AAIR AI Risk Program Management Practice Test 6 — 15 Questions

Question 1

When designing an AI Risk Committee, which TWO of the following roles are essential for ensuring a holistic view of risk?

Accepted Answer

Chief Legal Counsel.. Option A, Chief Legal Counsel, is essential because this role supplies the legal and regulatory perspective on AI risk, covering compliance obligations, liability exposure, intellectual property, and data-protection statutes that a holistic risk view must incorporate. Option C, Lead Data Scientist, is essential because this role provides the technical perspective on model behavior, including data quality, bias, explainability, validation, and performance limitations that determine actual AI risk. Together these two roles balance legal/compliance governance with technical/algorithmic insight, which is exactly what a holistic AI Risk Committee requires. The unmarked options do not belong: the Office Assistant, Social Media Manager, and Facilities Manager address administrative, marketing, and physical-building concerns respectively, none of which provide the legal or technical risk expertise needed for AI risk oversight.

Answer

Office Assistant.

Answer

Social Media Manager.

Answer

Facilities Manager.

Question 2

Which THREE factors should be considered when assessing the 'Risk Level' of an AI application?

Accepted Answer

The sensitivity of the input data.. Option A is correct because the sensitivity of the input data directly determines the potential harm if that data is exposed or misused, so higher-sensitivity data (e.g., PII, health, biometric data) raises the assessed Risk Level. Option B is correct because the criticality of the automated decision-making process reflects how consequential errors or failures would be, and automating high-stakes decisions (e.g., credit, medical triage) elevates risk. Option D is correct because potential impact on human rights and individual safety is a core risk dimension in AI risk frameworks, capturing harms such as discrimination, loss of liberty, or physical injury. Option C does not belong because neural network architectural complexity is an implementation detail that does not by itself determine risk level. Option E does not belong because user interface color scheme is a cosmetic design choice with no bearing on AI risk assessment.

Answer

The complexity of the neural network architecture.

Answer

The color scheme of the user interface.

Question 3

Which TWO metrics are most appropriate for measuring the effectiveness of an AI Risk Program?

Accepted Answer

Total number of AI-related incidents reported and remediated.. Option D is correct because tracking the total number of AI-related incidents reported and remediated directly measures how well the AI Risk Program detects, responds to, and resolves real risk events, which is a core effectiveness indicator. Option E is correct because the percentage of AI models that have undergone a formal risk assessment measures the program's coverage and consistency in applying risk controls across the AI model inventory, reflecting proactive risk management maturity. Options A, B, and C are not appropriate because average data scientist salary, coffee machine count, and social media followers are unrelated to AI risk identification, assessment, mitigation, or governance outcomes and do not indicate program effectiveness.

Answer

The average salary of data scientists.

Answer

Number of coffee machines in the building.

Answer

Number of social media followers of the company.

Question 4

When implementing an AI Risk Management program, which THREE components are necessary for effective monitoring?

Accepted Answer

A mechanism for logging and auditing model outputs.. Option B is correct because effective AI risk monitoring requires a mechanism for logging and auditing model outputs, which provides traceability, supports incident investigation, and enables detection of anomalies or policy violations over time. Option D is correct because a process for human intervention or override ensures that when a model behaves unexpectedly or produces harmful outputs, a human can step in to halt, correct, or escalate the issue, which is a core control in AI risk frameworks. Option E is correct because automated real-time monitoring of model performance and drift detects degradation, data drift, and concept drift as they occur, allowing timely remediation before risks materialize. Option A does not belong because requiring all staff to undergo coding training is not a monitoring control and is irrelevant to observing model behavior. Option C does not belong because a daily newsletter about AI advancements is informational only and does not provide any monitoring, logging, or intervention capability.

Answer

A requirement that all staff undergo coding training.

Answer

A daily newsletter for employees about AI advancements.

Question 5

Which THREE actions should be taken when integrating AI risk into the broader ERM (Enterprise Risk Management) framework?

Accepted Answer

Establish aligned risk scoring criteria across all business functions.. Option B is correct because integrating AI risk into ERM requires a consistent, enterprise-wide risk scoring methodology so AI risks can be compared, aggregated, and prioritized alongside operational, financial, and compliance risks in the same register. Option D is correct because a shared risk taxonomy must be extended to capture AI-specific concepts such as model bias, data drift, hallucination, and model opacity; without common definitions, AI risks cannot be consistently identified, classified, or reported across functions. Option E is correct because AI risk owners must sit within the same governance and escalation channels (e.g., the same risk committee and reporting lines) as other risk owners, ensuring AI risk is not siloed and receives the same oversight, accountability, and board visibility as traditional risks. Option A does not belong because outsourcing all AI risk management removes internal ownership and accountability, which contradicts ERM principles of retained responsibility and integrated oversight. Option C does not belong because prohibiting every AI initiative with any inherent risk is an avoid-or-eliminate approach rather than risk-based management, and it would block innovation instead of treating, transferring, or accepting AI risk within defined tolerances.

Answer

Outsource all AI risk management to a third-party consultant.

Answer

Prohibit all AI initiatives that carry any inherent risk.

