AAIR AI Risk Governance And Framework Integration Practice Test 5 — 15 Questions

Question 1

A firm is integrating AI into its ERM (Enterprise Risk Management). What is the primary benefit of a 'Common Risk Taxonomy' for AI?

Accepted Answer

It ensures consistent risk identification, communication, and reporting across the organization.. A common taxonomy ensures that AI risk is understood and communicated consistently across the enterprise.

Answer

It forces all AI models to be identical.

Answer

It makes AI code easier to write.

Answer

It eliminates the need for risk assessments.

Question 2

Why is 'Model Validation' (distinct from testing) essential in an AI Governance framework?

Accepted Answer

To provide independent assurance that the model performs as expected and within risk thresholds.. Model Validation provides independent assurance that a model performs as expected and stays within defined risk thresholds. Unlike testing (which is typically performed by developers to check functional correctness), validation is an independent governance control that confirms the model meets business, ethical, and regulatory requirements before and after deployment. It is a core pillar of AI governance frameworks because it creates an auditable, objective checkpoint that separates the builder from the assessor.

Answer

To ensure the developers have followed the coding standards.

Answer

To save money on cloud hosting.

Answer

To speed up the coding process.

Question 3

Which of the following is an example of an 'AI Risk' in a customer-facing service?

Accepted Answer

A chatbot providing inaccurate information to a customer.. An AI risk in a customer-facing service is a harm or failure arising from the AI system's behavior — a chatbot providing inaccurate information is a classic example of hallucination/misinformation risk, which can mislead customers, cause financial or reputational harm, and create liability. It is directly attributable to the AI model's output quality and is a recognized risk category in AI governance frameworks.

Answer

The CEO deciding to change the corporate strategy.

Answer

The office printer running out of ink.

Answer

A scheduled maintenance window for the website.

Question 4

When reporting to the Board, what is the best way to present 'AI Risk'?

Accepted Answer

Link AI risks to overall business impact, strategic goals, and current risk appetite.. Board-level reporting requires translating technical AI risk into business language. Option C does this by connecting AI risks to overall business impact, strategic goals, and the organization's risk appetite—the three dimensions boards care about most. This approach enables informed governance decisions, resource allocation, and risk tolerance setting, which are the board's actual responsibilities. It aligns with AAIR's emphasis on AI governance being integrated into enterprise risk management rather than treated as a purely technical concern.

Answer

State that AI is completely safe and requires no oversight.

Answer

Provide a list of all model parameters.

Answer

Give a 4-hour technical lecture on deep learning.

Question 5

Your organization is integrating AI risks into the existing COSO Enterprise Risk Management (ERM) framework. Which action best ensures that AI-specific model drift risk is formally addressed within the 'Review and Revision' component?

Accepted Answer

Integrating model performance metrics into the quarterly enterprise risk assessment and management review processes.. COSO ERM's 'Review and Revision' component requires that risk responses be reassessed and adjusted as conditions change. Integrating model performance metrics (including drift indicators) into the quarterly enterprise risk assessment and management review processes ensures drift risk is formally reviewed, escalated, and acted upon at the governance level. This embeds AI risk into existing ERM cadence rather than treating it as a purely technical pipeline concern.

Answer

Establishing automated triggers within the CI/CD pipeline to halt deployment if drift exceeds threshold.

Answer

Mapping AI model inventory to the IT asset register in the CMDB.

Answer

Assigning a Data Scientist to the Board Risk Committee.

Question 6

A board of directors requests a dashboard to monitor AI risk exposure. Which metric provides the most effective board-level oversight regarding AI regulatory compliance?

Accepted Answer

Percentage of critical AI systems that have undergone a formal regulatory compliance impact assessment.. The board's primary concern is regulatory compliance and risk exposure, not operational performance. The percentage of critical AI systems that have undergone a formal regulatory compliance impact assessment directly measures the organization's adherence to frameworks like the EU AI Act, NIST AI RMF, or ISO/IEC 42001. This metric provides assurance that high-risk AI systems are being evaluated against legal and ethical requirements, which is a core board-level oversight responsibility.

