AAIR AI Risk Program Management Practice Test 2 — 15 Questions

Question 1

Which activity is a foundational requirement for building a sustainable AI risk program?

Accepted Answer

Creating an enterprise AI inventory. A sustainable AI risk program requires knowing what AI exists across the enterprise — an AI inventory is the foundational artifact that every other activity (policy, monitoring, audit, vendor review) depends on. Without it, risk assessments are incomplete and controls cannot be scoped. This is why inventory creation is consistently the first and most cited foundational requirement.

Answer

Signing contracts with AI vendors

Answer

Automating all model retraining cycles

Answer

Purchasing third-party AI auditing tools

Question 2

Which role is primarily responsible for ensuring that AI-generated content adheres to intellectual property risk policies?

Accepted Answer

Chief Legal Officer. The Chief Legal Officer is primarily responsible for ensuring that AI-generated content adheres to intellectual property risk policies, as they oversee legal compliance and IP strategy. This role ensures that AI outputs do not infringe on copyrights, trademarks, or other IP rights. Other roles lack the legal expertise and authority.

Answer

System Administrator

Answer

Product Manager

Answer

Data Engineer

Question 3

A project lead argues that AI model performance metrics alone are sufficient for risk management. Why is this incorrect?

Accepted Answer

They do not capture social and compliance risk dimensions. Model performance metrics (accuracy, precision, recall, latency) measure technical behavior but say nothing about whether the model complies with regulations, treats protected groups fairly, respects privacy, or aligns with organizational values. Risk management must span social, ethical, legal, and compliance dimensions that performance metrics cannot capture. Relying on performance alone leaves material risk unmanaged.

Answer

They change too quickly to report

Answer

They are too difficult to calculate for small models

Answer

They are too subjective

Question 4

In an AI risk program, how should 'Residual Risk' be treated?

Accepted Answer

It must be formally documented and periodically reviewed against risk appetite. Residual risk is the risk remaining after controls are applied, and it must be formally documented and periodically reviewed against the organization's risk appetite to confirm it stays within tolerance. This creates an auditable trail and ensures changes in the threat landscape or model behavior trigger reassessment. Treating residual risk as a one-time calculation rather than a living value is a common program failure.

Answer

It should be ignored if below a specific performance threshold

Answer

It should always be zero for production systems

Answer

It should be formally accepted by the risk owner if it exceeds appetite

Question 5

To ensure cross-functional coordination, you are designing a workflow for AI incident reporting. Which group should be the first point of contact upon detecting an AI model bias issue?

Accepted Answer

AI Governance/Ethics Committee. An AI Governance/Ethics Committee is the designated cross-functional body responsible for overseeing AI risk, including bias, fairness, and ethical concerns. When a bias issue is detected, this committee is the appropriate first point of contact because it has the authority, expertise, and mandate to assess the issue, coordinate response across legal, data science, and business teams, and determine remediation or escalation. Routing bias incidents here ensures consistent, accountable handling aligned with the organization's AI risk framework.

Answer

IT Help Desk

Answer

Customer Support

Answer

External Regulators

Question 6

Which of the following is an example of an 'AI Risk Metric'?

Accepted Answer

Rate of false negatives in model output. A risk metric quantifies the potential for harm or error in an AI system. The rate of false negatives directly measures how often the model misses positive cases, which is a core performance and risk indicator—especially in safety-critical applications like medical diagnosis or fraud detection. This metric helps assess the model's reliability and the risk of costly or dangerous omissions.

Answer

Budget spent on office supplies

Answer

Employee headcount in AI department

Answer

Number of coffee machines in the breakroom

Question 7

What is the primary purpose of an 'AI Risk Dashboard' for executive leadership?

Accepted Answer

To provide high-level visibility into AI risk posture and trends. An AI Risk Dashboard aggregates key risk indicators, model performance metrics, and compliance status into a concise executive view. Its primary purpose is to give leadership high-level visibility into the organization's AI risk posture and emerging trends so they can make informed strategic decisions. It does not replace governance bodies or expose raw technical logs.

Answer

To replace the need for an AI ethics committee

Answer

To provide raw model logs to the public

Answer

To monitor individual developer productivity

Question 8

Which of the following is a key component of 'AI Risk Governance'?