Question 6

Which TWO types of documentation are critical for AI Transparency requirements?

Accepted Answer

Data Sheets for Datasets explaining the provenance and makeup of training data.. Data Sheets for Datasets (A) are critical because AI transparency requires documenting the provenance, composition, collection methods, and preprocessing of training data so stakeholders can assess bias, consent, and suitability. Model Cards (B) are equally essential since they disclose a model's intended use, limitations, performance metrics across relevant subgroups, and ethical considerations, directly supporting transparency obligations. Together these artifacts give the technical and contextual information regulators and users need to understand how an AI system was built and how it should be used. The remaining options do not belong: a weekly meeting calendar (C) and an employee handbook (D) are general administrative documents unrelated to AI system transparency, and an office access list (E) concerns physical security, not AI documentation.

Answer

A weekly calendar of team meetings.

Answer

The employee handbook.

Answer

A list of all employees who have access to the office.

Question 7

Which TWO stakeholders are most important to engage when establishing an AI risk appetite?

Accepted Answer

The Board of Directors or Executive Committee.. The Board of Directors or Executive Committee (B) is essential because setting AI risk appetite is a governance responsibility — this body defines the organization's overall tolerance for risk, approves strategic direction, and holds ultimate accountability for AI-related decisions, so their engagement ensures the appetite aligns with corporate strategy and fiduciary duties. Legal and Compliance officers (D) are equally critical because they translate regulatory obligations (e.g., GDPR, EU AI Act, sector-specific rules), contractual duties, and ethical/legal constraints into concrete risk thresholds and controls, ensuring the stated appetite is lawful and enforceable. The building security personnel (A) focus on physical premises protection, not enterprise AI risk governance, so they are not key stakeholders here. The office cleaning staff (C) have no role in defining strategic risk tolerance. The company's social media followers (E) are external parties whose opinions may inform reputation considerations but who hold no governance authority over risk appetite.

Answer

The building security personnel.

Answer

The office cleaning staff.

Answer

The company's social media followers.

Question 8

When considering the 'Risk of Bias' in an AI system, which THREE components should be audited?

Accepted Answer

The post-processing decisions made on the model outputs.. Option B is correct because bias can be introduced or amplified after the model produces its raw outputs, so auditing post-processing decisions (such as thresholding, ranking, filtering, or business rules applied to scores) is essential to detect and mitigate discriminatory outcomes. Option C is correct because the composition and representativeness of the training dataset directly determine whether the model learns patterns that generalize fairly; auditing for sampling bias, label bias, and underrepresentation of protected groups is a core part of a Risk of Bias assessment. Option E is correct because the objective or loss function encodes what the model optimizes for, and a poorly chosen loss (for example, optimizing overall accuracy on imbalanced data) can systematically disadvantage certain groups, so it must be audited. Option A is not correct because the physical location of a cloud data center relates to data residency, sovereignty, or latency concerns, not to bias in model behavior. Option D is not correct because team break schedules have no bearing on algorithmic bias and are irrelevant to a Risk of Bias audit.

Answer

The physical location of the cloud data center.

Answer

The number of coffee breaks the data science team takes.

Question 9

Which TWO documents are essential to include in the AI Risk Project 'Review Pack'?

Accepted Answer

A detailed risk mitigation and action plan.. Option B, a detailed risk mitigation and action plan, is essential because the Review Pack must show how identified AI risks will be treated, including specific controls, owners, timelines, and residual-risk decisions that reviewers can evaluate. Option E, a comprehensive AI Risk Assessment report, is essential because it provides the core evidence of risk identification, analysis, and evaluation, such as model purpose, data sources, affected stakeholders, likelihood/impact ratings, and inherent risk levels. Together, B and E give the Review Pack both the assessment basis and the remediation roadmap needed for governance sign-off. The unmarked options do not belong: A (team lunch schedule) and D (company lease agreement) are unrelated administrative documents, and C (list of all software installed on company laptops) is an IT asset inventory that, while potentially useful elsewhere, is not one of the two essential AI risk review documents in this scenario.

Answer

A summary of the team's lunch schedule.

Answer

A list of all software installed on company laptops.

Answer

A copy of the company's lease agreement.

Question 10

You are the AI risk lead at a health insurer. A vendor-supplied claims-triage model that scores prior-authorization requests is scheduled to go live in 30 days. Internal audit asks how the organization will detect silent performance drift once the model is operating, given that the vendor will not expose training data or model weights. Which control is MOST appropriate to establish before go-live?

Accepted Answer

Implement ongoing monitoring of input feature distributions and output score distributions against validated baselines, with alert thresholds and periodic outcomes reconciliation.. Because the vendor withholds training data and model weights, the insurer cannot rely on internal inspection or retraining. The practical control is behavioral: capture validation baselines for input features and output scores, monitor live distributions against those baselines with defined alert thresholds, and periodically reconcile scores against actual prior-authorization outcomes. This detects degradation early and produces auditable evidence, while the other choices address security assurance, manual decision review, or model development rather than drift detection.

Answer

Obtain a SOC 2 Type II report from the vendor and rely on it as evidence that model behavior remains stable.

