AAIR AI Risk Program Management — 40 Questions

Question 1

Which THREE metrics should be tracked to assess the 'Risk' of an AI model in production?

Accepted Answer

Model accuracy/error rate. Model accuracy/error rate (A) is a core risk metric because it directly quantifies how often the model produces incorrect outputs, which drives business, safety, and compliance exposure in production. Model latency (D) matters for risk because slow response times can violate SLAs, degrade user experience, and cause downstream failures in real-time or automated decision systems. Data drift (E) is essential because shifts between production input distributions and training data can silently degrade model reliability and validity, increasing the likelihood of harmful or non-compliant predictions. The unmarked options do not belong: the brand of the coffee machine (B) and the number of employees in the break room (C) are irrelevant workplace trivia with no bearing on AI model risk.

Answer

The brand of the coffee machine

Answer

The number of employees in the break room

Question 2

Which TWO actions are required to manage 'Third-Party' AI risks?

Accepted Answer

Performing due diligence on the vendor's AI risk practices. Option A is correct because managing third-party AI risk begins with due diligence: you must assess the vendor's AI governance, model training data provenance, bias testing, security controls, and compliance with frameworks such as ISO/IEC 42001 or the NIST AI RMF before onboarding or renewing the relationship. Option E is correct because a signed NDA is a contractual control that legally binds the vendor to confidentiality, protecting proprietary data, model inputs, and any sensitive information shared during the AI engagement. The remaining options do not belong: ignoring vendor feedback (B) removes a key input for continuous risk monitoring, letting the vendor set their own rules (C) abandons organizational oversight and accountability, and asking for a cafeteria menu (D) is irrelevant to AI risk management.

Answer

Ignoring the vendor's feedback

Answer

Allowing the vendor to set their own rules

Answer

Asking the vendor for their cafeteria menu

Question 3

Which TWO teams should define the 'Risk Appetite' for a new AI project?

Accepted Answer

Senior Leadership/Business Owners. Option A (Senior Leadership/Business Owners) is correct because risk appetite is a strategic decision about how much uncertainty and potential loss the organization is willing to accept in pursuit of the AI project's objectives, and only those accountable for business outcomes have the authority to set that threshold. Option B (The Risk Management/Compliance Office) is correct because this function translates leadership's tolerance into measurable risk limits, ensures alignment with regulatory and ethical obligations, and provides the governance framework for monitoring AI risks. Options C, D, and E are incorrect because a weather station, landscaping team, and company mascot have no governance authority, fiduciary responsibility, or risk oversight role in defining an AI project's risk appetite.

Answer

The local weather station

Answer

The office landscaping team

Answer

The company's mascot

Question 4

Your organization is experiencing 'AI Shadow IT'. What management action is most effective for bringing these initiatives into the Risk Program?

Accepted Answer

Implement a mandatory AI project registration and intake assessment process.. Visibility is the foundation of risk management. Implementing a centralized intake process forces shadow initiatives to be assessed.

Answer

Conduct a one-time audit of all network traffic.

Answer

Restrict all internet access to AI platforms.

Answer

Require managers to sign a liability waiver for their own AI projects.

Answer

multiple_choice

Question 5

When setting KPIs for an AI risk program, which metric is a leading indicator of potential model bias?

Accepted Answer

Demographic parity ratio in training data samples. Demographic parity ratio in training data samples is a leading indicator because it measures the representation of protected groups before the model is deployed. A skewed ratio (e.g., far from 1.0) signals that the model may learn biased patterns, allowing proactive mitigation. Unlike lagging metrics such as complaints, it provides early warning during data collection and preprocessing.

Answer

Average model inference latency

Answer

Percentage of customer complaints regarding AI decisions

Answer

Number of model updates per quarter

Question 6

An organization is establishing an AI governance framework. Which approach is most effective for aligning AI risk appetite with enterprise-wide risk management (ERM)?

Accepted Answer

Map AI-specific risk metrics to existing enterprise risk categories like operational, financial, and reputational risk.. Mapping AI-specific risk metrics to existing enterprise risk categories (operational, financial, reputational) integrates AI risk into ERM rather than treating it as a silo. This lets the organization express AI risk appetite in the same language and scales used for other risks, enabling consistent aggregation, reporting, and board-level oversight. It is the approach most aligned with COSO ERM and ISO 31000 integration principles.

Answer

Establish a top-down mandate that ignores business unit input to ensure uniformity.

Answer

Focus solely on technical model performance metrics to define the organizational risk appetite.

Answer

Create a separate AI-specific risk register that operates independently of the corporate risk register.

Question 7

The AI Risk Governance Committee is defining the risk appetite for a new generative AI chatbot. Which THREE factors must be considered to align with organizational risk tolerance?

