AAIR AI Risk Governance And Framework Integration — Timed 10 Questions

Question 1

You are mapping AI risks to the NIST AI RMF. Which step is essential when documenting the 'Map' function for a high-risk autonomous system?

Accepted Answer

Identifying and documenting the context and intended use. Identifying and documenting the context and intended use is the foundation of mapping AI risks to an enterprise framework.

Answer

Updating the SOC2 Type II report

Answer

Automating the model deployment pipeline

Answer

Conducting a quarterly penetration test

Question 2

A firm is establishing an AI Governance Committee. Which TWO groups should be represented to ensure comprehensive oversight?

Accepted Answer

Data Privacy Office. Legal/Compliance and Data Privacy are essential for addressing the regulatory and ethical risks inherent in AI deployments.

Answer

Public relations

Answer

Hardware vendors

Answer

External marketing agencies

Question 3

A financial institution is integrating AI risk into its ERM framework. Which action most effectively aligns AI risk appetite with enterprise risk appetite?

Accepted Answer

Defining quantitative risk thresholds in the AI governance policy. Defining quantitative risk thresholds in the AI governance policy ensures alignment with the organization's overall risk capacity.

Answer

Purchasing cybersecurity insurance for AI systems

Answer

Assigning AI risk ownership to the IT department

Answer

Implementing a standalone AI audit program

Question 4

You are integrating AI risk into the NIST Risk Management Framework (RMF). Which step requires an explicit evaluation of AI model lineage and data provenance to satisfy the 'Govern' function?

Accepted Answer

Governance mapping during 'Govern' function analysis. The NIST AI RMF 'Govern' function prioritizes understanding the provenance and lineage to establish accountability and transparency.

Answer

Step 2: Select controls

Answer

Step 1: Categorize system

Answer

Continuous Monitoring phase

Question 5

When configuring the Microsoft Purview AI hub for risk management, which setting must be enabled to ensure AI prompt logs are captured for enterprise risk reporting?

Accepted Answer

Configure Microsoft Purview AI activity logging. Microsoft Purview's AI hub requires activity logging to be enabled to audit interactions with generative AI applications.

Answer

Enable Audit (Premium)

Answer

Set up Data Loss Prevention (DLP) policies

Answer

Enable sensitivity labels

Question 6

During a board meeting, the Chief Risk Officer needs to present AI model performance trends. Which metric is most critical for board-level reporting?

Accepted Answer

Frequency and severity of model drift incidents. The frequency and severity of model drift incidents are direct indicators of operational and reputational risk, which are board-level concerns.

Answer

Data scientists' training hours per quarter

Answer

Computational resource utilization percentage

Answer

Model latency in milliseconds

Question 7

When integrating AI risk into existing ERM, which THREE aspects of an AI model lifecycle must be audited to ensure compliance?

Accepted Answer

Model validation results. Data lineage, model validation results, and incident response logs are critical audit points for enterprise risk accountability.

Answer

Personnel physical security badges

Answer

Office climate control settings

Question 8

Which TWO of the following governance actions should a Chief Risk Officer (CRO) implement to align AI risk with the COSO Enterprise Risk Management (ERM) framework?

Accepted Answer

Establish a cross-functional AI Risk Committee. COSO ERM requires integrating risk into strategy and performance. Governance structures and risk appetite alignment are key.

Answer

Assign AI risk ownership to individual data scientists

Answer

Disable all open-source AI libraries

Answer

Mandate daily model training cycles

Question 9

Which THREE components must be included in an AI Risk Register to satisfy ISO/IEC 42001 requirements?

Accepted Answer

Identification of relevant stakeholders. ISO 42001 requires systematic risk identification, analysis, and treatment planning.

Answer

Hardware procurement schedules

Answer

Technical documentation of model architecture

Question 10

A board of directors requests a dashboard view of AI model drift. Which metric is most appropriate for a board-level risk report?

Accepted Answer

Feature drift threshold violations. The board requires high-level risk indicators rather than granular performance metrics like F1 scores.

Answer

Mean Squared Error (MSE)

Answer

GPU utilization percentage

Answer

Latency per inference request