AAIR AI Risk Program Management — 25 Questions

Question 1

Your organization is experiencing 'AI Shadow IT'. What management action is most effective for bringing these initiatives into the Risk Program?

Accepted Answer

Implement a mandatory AI project registration and intake assessment process.. Visibility is the foundation of risk management. Implementing a centralized intake process forces shadow initiatives to be assessed.

Answer

Conduct a one-time audit of all network traffic.

Answer

Restrict all internet access to AI platforms.

Answer

Require managers to sign a liability waiver for their own AI projects.

Answer

multiple_choice

Question 2

When setting KPIs for an AI risk program, which metric is a leading indicator of potential model bias?

Accepted Answer

Demographic parity ratio in training data samples. Monitoring training data distribution is a leading indicator, whereas output monitoring is a lagging indicator.

Answer

Average model inference latency

Answer

Percentage of customer complaints regarding AI decisions

Answer

Number of model updates per quarter

Question 3

An organization is establishing an AI governance framework. Which approach is most effective for aligning AI risk appetite with enterprise-wide risk management (ERM)?

Accepted Answer

Map AI-specific risk metrics to existing enterprise risk categories like operational, financial, and reputational risk.. Integrating AI risk appetite into the existing ERM framework ensures consistency and avoids silos.

Answer

Establish a top-down mandate that ignores business unit input to ensure uniformity.

Answer

Focus solely on technical model performance metrics to define the organizational risk appetite.

Answer

Create a separate AI-specific risk register that operates independently of the corporate risk register.

Question 4

The AI Risk Governance Committee is defining the risk appetite for a new generative AI chatbot. Which THREE factors must be considered to align with organizational risk tolerance?

Accepted Answer

Data privacy and residency requirements for training sets. Risk appetite for AI depends on the domain, data sensitivity, and potential for harm.

Answer

The speed of the development team's sprint cycles

Answer

The total cost of GPU infrastructure

Question 5

A firm is using the NIST AI Risk Management Framework to document its AI risk program. Which approach best ensures that AI risk metrics are dynamic?

Accepted Answer

Integrating model performance metrics into operational dashboards. Mapping specific risk indicators to model performance monitoring allows metrics to evolve as the model's environment changes.

Answer

Conducting annual risk assessments

Answer

Setting static thresholds for model accuracy

Answer

Limiting AI deployment to offline systems

Question 6

An enterprise is establishing its AI Governance Committee. Which stakeholder is most critical to include to ensure alignment between AI technical capabilities and the organization's enterprise risk appetite?

Accepted Answer

Chief Risk Officer. The Chief Risk Officer (CRO) ensures that AI development aligns with the risk appetite and risk management framework, acting as the bridge between technical execution and business oversight.

Answer

Head of Legal

Answer

Chief Information Security Officer

Answer

Lead Data Scientist

Question 7

A cross-functional committee is evaluating the deployment of a high-impact AI model. Which TWO factors are critical to include in the initial AI risk assessment to ensure comprehensive coverage?

Accepted Answer

The socio-technical implications and potential impact on protected groups.. Data lineage and socio-technical impact are critical for high-impact AI assessments.

Answer

The frequency of software patching for the underlying cloud infrastructure.

Answer

The name of the vendor providing the cloud compute resources.

Answer

The specific programming language used for the model development.

Question 8

When drafting an AI risk policy, which element must be defined to provide clear guidance on acceptable AI outcomes?

Accepted Answer

Risk appetite statement. Risk appetite statements provide the boundary of acceptable risk, which is foundational to any AI risk management program.

Answer

AI model training data source list

Answer

Vendor procurement list

Answer

Technical architecture diagram

Question 9

An enterprise is establishing an AI Governance Committee. Which organizational structure best ensures that risk management is integrated into the AI development lifecycle?

Accepted Answer

Cross-functional membership including Legal, Security, and Engineering. A cross-functional approach involving data science, legal, compliance, and IT security ensures risk is addressed at every SDLC phase.