Accepted Answer

Data privacy and residency requirements for training sets. Option B is correct because data privacy and residency requirements directly shape risk appetite: regulations like GDPR, HIPAA, or data-localization laws determine what training data may be used and where it can be stored, which bounds the acceptable risk for the chatbot. Option C is correct because model drift is a core AI risk factor — as data distributions shift, output accuracy degrades, so the committee must weigh the likelihood of drift against the organization's tolerance for degraded performance. Option D is correct because hallucination is a generative-AI-specific risk whose potential impact on brand reputation and customer trust must be assessed against the organization's risk tolerance. Option A is not a risk-appetite factor; sprint cadence is a delivery-process metric, not a measure of AI risk exposure. Option E is also not a risk-tolerance factor; GPU infrastructure cost is a budgeting concern, not a determinant of acceptable risk.

Answer

The speed of the development team's sprint cycles

Answer

The total cost of GPU infrastructure

Question 8

A firm is using the NIST AI Risk Management Framework to document its AI risk program. Which approach best ensures that AI risk metrics are dynamic?

Accepted Answer

Integrating model performance metrics into operational dashboards. Integrating model performance metrics into operational dashboards ensures that AI risk metrics are dynamic, as they are continuously updated and monitored in real time. This allows for timely detection of drift, bias, or degradation. Annual assessments and static thresholds are not dynamic.

Answer

Conducting annual risk assessments

Answer

Setting static thresholds for model accuracy

Answer

Limiting AI deployment to offline systems

Question 9

An enterprise is establishing its AI Governance Committee. Which stakeholder is most critical to include to ensure alignment between AI technical capabilities and the organization's enterprise risk appetite?

Accepted Answer

Chief Risk Officer. The Chief Risk Officer (CRO) owns the enterprise risk appetite and framework, so including the CRO ensures AI risks are calibrated to the organization's overall risk tolerance rather than treated as a standalone technical concern. The CRO can translate AI-specific risks (bias, model drift, regulatory exposure) into the enterprise risk taxonomy and ensure governance decisions align with board-approved risk limits. This alignment is the committee's core purpose, making the CRO the most critical stakeholder.

Answer

Head of Legal

Answer

Chief Information Security Officer

Answer

Lead Data Scientist

Question 10

A cross-functional committee is evaluating the deployment of a high-impact AI model. Which TWO factors are critical to include in the initial AI risk assessment to ensure comprehensive coverage?

Accepted Answer

The socio-technical implications and potential impact on protected groups.. Option B is correct because a comprehensive AI risk assessment must evaluate socio-technical implications, including how the model's deployment could disproportionately affect protected groups (e.g., by race, gender, age, or disability), which is central to fairness, equity, and regulatory compliance concerns such as those in the EU AI Act and NIST AI RMF. Option C is correct because understanding training data lineage—provenance, collection methods, and embedded bias sources—is essential to identifying data-driven risks like historical bias, sampling bias, and label bias that propagate into model outputs. Options A, D, and E are not critical initial risk-assessment factors: patching frequency (A) is a general infrastructure hygiene concern, the vendor name (D) is a procurement detail rather than a risk dimension, and the programming language (E) is an implementation choice that does not materially affect AI risk exposure.

Answer

The frequency of software patching for the underlying cloud infrastructure.

Answer

The name of the vendor providing the cloud compute resources.

Answer

The specific programming language used for the model development.

Question 11

When drafting an AI risk policy, which element must be defined to provide clear guidance on acceptable AI outcomes?

Accepted Answer

Risk appetite statement. A risk appetite statement defines the level and types of risk an organization is willing to accept in pursuit of its objectives, providing clear guidance on acceptable AI outcomes. It translates abstract risk tolerance into concrete boundaries that AI teams can apply when designing, deploying, and operating models. Without it, decision-makers lack a consistent benchmark for what constitutes acceptable versus unacceptable AI risk.

Answer

AI model training data source list

Answer

Vendor procurement list

Answer

Technical architecture diagram

Question 12

An enterprise is establishing an AI Governance Committee. Which organizational structure best ensures that risk management is integrated into the AI development lifecycle?

Accepted Answer

Cross-functional membership including Legal, Security, and Engineering. A cross-functional AI Governance Committee including Legal, Security, and Engineering ensures that legal/regulatory, security/privacy, and technical feasibility perspectives are all represented in AI risk decisions. This integration embeds risk management into the development lifecycle because engineering is at the table alongside the functions that define constraints and obligations, enabling risks to be identified and mitigated during design rather than after deployment.

Answer

Centralized control under the Chief Data Officer

Answer

External advisory board oversight

Answer

Automated AI risk assessment tools alone

Question 13

A company is scaling its AI initiatives across five business units. What is the most effective way to ensure consistent risk measurement?