Accepted Answer

The definition of roles and responsibilities. A key component of AI Risk Governance is the definition of roles and responsibilities, which establishes accountability for risk management across the organization. This includes specifying who owns AI risks, who approves deployments, and who monitors ongoing performance. Without clear roles, governance breaks down and risks go unmanaged.

Answer

The choice of programming language

Answer

The vendor of the cloud hosting platform

Answer

The speed of model deployment

Question 9

When integrating AI risk into the broader ERM (Enterprise Risk Management) framework, which approach is most effective?

Accepted Answer

Map AI risks to existing risk categories (e.g., operational, compliance). Mapping AI risks to existing risk categories such as operational, compliance, and strategic risks integrates AI into the broader ERM framework. This allows the organization to leverage established risk management processes, reporting lines, and mitigation strategies. It ensures AI risks are not siloed and receive appropriate visibility and resourcing.

Answer

Only report AI risks if they result in a financial loss

Answer

Keep AI risks in a separate, isolated tracking system

Answer

Automate the removal of AI risks from the main risk register

Question 10

When performing an AI risk assessment, which question is most appropriate to ask?

Accepted Answer

What is the potential impact if the model produces biased results?. The most appropriate risk-assessment question probes potential harm and impact, such as the consequences of biased model outputs. This focuses the assessment on likelihood and severity of adverse outcomes, which is the core of risk analysis. Questions about team size, accuracy scores, or library choices are inputs or metrics, not risk-impact questions.

Answer

How many people are on the development team?

Answer

What is the model's highest accuracy score?

Answer

Does the model use open-source libraries?

Question 11

Which documentation is necessary to provide to auditors for an AI system?

Accepted Answer

The model card or model documentation. Model cards (and related model documentation such as datasheets for datasets) are the standard artifacts auditors expect for AI systems because they disclose a model's intended use, training data, performance metrics, limitations, ethical considerations, and evaluation results. They provide the transparency and traceability auditors need to assess whether the AI system is being used appropriately and whether its risks are understood and documented. This aligns with NIST AI RMF transparency and accountability principles.

Answer

A list of all employees who attended a conference

Answer

The login credentials for the production environment

Answer

The complete source code without comments

Question 12

A company is utilizing a third-party LLM service. Which risk is specifically heightened by this arrangement?

Accepted Answer

Data leakage and privacy violations. Using a third-party LLM service means prompts, context, and potentially sensitive data are transmitted to and processed by an external provider, heightening data leakage and privacy violation risk. The organization loses direct control over data handling, retention, and secondary use, and may face regulatory exposure under GDPR, HIPAA, or similar regimes. This is the risk specifically amplified by the third-party arrangement.

Answer

Server downtime

Answer

Model training cost inflation

Answer

Lack of software updates

Question 13

Why is 'Data Lineage' important in an AI risk management program?

Accepted Answer

It helps ensure data quality and integrity. Data lineage documents the origin, movement, transformation, and usage of data throughout its lifecycle, which is foundational to AI risk management because it enables traceability of data quality issues, bias sources, and compliance violations back to their root. Without lineage, an organization cannot verify that training data was lawfully obtained, representative, or free of contamination — making it impossible to assess or remediate data-related AI risks.

Answer

It makes user interfaces more attractive

Answer

It improves server load times

Answer

It reduces the amount of storage needed

Question 14

What is the primary responsibility of a 'Model Owner' in an AI risk framework?

Accepted Answer

Maintaining the risk profile and performance of the model. The Model Owner is accountable for the model's risk profile and performance throughout its lifecycle, including ensuring it operates within approved risk tolerances, monitoring for drift or degradation, and maintaining documentation for governance and audit. This role bridges technical teams and governance bodies, ensuring the model continues to meet business, ethical, and regulatory requirements. It is an accountability role, not necessarily a hands-on coding role.

Answer

Writing all the Python code for the model

Answer

Approving company-wide bonuses

Answer

Fixing broken office furniture

Question 15

What is the primary reason for maintaining an 'AI Model Inventory'?

Accepted Answer

To identify and mitigate shadow AI risks. The primary reason for maintaining an AI Model Inventory is to identify and mitigate shadow AI risks by providing a centralized record of all models in use. This visibility helps ensure compliance, track model lifecycle, and manage risks such as unauthorized deployments. It is not for sharing code or backing up databases.

Answer

To share model code with competitors

Answer

To make the database easier to back up

Answer

To increase the size of the IT department