AAIR AI Risk Governance And Framework Integration Practice Test 3 — 15 Questions

Question 1

An organization is revising its AI Governance to include 'Human-in-the-loop' (HITL) requirements. Why is this a critical risk mitigation strategy?

Accepted Answer

It ensures human oversight for critical decisions, reducing the risk of 'black box' failures.. Human-in-the-loop (HITL) is a critical risk mitigation because it places a human reviewer in the decision path for consequential AI outputs, providing a check against opaque 'black box' failures, edge cases, and harmful errors that automated controls may miss. It preserves meaningful human judgment and accountability where the cost of an AI mistake is high. It does not replace other controls or eliminate testing obligations.

Answer

It removes the requirement for model bias testing.

Answer

It is required for every AI model regardless of impact.

Answer

It eliminates the need for any other automated risk controls.

Question 2

When integrating AI risk into the corporate GRC (Governance, Risk, and Compliance) platform, what is the best practice for handling 'AI Model Drift' alerts?

Accepted Answer

Integrate drift alerts as risk indicators in the GRC platform for automated tracking.. Best practice is to integrate model drift alerts directly into the GRC platform as risk indicators, so they are tracked, scored, and routed through the same governance workflows as other enterprise risks. This enables automated tracking, trend analysis, and timely escalation. The other options either misroute alerts, ignore them, or suppress them, all of which defeat the purpose of drift monitoring.

Answer

Send all alerts to the help desk.

Answer

Ignore drift alerts until a manual audit happens annually.

Answer

Disable the alerts to prevent 'alert fatigue'.

Question 3

Which THREE components must be included in an AI Model 'Control Framework' to ensure effective risk mitigation?

Accepted Answer

Access management controls restricting model usage.. Option B (Access management controls restricting model usage) is correct because enforcing authentication, authorization, and least-privilege access to AI models prevents unauthorized use, tampering, or data exfiltration, which are core risk-mitigation controls in any AI control framework. Option D (Manual approval gates for model deployment) is correct because human-in-the-loop approval before promoting a model to production ensures that risk, compliance, and performance checks are satisfied before the model can affect real users or systems. Option E (Automated version control for model training code) is correct because tracking code, data, and configuration changes with automated version control provides reproducibility, auditability, and rollback capability, which are essential for detecting and remediating model-related risks. Option A (Hardware power usage tracking) is not a required control-framework component for risk mitigation, as it addresses cost or sustainability monitoring rather than AI risk governance. Option C (Public disclosure of all model architecture details) is not required and would often increase risk by exposing intellectual property and attack surface, so it does not belong in a risk-mitigation control framework.

Answer

Hardware power usage tracking.

Answer

Public disclosure of all model architecture details.

Question 4

A bank's AI Governance policy requires a 'bias test' for all customer-facing models. What is the most important element to document in the audit trail?

Accepted Answer

The test methodology, criteria for success, and the specific mitigation steps taken.. For an AI bias test audit trail, the defensible record must show how the test was conducted, what threshold defined pass/fail, and what was done when bias was detected — this is what regulators and auditors need to reconstruct the decision. Documenting methodology, success criteria, and mitigation steps demonstrates due diligence and reproducibility, which is the core purpose of an audit trail. Operational trivia like hours, salaries, or tool names does not establish that the model was actually tested for fairness.

Answer

The number of hours the test took to run.

Answer

The salary of the testers.

Answer

The name of the software used for the test.

Question 5

An organization discovers that an AI model has learned a bias from training data. Per the AI Risk framework, what should be the immediate priority of the Governance function?

Accepted Answer

Suspend the model's usage and conduct a formal root cause analysis.. When bias is discovered in a model, the Governance function's immediate priority is to suspend the model's usage to prevent ongoing harm and then conduct a formal root cause analysis to determine how the bias entered and how to remediate it. This aligns with the AI risk framework's emphasis on containment before correction, protecting affected stakeholders and preserving evidence. Waiting or retraining on the same data would perpetuate the harm.

Answer

Wait for the quarterly board report to inform the board.

Answer

Fire the AI development team.

Answer

Retrain the model on the same data set to see if it fixes itself.

Question 6

Why is 'AI Literacy' for the board of directors a key component of AI Governance?

Accepted Answer

To enable effective decision-making regarding AI adoption and risk management.. Directors must understand AI risks and benefits to provide informed oversight and define the organization's risk appetite.

Answer

To allow directors to code their own AI models.

Answer

To replace the need for the Chief Risk Officer.

Answer

To reduce the cost of IT infrastructure.

Question 7

When designing an AI Risk Reporting dashboard for senior management, which TWO of the following should be visualized?