Answer

Mean Time to Detect (MTTD) for model adversarial attacks.

Answer

Current GPU utilization rates for production inference clusters.

Answer

Average latency of API requests for generative AI models.

Question 7

An organization is establishing an AI Risk Committee. Which stakeholder is most critical to include to ensure alignment between enterprise risk appetite and technical AI capabilities?

Accepted Answer

Chief Risk Officer (CRO).. The Chief Risk Officer (CRO) is the executive who owns the enterprise risk appetite and the ERM framework, making them the most critical member to align AI risk governance with the organization's overall risk posture. Including the CRO ensures AI risks are scored, escalated, and mitigated using the same taxonomy and tolerance thresholds applied to financial, operational, and strategic risks. Without CRO involvement, AI risk decisions can drift from enterprise risk appetite.

Answer

Chief Information Security Officer (CISO).

Answer

Lead Cloud Architect.

Answer

Head of Human Resources.

Question 8

You are mapping existing ISO 31000 risk management processes to an AI-specific application. Which step is most crucial to ensure 'Risk Treatment' is appropriately scaled for AI?

Accepted Answer

Implementing a tiered control framework where mitigations scale based on the system's impact assessment.. A tiered control framework is the correct answer because ISO 31000's Risk Treatment step requires selecting controls proportionate to the assessed risk level. For AI, this means mitigations (e.g., human-in-the-loop review, explainability requirements, monitoring intensity) must scale with the system's impact classification — a low-risk internal chatbot needs lighter controls than a high-risk hiring or medical diagnostic model. This impact-based tiering directly operationalizes ISO 31000's principle that treatment options be evaluated against risk criteria and organizational context.

Answer

Automating all risk logging in the SIEM.

Answer

Discontinuing the use of third-party AI APIs to avoid vendor risk.

Answer

Standardizing all AI models under one security policy regardless of function.

Question 9

When reporting AI risk to the board, which approach best demonstrates 'Risk Culture' maturity?

Accepted Answer

Presenting a heatmap showing residual risk levels against the defined enterprise risk appetite.. Presenting a heatmap of residual risk against the enterprise risk appetite demonstrates Risk Culture maturity because it shows the board not just what risks exist, but how they compare to the organization's stated tolerance thresholds. This reflects an integrated, governance-driven approach where risk is quantified, contextualized, and actively managed rather than merely inventoried. Mature risk culture requires translating technical AI risk into business-relevant terms that support informed decision-making at the board level.

Answer

Listing all AI projects currently in production with their budget spend.

Answer

Reporting solely on the number of successful cyber attacks against the AI infrastructure.

Answer

Providing a list of all AI models currently undergoing training.

Question 10

Which document should a practitioner review to determine the organization's threshold for acceptable AI model bias?

Accepted Answer

The Enterprise Risk Appetite Statement.. The Enterprise Risk Appetite Statement is the governing document that defines how much risk the organization is willing to accept across its operations, including acceptable thresholds for AI model bias. It translates board-level risk tolerance into measurable limits that AI teams must design and validate against. Reviewing it tells a practitioner what bias level is tolerable versus what would breach organizational policy.

Answer

The vendor's Service Level Agreement (SLA).

Answer

The software's End User License Agreement (EULA).

Answer

The AI development team's sprint backlog.

Question 11

In the context of AI Supply Chain risk, what is the primary governance objective when evaluating a vendor's AI model transparency?

Accepted Answer

To confirm the vendor's model satisfies the internal 'Model Card' and transparency requirements for risk assessment.. The primary governance objective when evaluating a vendor's AI model transparency is to ensure the vendor provides sufficient documentation — such as model cards, datasheets, and transparency reports — to assess risks related to bias, explainability, and compliance. Confirming that the vendor's model satisfies internal Model Card and transparency requirements enables the organization to perform due diligence and integrate the model into its risk management framework.

Answer

To minimize the number of API calls made to the vendor.

Answer

To verify the vendor's financial stability and market share.

Answer

To ensure the vendor's training data includes proprietary internal company data.

