AAIR AI Risk Governance And Framework Integration Practice Test 4 — 15 Questions

Question 1

What is the primary benefit of documenting 'AI Model Lineage'?

Accepted Answer

It provides transparency, auditability, and the ability to reproduce models.. Documenting AI Model Lineage provides transparency, auditability, and reproducibility by capturing the full chain of data sources, transformations, hyperparameters, code versions, and dependencies used to produce a model. This record allows auditors and regulators to trace how a model was built, verify compliance with policies, and reproduce or re-validate the model when needed. It is a foundational governance artifact rather than a performance optimization.

Answer

It ensures the model is smaller in file size.

Answer

It helps the marketing team write better ads.

Answer

It makes the model run faster.

Question 2

When an AI model is updated (e.g., retrained on new data), what action is required from an AI Risk Governance perspective?

Accepted Answer

The model should be re-validated to ensure it still meets risk thresholds.. Retraining a model on new data changes its behavior, so from a risk governance perspective it must be re-validated against the same risk thresholds (accuracy, fairness, robustness, compliance) before being trusted in production. Renaming or assuming no action is needed ignores the fact that the model's outputs and risk profile may have changed. Automatic deployment without review bypasses required oversight.

Answer

The model should be renamed to show it is a new version.

Answer

No action is needed as the underlying architecture is unchanged.

Answer

The model should be automatically deployed without review.

Question 3

Which THREE items are necessary for a comprehensive 'AI Governance Policy'?

Accepted Answer

Standard Operating Procedures (SOPs) for model lifecycle management.. Option A is correct because a comprehensive AI Governance Policy must include Standard Operating Procedures (SOPs) that define the repeatable processes for model lifecycle management, covering stages such as data collection, training, validation, deployment, monitoring, and retirement, which ensures consistency and accountability. Option D is correct because an AI risk classification framework (e.g., Low, Medium, High) is essential for tiering AI systems by potential impact, so that controls, review rigor, and approval levels are proportionate to the risk each system presents. Option E is correct because clearly defining roles and responsibilities for AI risk oversight establishes ownership and accountability — for example, who approves models, who monitors drift, and who handles incidents — which is a foundational element of any governance policy. Option B is not appropriate because listing every single line of code is an impractical and unnecessary level of detail for a governance policy; governance addresses principles, controls, and processes rather than source code inventories. Option C is not appropriate because collecting developers' personal home addresses is irrelevant to AI governance and would raise serious privacy and data protection concerns.

Answer

A list of every single line of code in the production models.

Answer

The personal home addresses of all developers.

Question 4

When building an AI Governance framework, which TWO of the following are essential for ensuring enterprise adoption?

Accepted Answer

Integration with existing GRC and software delivery workflows.. Option B is correct because embedding AI governance controls directly into existing GRC platforms and CI/CD software delivery workflows (e.g., policy gates, automated evidence capture, approval steps) makes compliance a native part of how teams already work, which dramatically lowers friction and drives enterprise adoption. Option C is correct because a clear, collaborative engagement model between risk teams and developers—such as shared review boards, defined RACI, and joint risk-assessment sessions—removes the us-versus-them dynamic and ensures governance requirements are practical and understood, which is essential for sustained adoption. The remaining options do not belong: A is wrong because mandatory 40-hour weekly training is excessive and impractical, creating resistance rather than adoption; D is wrong because manual, spreadsheet-based tracking does not scale, is error-prone, and cannot integrate with enterprise workflows; and E is wrong because requiring all developers to be lawyers is neither feasible nor necessary for effective AI governance.

Answer

Providing mandatory 40-hour weekly training sessions.

Answer

Using only manual, spreadsheet-based tracking.

Answer

Requiring all developers to be lawyers.

Question 5

Which department is primarily responsible for ensuring AI models comply with data protection regulations like GDPR?

Accepted Answer

The Compliance/Legal Department and the Data Protection Officer.. GDPR compliance for AI models requires legal interpretation of lawful basis, data subject rights, DPIA obligations, and cross-border transfer rules, which sit with the Compliance/Legal Department and the Data Protection Officer. The DPO is specifically mandated under GDPR Articles 37-39 to monitor compliance, advise on DPIAs, and act as the contact point with supervisory authorities. Engineering, sales, and finance teams may implement or consume the model, but they do not own the regulatory interpretation.

Answer

The Sales force.

Answer

The Accounting Department.

Answer

The Janitorial staff.

Question 6

An organization is using 'AI Model Monitoring' to track 'Concept Drift'. Why is this a risk governance issue?

Accepted Answer

It signals that the model's predictive accuracy is degrading due to changes in the data context.. Concept drift occurs when the statistical properties of the target variable change over time, causing the model's predictions to become less accurate. This is a risk governance issue because degraded model performance can lead to poor business decisions, compliance violations, or harm to stakeholders. Monitoring for concept drift is essential to maintain model reliability and trustworthiness.

Answer

It indicates the model is running out of memory.

Answer

It is not a risk issue; it is a maintenance issue.

Answer

It shows that the model is 'thinking' too slowly.

Question 7

What is the goal of an AI 'Model Inventory'?

Accepted Answer

To maintain visibility over all AI models and their associated risk profiles.. An AI Model Inventory is a centralized register that maintains visibility over all AI models in use, including their purpose, owner, data sources, version, and risk classification. Its primary goal is governance and risk management — you cannot govern what you cannot see. It enables oversight, audit, and lifecycle management rather than deployment speed or data sharing.