Accepted Answer

Status of compliance certifications for high-risk models.. Option C is correct because senior management needs visibility into the governance posture of high-risk AI models, and tracking the status of compliance certifications (e.g., ISO/IEC 42001, SOC 2, or EU AI Act conformity assessments) directly supports regulatory oversight and accountability. Option D is correct because an aggregate risk score per business unit condenses model-level risk metrics into a decision-ready KPI that lets executives compare exposure, prioritize mitigation funding, and track risk appetite across the organization. Option A is not appropriate because server uptime is an infrastructure/availability metric that belongs in IT operations dashboards, not an AI risk reporting view for executives. Option B is not appropriate because raw per-transaction prediction scores are far too granular and technical for senior management, and would create noise rather than actionable risk insight. Option E is not appropriate because employee training attendance is a tactical HR/compliance activity metric, not a strategic AI risk indicator for the board or executive committee.

Answer

Server uptime percentages.

Answer

Raw model prediction scores for every transaction.

Answer

Employee training attendance logs.

Question 8

Which THREE items should be included in an AI 'Risk Assessment' report for a new project?

Accepted Answer

Identification of potential failure modes and their impact.. A complete report covers the risk identification, the impact analysis, and the control strategy.

Answer

The favorite color of the lead developer.

Answer

A list of all competitors currently using the same software.

Question 9

A firm adopts the 'Three Lines of Defense' model for AI. What is the specific responsibility of the 'Third Line' (Internal Audit)?

Accepted Answer

Providing independent assurance on the design and effectiveness of the AI governance framework.. The Third Line of Defense in the Three Lines of Defense model is Internal Audit, which provides independent, objective assurance to the board and senior management on the design and operating effectiveness of the AI governance framework, including risk management and controls. It does not own or operate AI controls; it evaluates them. This independence is what distinguishes it from the First Line (business/IT operations) and Second Line (risk/compliance).

Answer

Approving AI model deployment.

Answer

Developing the AI models.

Answer

Defining the AI risk appetite.

Question 10

An organization is considering outsourcing its AI development. How should the 'AI Risk Governance' policy be adjusted for third-party vendors?

Accepted Answer

Include mandatory audit rights, model validation requirements, and risk-sharing clauses in the vendor contract.. Third-party risk management must include audit rights and clear accountability for the vendor's models.

Answer

Assume that the vendor's own governance is sufficient.

Answer

Only evaluate the vendor for financial stability.

Answer

Exclude outsourced AI from the internal risk assessment.

Question 11

An organization is evaluating 'Model Risk Management' (MRM) tools for its AI governance. What is the most critical feature to look for to ensure compliance with external regulatory requirements?

Accepted Answer

Comprehensive audit trails of model lineage, versions, and validation results.. External regulators require demonstrable traceability: who built the model, what data it used, which version is in production, and what validation it passed. Comprehensive audit trails of model lineage, versions, and validation results (B) provide exactly this evidence and are the cornerstone of MRM compliance. The other options are cosmetic or irrelevant to regulatory requirements.

Answer

Automatic social media integration.

Answer

The ability to run models on mobile devices.

Answer

The ability to add custom skins to the UI.

Question 12

In the context of the AI RMF, what is the significance of the 'Measure' function for risk management?

Accepted Answer

To evaluate the model's performance and risk outcomes against established benchmarks.. The Measure function of the AI RMF is responsible for evaluating AI systems' performance, trustworthiness characteristics, and risk outcomes against defined benchmarks and metrics. It provides the quantitative and qualitative evidence needed to determine whether risks are within tolerance and whether the system meets its intended purpose. This function operationalizes the risk assessment by turning identified risks into measurable indicators.

Answer

To identify which employees have access to the AI system.

Answer

To set the budget for future AI projects.

Answer

To provide a score for the developers' performance.

Question 13

What is the primary role of the AI 'Data Steward' within the AI Governance framework?

Accepted Answer

To oversee the lifecycle of the data, ensuring its quality and compliance.. The AI Data Steward owns the data lifecycle within the AI governance framework — ensuring datasets are accurate, complete, appropriately sourced, and compliant with privacy and licensing requirements throughout collection, use, retention, and disposal. This role is the data-side counterpart to model governance, ensuring that what feeds the model is trustworthy and lawful. Budget, architecture, and marketing responsibilities belong to entirely different roles.

Answer

To manage the budget for AI hardware.

Answer

To build the model architecture.

Answer

To handle marketing and customer relations.

Question 14

Which document defines the 'AI Risk Appetite' for an organization?

Accepted Answer

The AI Risk Appetite Statement.. The AI Risk Appetite Statement is the document approved by the Board that defines the risk tolerance for AI activities.

Answer

The Employee Training Manual.

Answer

The IT Service Catalog.

Answer

The AI Project Status Report.

Question 15

What is the key purpose of the 'Govern' function in the NIST AI RMF?

Accepted Answer

To establish the organizational culture, policy, and procedures for AI risk management.. The Govern function in the NIST AI RMF (AI Risk Management Framework 1.0) is one of the four core functions (Govern, Map, Measure, Manage) and is explicitly cross-cutting. Its purpose is to cultivate and implement a culture of risk management via policies, processes, procedures, roles, responsibilities, and accountability structures across the AI lifecycle. It is not a technical execution function — it establishes the organizational scaffolding that enables the other three functions to operate.

Answer

To troubleshoot hardware issues.

Answer

To define the marketing strategy for the AI products.

Answer

To code the AI algorithms.