Answer

Centralized control under the Chief Data Officer

Answer

External advisory board oversight

Answer

Automated AI risk assessment tools alone

Question 10

A company is scaling its AI initiatives across five business units. What is the most effective way to ensure consistent risk measurement?

Accepted Answer

Implementing a centralized AI risk taxonomy. Standardizing a taxonomy ensures that all business units report risks using the same language and impact levels.

Answer

Using different platforms for each business unit

Answer

Allowing each business unit to define its own risk metrics

Answer

Focusing only on the highest-risk model

Question 11

You are defining KPIs for an AI project in a regulated industry. Which metric best captures model reliability over time?

Accepted Answer

Model drift (data drift/concept drift). Drift metrics indicate whether the model's accuracy is degrading, which is a proxy for reliability.

Answer

Frequency of model retraining

Answer

Number of training iterations

Answer

Total cost of compute resources

Question 12

When coordinating between Legal and Data Science teams, what is the best way to handle 'Explainability' requirements?

Accepted Answer

Require Data Science to translate technical model output into plain language documentation. Bridging technical model features (shapley values, etc.) with legal disclosure requirements requires a common documentation template.

Answer

Restrict Legal from reviewing AI model outputs

Answer

Let Legal define the technical parameters of the models

Answer

Only document model logic when a lawsuit occurs

Question 13

Which activity is a foundational requirement for building a sustainable AI risk program?

Accepted Answer

Creating an enterprise AI inventory. An AI inventory is the starting point for any risk program, as you cannot manage risks for models you haven't identified.

Answer

Signing contracts with AI vendors

Answer

Automating all model retraining cycles

Answer

Purchasing third-party AI auditing tools

Question 14

Which role is primarily responsible for ensuring that AI-generated content adheres to intellectual property risk policies?

Accepted Answer

Chief Legal Officer. The Chief Legal Officer or Legal counsel is accountable for IP rights and contractual obligations related to AI output.

Answer

System Administrator

Answer

Product Manager

Answer

Data Engineer

Question 15

A project lead argues that AI model performance metrics alone are sufficient for risk management. Why is this incorrect?

Accepted Answer

They do not capture social and compliance risk dimensions. Performance metrics do not account for external risks such as legal exposure, compliance violations, or social impact.

Answer

They change too quickly to report

Answer

They are too difficult to calculate for small models

Answer

They are too subjective

Question 16

In an AI risk program, how should 'Residual Risk' be treated?

Accepted Answer

It must be formally documented and periodically reviewed against risk appetite. Residual risk is the risk that remains after controls are applied; it must be periodically reviewed against the established appetite.

Answer

It should be ignored if below a specific performance threshold

Answer

It should always be zero for production systems

Answer

It should be formally accepted by the risk owner if it exceeds appetite

Question 17

To ensure cross-functional coordination, you are designing a workflow for AI incident reporting. Which group should be the first point of contact upon detecting an AI model bias issue?

Accepted Answer

AI Governance/Ethics Committee. The AI Governance team or AI Ethics office is tasked with immediate triage of AI-specific risks before escalation to legal or IT operations.

Answer

IT Help Desk

Answer

Customer Support

Answer

External Regulators

Question 18

Which of the following is an example of an 'AI Risk Metric'?

Accepted Answer

Rate of false negatives in model output. The rate of false negatives in a credit approval model is a direct measure of AI-specific operational risk.

Answer

Budget spent on office supplies

Answer

Employee headcount in AI department

Answer

Number of coffee machines in the breakroom

Question 19

What is the primary purpose of an 'AI Risk Dashboard' for executive leadership?

Accepted Answer

To provide high-level visibility into AI risk posture and trends. Dashboards allow leadership to see aggregated risk trends across the enterprise, not just individual project metrics.

Answer

To replace the need for an AI ethics committee

Answer

To provide raw model logs to the public

Answer

To monitor individual developer productivity

Question 20

Which of the following is a key component of 'AI Risk Governance'?

Accepted Answer

The definition of roles and responsibilities. Clear roles and responsibilities are essential for accountability, which is a core component of governance.

Answer

The choice of programming language

Answer

The vendor of the cloud hosting platform

Answer

The speed of model deployment