AAIR AI Risk Program Management Practice Test 3 — 15 Questions

Question 1

In a cross-functional AI governance meeting, the Data Science team wants to deploy a new model, but the Legal team is concerned about data privacy. How should the AI Risk Manager resolve this?

Accepted Answer

Conduct a joint risk assessment to identify potential mitigations. The AI Risk Manager should facilitate a joint risk assessment that brings together Data Science and Legal to identify privacy risks and potential mitigations. This collaborative approach balances innovation with compliance, rather than unilaterally halting work or escalating to the CEO prematurely. It ensures both technical and legal perspectives inform the decision.

Answer

Order the Data Science team to stop work immediately

Answer

Ask the CEO to decide

Answer

Ignore the Legal team's concerns

Question 2

When assessing the risk of AI-generated content, which factor is the most important for calculating 'Impact'?

Accepted Answer

The potential for reputational and legal consequences. Impact in risk assessment is defined as the magnitude of consequences if a risk materializes; for AI-generated content, the most significant consequences are reputational damage and legal liability (defamation, copyright infringement, regulatory penalties, discrimination claims). These are the factors that determine severity in a risk matrix, whereas generation speed, font color, and GPU count are technical or cosmetic attributes with no bearing on harm magnitude.

Answer

The speed at which the content is generated

Answer

The color of the font used for the output

Answer

The number of GPUs used to create the content

Question 3

What is 'Bias' in the context of AI risk?

Accepted Answer

Systematic prejudice in model outputs leading to unfair results. In AI risk taxonomy, bias refers to systematic and unfair prejudice in model outputs that disadvantages individuals or groups based on protected attributes like race, gender, or age. It arises from skewed training data, flawed feature selection, or proxy variables, and manifests as disparate impact in decisions such as hiring, lending, or healthcare. It is a fairness risk, not a documentation, cost, or performance issue.

Answer

The model is missing documentation

Answer

The model is too expensive to maintain

Answer

The model is running too fast

Question 4

Which action should be taken if a model's performance consistently falls outside the 'Risk Appetite' threshold?

Accepted Answer

Take the model offline for remediation. When a model's performance consistently falls outside the defined Risk Appetite threshold, the organization has exceeded its tolerance for risk, so the model should be taken offline for remediation to prevent potential harm or compliance violations. This action aligns with governance principles that require corrective action when risk limits are breached. Simply ignoring or adjusting the threshold would undermine the risk management framework.

Answer

Only inform the IT team

Answer

Ignore the result as it is just a statistical outlier

Answer

Increase the threshold to match current performance

Question 5

Which of the following is a classic example of 'AI Hallucination' that needs monitoring?

Accepted Answer

The system generates confident but factually incorrect information. AI hallucination refers to a model generating confident but factually incorrect or nonsensical information, which is a key risk that requires monitoring. This can lead to misinformation, user harm, and reputational damage. The other options describe operational or infrastructure issues, not hallucination.

Answer

The system is running slowly

Answer

The system requires too much electricity

Answer

The system password has expired

Question 6

In a retail company, which AI risk is most likely to cause direct financial loss?

Accepted Answer

The pricing model provides incorrect, discounted rates. The AI risk most likely to cause direct financial loss in a retail company is a pricing model that provides incorrect, discounted rates. This directly impacts revenue and profitability, as customers may be undercharged or the company may lose sales due to pricing errors. Incorrect pricing can also lead to competitive disadvantages and customer distrust.

Answer

The model documentation is outdated

Answer

The font size in the UI is too small

Answer

The model's name is not catchy

Question 7

When an AI model fails in production, what is the 'Post-Mortem' goal?

Accepted Answer

To identify root causes and update risk management practices. A post-mortem's goal is to identify root causes of the failure and feed those lessons back into risk management practices, controls, and monitoring. It is a blameless, learning-oriented exercise that improves future resilience rather than assigning fault. This aligns with AAIR's emphasis on continuous improvement of the AI risk management lifecycle.

Answer

To hide the failure from management

Answer

To fire the developer responsible

Answer

To delete all logs associated with the model

Question 8

Which team is usually responsible for the 'Technical Implementation' of risk controls in an AI model?

Accepted Answer

Data Science/Machine Learning Team. The Data Science/Machine Learning Team is responsible for the technical implementation of risk controls in an AI model because they build, train, and deploy the model. They implement controls such as bias mitigation, model monitoring, access controls, and performance safeguards directly in the code and pipeline. Other teams provide oversight, policy, or compliance guidance but do not typically implement technical controls.

