer

To limit the number of AI developers in the company.

Answer

To serve as a marketing catalog for external clients.

Question 13

An organization is using a centralized AI Governance structure. What is the biggest risk of this approach compared to a decentralized one?

Accepted Answer

Operational bottlenecks and delayed AI project timelines.. A centralized AI Governance structure concentrates decision-making, policy approval, and review authority in a single body. While this ensures consistency, it creates a single queue through which all AI projects must pass, producing operational bottlenecks and delayed project timelines. The other options describe risks more associated with decentralized or ungoverned structures.

Answer

Higher infrastructure costs.

Answer

Lack of standardized policy.

Answer

Increased risk of shadow AI.

Question 14

A company is deploying an AI system that interacts with human users. According to the AI RMF, what should be the focus of the 'Map' function in the risk governance process?

Accepted Answer

Identifying stakeholders, intended use, and potential human impacts.. In the NIST AI RMF, the Map function focuses on understanding the context of the AI system: identifying stakeholders, intended use, affected populations, and potential human impacts. It establishes the foundation for risk assessment by framing what the system does, who it affects, and what could go wrong. This contextual mapping is essential before measuring or managing risks.

Answer

Choosing the most efficient algorithm.

Answer

Selecting the cloud service provider.

Answer

Calculating the total budget for the project.

Question 15

Which TWO of the following are considered 'High-Risk' AI use cases that require enhanced oversight by the Governance Committee?

Accepted Answer

AI-powered biometric identification for facility access.. Option B is correct because AI-powered biometric identification for facility access processes sensitive biometric data and controls physical security, making it a high-risk use case that demands enhanced oversight by the Governance Committee. Option C is correct because automated recruitment and hiring filtering tools directly affect individuals' employment opportunities and can introduce bias or discrimination, which places them in the high-risk category requiring stricter governance. Options A and D are not high-risk since basic spell-checking and email auto-complete are low-impact productivity features with minimal risk to rights or safety. Option E is also not high-risk because internal cafeteria menu suggestions have negligible impact on individuals and pose no significant compliance or ethical concerns.

Answer

Basic spell-checking software.

Answer

Email auto-complete features.

Answer

AI systems used for internal cafeteria menu suggestions.