Answer

Require the vendor to retrain the model monthly on the insurer's own claims data.

Answer

Add a human reviewer to approve every model score before the prior-authorization decision is issued.

Question 11

A retail bank's AI risk committee is defining how third-party foundation model providers should be governed across 40 planned use cases. Legal notes that several providers reserve the right to change model versions with limited notice, and business units want to avoid re-approval delays for every update. Which approach BEST balances risk oversight with delivery speed?

Accepted Answer

Tier use cases by risk and data sensitivity, define pre-approved model versions and change classes per tier, and require impact assessment plus escalation only when a change crosses defined thresholds.. The bank needs governance that is proportionate and fast. Tiering use cases by risk and data sensitivity, pre-approving specific model versions and classes of change, and escalating only when a change crosses defined thresholds gives the committee control over material risk while letting low-impact updates proceed. This answers the vendor's limited-notice practice with pre-defined acceptance criteria, rather than serial re-approval or reliance on contracts alone.

Answer

Delegate all provider oversight to procurement and rely on contractual terms as the primary risk control.

Answer

Standardize on a single foundation model provider to reduce the number of version-change events the committee must review.

Answer

Require full AI risk committee re-approval for every provider model version change before any production use.

Question 12

You are the AI risk lead at a mid-sized insurer. The Chief Risk Officer asks you to establish a formal AI risk taxonomy that will be used consistently across all business units for identifying, assessing, and reporting AI risks. Which action best ensures the taxonomy will be adopted and remain useful over time?

Accepted Answer

Map the taxonomy to the enterprise risk management framework and existing risk register categories, then pilot it with two business units before enterprise rollout.. A durable AI risk taxonomy must integrate with existing ERM structures so risks can be aggregated and compared across the enterprise. Piloting with a subset of business units validates the categories against real AI use cases and generates feedback before broad rollout. This combination of alignment and iterative validation is what drives sustained adoption and keeps the taxonomy relevant as AI use evolves.

Answer

Delegate taxonomy design entirely to the data science team, since they understand AI models best and can define the risks most accurately.

Answer

Draft the taxonomy with only legal and compliance input, then publish it as a mandatory standard to all business units to ensure regulatory alignment.

Answer

Adopt the risk categories directly from a leading industry publication without modification, since external benchmarks carry more credibility than internal design.

Question 13

A global bank's AI risk committee is defining key risk indicators (KRIs) for its portfolio of customer-facing AI systems. The committee wants KRIs that provide early warning of emerging risk rather than lagging confirmation of past failures. Which KRI design best meets this objective?

Accepted Answer

Percentage of AI models whose input data drift exceeds a defined threshold over a rolling 30-day window.. Leading KRIs measure conditions that precede adverse outcomes, giving the committee time to intervene. Input data drift beyond a defined threshold is detectable before model outputs degrade, before customers are harmed, and before regulators take notice. By tracking the proportion of models breaching the drift threshold over a rolling window, the committee gains a forward-looking signal that can trigger retraining, rollback, or heightened oversight.

Answer

Aggregate spend on AI risk remediation activities compared with the annual budget.

Answer

Number of confirmed regulatory findings related to AI systems in the past quarter.

Answer

Total count of AI-related customer complaints resolved by the service desk each month.

Question 14

A hospital network deploys a clinical decision support model that recommends sepsis protocols. During a risk assessment, the AI risk manager identifies that clinicians frequently override the model's recommendations when they conflict with bedside judgment. Which risk treatment strategy is most appropriate for this situation?

Accepted Answer

Mitigate the risk by analyzing override patterns to determine whether they reflect model performance gaps, then recalibrate the model and refine alert thresholds.. Frequent overrides are diagnostic evidence, not an end state. Investigating override patterns can distinguish legitimate clinical judgment from model miscalibration, subgroup bias, or alert fatigue. Recalibrating the model and refining thresholds addresses the root cause directly, improving alignment between recommendations and clinical practice while retaining the safety net of clinician discretion that the hospital already relies on.

Answer

Accept the risk because clinician overrides demonstrate that human oversight is functioning as designed.

Answer

Avoid the risk by disabling the model entirely and reverting to manual sepsis screening protocols.

Answer

Transfer the risk by purchasing additional medical malpractice insurance coverage for AI-assisted decisions.

Question 15

A fintech company is preparing its annual AI risk report for the board. The Chief Risk Officer wants the report to demonstrate that the AI risk program is operating effectively, not merely listing AI use cases. Which two elements most directly provide evidence of an effective operating AI risk program? (Choose two.)

Accepted Answer

Documented remediation actions and closure rates for issues raised by AI risk assessments and incident reviews.. Evidence of an operating program comes from artifacts that change over time in response to activity. A live AI inventory with tiers, owners, and assessment dates proves continuous identification and accountability, while remediation tracking with closure rates proves that findings translate into corrective action. Together they show the program detects, assigns, and resolves AI risk, which is what the board needs to judge effectiveness.

Answer

The total number of employees who have completed general security awareness training.

Answer

A summary of the AI risk team's organizational chart and reporting lines.

Answer

A list of AI vendor logos and product names used across the organization.