Answer

Internal Audit

Answer

Human Resources

Answer

Legal Department

Question 9

Which metric is useful for measuring the 'Efficiency' of an AI risk program?

Accepted Answer

Time to complete a risk assessment for new models. Time to complete a risk assessment for new models is a direct efficiency metric because it measures the throughput and speed of the risk program's core process — how quickly it can evaluate and onboard AI models. Efficiency metrics compare outputs to inputs (time, cost, effort), and assessment cycle time captures how productively the program converts review effort into completed assessments. Shorter cycle times with consistent quality indicate a more efficient program.

Answer

Number of emails sent

Answer

Total weight of the hardware

Answer

Number of meetings held

Question 10

When drafting a vendor management policy for AI, what is the most important clause to include?

Accepted Answer

Right-to-audit the vendor's AI training practices. The most important clause in an AI vendor management policy is the right-to-audit the vendor's AI training practices, as it ensures transparency and accountability for the vendor's data handling, model development, and compliance with ethical standards. This clause allows the organization to verify that the vendor's AI systems meet regulatory and contractual requirements. Without it, the organization has limited visibility into potential risks.

Answer

Requirement for vendor to provide coffee

Answer

Requirement to use a specific font

Answer

Vendor must provide free hardware

Question 11

If an AI model relies on an open-source library that is found to have a security vulnerability, who is responsible for managing this risk?

Accepted Answer

The AI Risk Manager and Security team. When an AI system depends on a vulnerable open-source library, the organization deploying the model owns the residual risk. The AI Risk Manager and Security team are responsible for identifying, assessing, and mitigating that risk through patching, compensating controls, or replacing the dependency. Responsibility cannot be outsourced to the library author or regulators simply because the code was third-party.

Answer

The government regulators

Answer

The library's author

Answer

The public at large

Question 12

Which stage of the AI lifecycle should risk management activities begin?

Accepted Answer

During the design and requirements phase. Risk management activities should begin during the design and requirements phase of the AI lifecycle to proactively identify and mitigate potential risks before they materialize. This early integration ensures that ethical, legal, and operational risks are considered from the outset, reducing costly rework and harm. Waiting until later stages increases the likelihood of unintended consequences.

Answer

When the budget is exhausted

Answer

After the model is fully deployed

Answer

Only when a bug is reported

Question 13

Which THREE components are necessary for effective cross-functional AI risk coordination?

Accepted Answer

Clearly defined RACI matrix for AI initiatives. A clearly defined RACI matrix for AI initiatives (A) is necessary because it assigns explicit Responsible, Accountable, Consulted, and Informed roles across functions, eliminating ambiguity about who owns each AI risk decision and escalation path. A standardized AI risk taxonomy (C) is required so that legal, security, data science, and business teams classify and compare risks using the same categories, severity scales, and terminology, enabling consistent cross-functional assessment. A centralized AI risk register (D) is essential as the single source of truth that aggregates identified risks, owners, mitigations, and status, giving all functions shared visibility and traceability. Weekly team lunches (B) are a social nicety that may improve rapport but are not a structural mechanism for risk coordination, and unrestricted access to all production servers for all staff (E) violates least-privilege and actually increases risk rather than enabling effective coordination.

Answer

Weekly team lunches

Answer

Unrestricted access to all production servers for all staff

Question 14

Which TWO factors should be included in an AI risk appetite statement?

Accepted Answer

Financial thresholds for model-related incidents. Option D is correct because a risk appetite statement must quantify how much financial loss from model-related incidents (e.g., fraud, erroneous decisions, remediation costs) the organization is willing to tolerate, expressed as concrete monetary thresholds or limits. Option E is correct because AI-specific risk appetite must define the maximum acceptable level of model bias (e.g., disparate impact ratios or fairness metric tolerances), since bias is a core AI risk affecting ethics, compliance, and legal exposure. Options A, B, and C are not appropriate: intended revenue impact is a business outcome rather than a risk tolerance limit, programming language is an implementation/technical standard, and preferred office software is an unrelated productivity choice — none of these express acceptable risk levels for AI systems.

Answer

The intended impact on company revenue

Answer

The specific programming language allowed

Answer

The preferred office software