Accepted Answer

Implementing a centralized AI risk taxonomy. A centralized AI risk taxonomy provides a common language, scoring scale, and category structure that all five business units can apply consistently, enabling comparable risk measurement across the enterprise. Without a shared taxonomy, each unit's risk ratings become incommensurable, defeating the purpose of enterprise-wide AI risk oversight. This aligns with AAIR guidance that risk measurement must be standardized before it can be aggregated or governed.

Answer

Using different platforms for each business unit

Answer

Allowing each business unit to define its own risk metrics

Answer

Focusing only on the highest-risk model

Question 14

You are defining KPIs for an AI project in a regulated industry. Which metric best captures model reliability over time?

Accepted Answer

Model drift (data drift/concept drift). Model drift — encompassing data drift and concept drift — directly measures whether a model's predictive behavior remains aligned with the real-world distribution it was trained on. It is the canonical reliability KPI because it captures degradation over time before it manifests as business harm. Retraining frequency, iteration counts, and compute cost are operational metrics, not reliability indicators.

Answer

Frequency of model retraining

Answer

Number of training iterations

Answer

Total cost of compute resources

Question 15

When coordinating between Legal and Data Science teams, what is the best way to handle 'Explainability' requirements?

Accepted Answer

Require Data Science to translate technical model output into plain language documentation. Explainability requirements exist so that non-technical stakeholders — Legal, compliance, regulators, and affected individuals — can understand how a model reaches decisions. The Data Science team owns the technical model and is best positioned to translate its behavior into plain-language documentation that Legal can review and rely on. This preserves the division of labor: Data Science explains, Legal interprets and applies.

Answer

Restrict Legal from reviewing AI model outputs

Answer

Let Legal define the technical parameters of the models

Answer

Only document model logic when a lawsuit occurs

Question 16

Which activity is a foundational requirement for building a sustainable AI risk program?

Accepted Answer

Creating an enterprise AI inventory. A sustainable AI risk program requires knowing what AI exists across the enterprise — an AI inventory is the foundational artifact that every other activity (policy, monitoring, audit, vendor review) depends on. Without it, risk assessments are incomplete and controls cannot be scoped. This is why inventory creation is consistently the first and most cited foundational requirement.

Answer

Signing contracts with AI vendors

Answer

Automating all model retraining cycles

Answer

Purchasing third-party AI auditing tools

Question 17

Which role is primarily responsible for ensuring that AI-generated content adheres to intellectual property risk policies?

Accepted Answer

Chief Legal Officer. The Chief Legal Officer is primarily responsible for ensuring that AI-generated content adheres to intellectual property risk policies, as they oversee legal compliance and IP strategy. This role ensures that AI outputs do not infringe on copyrights, trademarks, or other IP rights. Other roles lack the legal expertise and authority.

Answer

System Administrator

Answer

Product Manager

Answer

Data Engineer

Question 18

A project lead argues that AI model performance metrics alone are sufficient for risk management. Why is this incorrect?

Accepted Answer

They do not capture social and compliance risk dimensions. Model performance metrics (accuracy, precision, recall, latency) measure technical behavior but say nothing about whether the model complies with regulations, treats protected groups fairly, respects privacy, or aligns with organizational values. Risk management must span social, ethical, legal, and compliance dimensions that performance metrics cannot capture. Relying on performance alone leaves material risk unmanaged.

Answer

They change too quickly to report

Answer

They are too difficult to calculate for small models

Answer

They are too subjective

Question 19

In an AI risk program, how should 'Residual Risk' be treated?

Accepted Answer

It must be formally documented and periodically reviewed against risk appetite. Residual risk is the risk remaining after controls are applied, and it must be formally documented and periodically reviewed against the organization's risk appetite to confirm it stays within tolerance. This creates an auditable trail and ensures changes in the threat landscape or model behavior trigger reassessment. Treating residual risk as a one-time calculation rather than a living value is a common program failure.

Answer

It should be ignored if below a specific performance threshold

Answer

It should always be zero for production systems

Answer

It should be formally accepted by the risk owner if it exceeds appetite

Question 20

To ensure cross-functional coordination, you are designing a workflow for AI incident reporting. Which group should be the first point of contact upon detecting an AI model bias issue?

Accepted Answer

AI Governance/Ethics Committee. An AI Governance/Ethics Committee is the designated cross-functional body responsible for overseeing AI risk, including bias, fairness, and ethical concerns. When a bias issue is detected, this committee is the appropriate first point of contact because it has the authority, expertise, and mandate to assess the issue, coordinate response across legal, data science, and business teams, and determine remediation or escalation. Routing bias incidents here ensures consistent, accountable handling aligned with the organization's AI risk framework.

Answer

IT Help Desk

Answer

Customer Support

Answer

External Regulators