Question 12

You are auditing the integration of AI risk into the Enterprise Risk Management (ERM) system. Which finding indicates a failure in the governance structure?

Accepted Answer

AI models deployed in production are missing from the centralized enterprise risk register.. A centralized enterprise risk register is the authoritative inventory of organizational risks; if production AI models are absent from it, the governance structure has failed to integrate AI risk into ERM — meaning those models are unmanaged, unreviewed, and invisible to executive and Board oversight. This is a structural governance failure because it breaks the linkage between AI risk identification and enterprise-level risk aggregation, violating the principle that all material risks must flow into the ERM.

Answer

The risk assessment template is 20 pages long.

Answer

The AI risk register is updated annually instead of monthly.

Answer

The AI risk committee meets quarterly rather than monthly.

Question 13

The board requires a new reporting structure for AI risk. Which TWO of the following should be included in the quarterly AI Risk Report to effectively communicate risk posture?

Accepted Answer

The status of the AI risk control roadmap and effectiveness of implemented mitigations.. Option C is correct because a quarterly AI Risk Report must communicate governance progress, so reporting the status of the AI risk control roadmap and the measured effectiveness of implemented mitigations shows whether planned controls are on track and actually reducing risk. Option E is correct because risk posture is defined by what remains after treatment, so an overview of current AI-related residual risks that exceed the organization's defined risk appetite gives the board the decision-relevant exceptions requiring acceptance, escalation, or further mitigation. Option A is not appropriate because raw training-iteration output is low-level engineering telemetry, not a risk-posture metric, and it does not map to risk appetite or control effectiveness. Option B is not appropriate because daily CPU and memory metrics for inference clusters are operational performance data with no direct bearing on AI risk exposure at a quarterly governance level. Option D is not appropriate because listing all model parameters and weights is an unmanageable technical artifact dump that conveys no meaningful risk or control information to the board.

Answer

The raw output from the model's most recent training iteration.

Answer

The daily CPU and memory metrics for the inference clusters.

Answer

A list of all individual model parameters and weights.

Question 14

You are integrating AI governance into the existing Corporate Governance framework. Which THREE of the following activities are essential to ensure the Board of Directors maintains adequate oversight?

Accepted Answer

Reviewing and approving the organization's AI Risk Appetite Statement.. Option A is correct because the Board's core governance role includes setting and approving the organization's risk appetite, and an AI Risk Appetite Statement translates that mandate into explicit tolerance thresholds for AI-specific risks (e.g., bias, model drift, data privacy), giving the Board a formal basis for oversight. Option C is correct because designating executive-level accountability (e.g., a Chief AI Officer or an AI risk owner at the C-suite) establishes clear ownership and escalation paths, which is a fundamental governance control ensuring the Board can hold management responsible for AI risk outcomes. Option E is correct because a defined reporting cadence for significant AI-related risk incidents and model performance trends provides the Board with timely, recurring visibility into AI risk posture, enabling informed oversight and intervention consistent with corporate governance principles. Options B and D are not Board-level governance activities: patching GPU servers is an operational IT maintenance task, and daily code reviews of training algorithms are tactical engineering controls, both of which belong to management and technical teams rather than the Board's oversight responsibilities.

Answer

Installing software patches on all GPU servers.

Answer

Conducting daily code reviews of all AI training algorithms.

Question 15

A multinational bank has assigned its AI governance responsibilities across the Three Lines of Defense. The second line has drafted an AI risk appetite statement, but the board wants assurance that the first line's AI use cases remain within that appetite. Which activity should the second line perform to provide this assurance while preserving its independence?

Accepted Answer

Independently review first-line AI risk assessments and challenge whether residual risk remains within the approved appetite.. Second-line assurance over AI risk appetite is delivered through independent review and credible challenge of first-line assessments, not by taking over operational controls or audit functions. This keeps risk ownership with the first line while giving the board objective evidence that residual AI risk is being managed within the approved appetite.

Answer

Directly approve or reject each first-line AI use case before deployment.

Answer

Operate the AI monitoring dashboards and tune alert thresholds for model drift.

Answer

Commission an external audit of the AI governance program and report findings to the board.