An organization is establishing an AI governance framework. Which approach is most effective for aligning AI risk appetite with enterprise-wide risk management (ERM)?
The AI Risk Governance Committee is defining the risk appetite for a new generative AI chatbot. Which THREE factors must be considered to align with organizational risk tolerance?
An enterprise is establishing its AI Governance Committee. Which stakeholder is most critical to include to ensure alignment between AI technical capabilities and the organization's enterprise risk appetite?
A cross-functional committee is evaluating the deployment of a high-impact AI model. Which TWO factors are critical to include in the initial AI risk assessment to ensure comprehensive coverage?
An enterprise is establishing an AI Governance Committee. Which organizational structure best ensures that risk management is integrated into the AI development lifecycle?
To ensure cross-functional coordination, you are designing a workflow for AI incident reporting. Which group should be the first point of contact upon detecting an AI model bias issue?
In a cross-functional AI governance meeting, the Data Science team wants to deploy a new model, but the Legal team is concerned about data privacy. How should the AI Risk Manager resolve this?
You are establishing an AI risk appetite framework using the NIST AI RMF. Which action best ensures alignment between AI innovation velocity and organizational risk tolerance?
Your organization is implementing an AI Risk Register. Which approach provides the most effective cross-functional coordination for identifying bias in a new HR recruitment AI?
An organization discovers that their AI model exhibits bias toward a specific demographic. What is the most important step in the Incident Response process?
You are the AI risk lead at a health insurer. A vendor-supplied claims-triage model that scores prior-authorization requests is scheduled to go live in 30 days. Internal audit asks how the organization will detect silent performance drift once the model is operating, given that the vendor will not expose training data or model weights. Which control is MOST appropriate to establish before go-live?
A retail bank's AI risk committee is defining how third-party foundation model providers should be governed across 40 planned use cases. Legal notes that several providers reserve the right to change model versions with limited notice, and business units want to avoid re-approval delays for every update. Which approach BEST balances risk oversight with delivery speed?
You are the AI risk lead at a mid-sized insurer. The Chief Risk Officer asks you to establish a formal AI risk taxonomy that will be used consistently across all business units for identifying, assessing, and reporting AI risks. Which action best ensures the taxonomy will be adopted and remain useful over time?
A global bank's AI risk committee is defining key risk indicators (KRIs) for its portfolio of customer-facing AI systems. The committee wants KRIs that provide early warning of emerging risk rather than lagging confirmation of past failures. Which KRI design best meets this objective?
A hospital network deploys a clinical decision support model that recommends sepsis protocols. During a risk assessment, the AI risk manager identifies that clinicians frequently override the model's recommendations when they conflict with bedside judgment. Which risk treatment strategy is most appropriate for this situation?
A fintech company is preparing its annual AI risk report for the board. The Chief Risk Officer wants the report to demonstrate that the AI risk program is operating effectively, not merely listing AI use cases. Which two elements most directly provide evidence of an effective operating AI risk program? (Choose two.)
A retail company's AI governance committee is drafting its charter. The committee wants to define clear decision rights so that disputes over AI risk acceptance do not stall deployment decisions. Which element is most essential to include in the charter?