Answer

To automatically delete old models.

Answer

To provide marketing data to competitors.

Answer

To increase the speed of model deployment.

Question 8

When deploying a generative AI model, what 'Governance Control' is most critical for preventing the generation of harmful/inappropriate content?

Accepted Answer

Implement output guardrails and moderation layers.. Guardrails are technical controls placed on top of models to intercept and filter output, which is a vital part of risk governance.

Answer

Increase the number of GPUs to make it faster.

Answer

Only use the model in an internal environment without internet access.

Answer

Allow users to provide feedback directly to the model.

Question 9

Which THREE activities are part of the 'AI Risk Management' lifecycle?

Accepted Answer

Risk Treatment/Mitigation.. The AI Risk Management lifecycle follows the standard risk management process, which includes Risk Identification (C), where AI-related risks such as bias, data privacy issues, model drift, and security threats are systematically discovered and documented. Risk Treatment/Mitigation (B) is the phase where controls, safeguards, and remediation actions are selected and applied to reduce identified risks to acceptable levels. Ongoing Monitoring and Review (D) is essential because AI systems evolve through retraining, data changes, and environmental shifts, requiring continuous tracking of risk indicators and periodic reassessment of controls. Option A (manual approval of all company emails) is an operational email-handling procedure, not an AI risk management lifecycle activity, and option E (writing press releases about AI success) is a communications/marketing task unrelated to identifying, treating, or monitoring AI risk.

Answer

Manual approval of all company emails.

Answer

Writing press releases about AI success.

Question 10

What is the first step in performing an AI Risk Assessment?

Accepted Answer

Defining the scope, context, and purpose of the AI system.. Per ISO 31000 and NIST AI RMF, every risk assessment begins with establishing scope, context, and purpose — defining which AI system is being assessed, its boundaries, stakeholders, operating environment, and the objectives of the assessment. Without this foundational step, subsequent activities like bias testing or control selection lack a reference frame and may address the wrong risks or miss critical ones. This mirrors ISO 31000 Clause 6.3.1, which explicitly places 'defining scope and context' as the first activity in the risk assessment process.

Answer

Hiring a security consultant.

Answer

Updating the company website.

Answer

Running a bias test.

Question 11

In the context of the Three Lines of Defense, which function constitutes the 'Second Line'?

Accepted Answer

The AI Risk Management and Compliance teams.. In the Three Lines of Defense model, the Second Line consists of risk management and compliance functions that provide oversight, guidance, and challenge to the First Line (operational/business teams). For AI governance, the AI Risk Management and Compliance teams own frameworks, policies, and monitoring that ensure AI development and deployment align with risk appetite and regulatory requirements. They are independent from day-to-day operations but not fully independent like Internal Audit.

Answer

The Internal Audit department.

Answer

The Board of Directors.

Answer

The AI Development team.

Question 12

What is the 'Accountability' principle in the NIST AI RMF intended to address?

Accepted Answer

Ensuring that there is clear ownership and responsibility for AI system performance and safety.. The Accountability principle in the NIST AI RMF (part of the Govern function) is about ensuring clear ownership and responsibility for AI system performance, safety, and outcomes throughout the lifecycle. It answers 'who is responsible?' so that risks are managed, issues are escalated, and redress is possible. It is not about explainability, bug-freeness, or speed.

Answer

Ensuring the AI can explain itself.

Answer

Making sure the model is free of bugs.

Answer

Ensuring that the AI system is fast.

Question 13

What is the primary risk associated with 'Shadow AI' in an organization?

Accepted Answer

It bypasses established AI risk governance and compliance controls.. Shadow AI refers to AI tools deployed without the knowledge or oversight of the governance team, creating invisible, unmanaged risks.

Answer

It makes the network run slower.

Answer

It costs too much.

Answer

It makes the developers work too hard.

Question 14

How should an 'AI Ethics Committee' interact with the 'AI Risk Governance' body?

Accepted Answer

The Ethics Committee should serve as an advisory body to the governance framework.. An AI Ethics Committee should function as an advisory body that informs and guides the AI Risk Governance framework, providing ethical expertise, stakeholder perspectives, and recommendations on responsible AI use. It does not own the risk decisions or replace governance; instead, it feeds ethical considerations into the governance process so that risk owners can make informed, defensible choices. This separation preserves accountability while ensuring ethics is systematically considered.

Answer

The Ethics Committee should be responsible for coding the AI.

Answer

The Ethics Committee should have final veto power over all projects.

Answer

The Ethics Committee should replace the Risk Governance body.

Question 15

Which THREE factors should be evaluated when reviewing an AI model for 'Fairness'?

Accepted Answer

Performance disparity across different demographic cohorts.. Option A is correct because fairness review requires measuring performance disparity across different demographic cohorts — comparing metrics such as accuracy, precision, recall, or false positive/negative rates between protected groups reveals disparate impact. Option C is correct because fairness cannot be assessed without defined metrics for success that explicitly account for equity, such as equalized odds, demographic parity, or equal opportunity, which operationalize what 'fair' means for the use case. Option D is correct because training data representation across protected groups directly affects model behavior; underrepresentation or historical bias in the data propagates into biased predictions, so representation must be audited. Option B is not relevant because server uptime is an infrastructure/availability metric unrelated to model fairness. Option E is not relevant because model file size in kilobytes is a storage or deployment concern, not a fairness indicator.

Answer

The number of hours the server was powered on.

Answer

The model's file size in kilobytes.