AAIR AI Risk Program Management — Timed 10 Questions

Question 1

Which THREE metrics should be tracked to assess the 'Risk' of an AI model in production?

Accepted Answer

Model accuracy/error rate. Model accuracy/error rate (A) is a core risk metric because it directly quantifies how often the model produces incorrect outputs, which drives business, safety, and compliance exposure in production. Model latency (D) matters for risk because slow response times can violate SLAs, degrade user experience, and cause downstream failures in real-time or automated decision systems. Data drift (E) is essential because shifts between production input distributions and training data can silently degrade model reliability and validity, increasing the likelihood of harmful or non-compliant predictions. The unmarked options do not belong: the brand of the coffee machine (B) and the number of employees in the break room (C) are irrelevant workplace trivia with no bearing on AI model risk.

Answer

The brand of the coffee machine

Answer

The number of employees in the break room

Question 2

Which TWO actions are required to manage 'Third-Party' AI risks?

Accepted Answer

Performing due diligence on the vendor's AI risk practices. Option A is correct because managing third-party AI risk begins with due diligence: you must assess the vendor's AI governance, model training data provenance, bias testing, security controls, and compliance with frameworks such as ISO/IEC 42001 or the NIST AI RMF before onboarding or renewing the relationship. Option E is correct because a signed NDA is a contractual control that legally binds the vendor to confidentiality, protecting proprietary data, model inputs, and any sensitive information shared during the AI engagement. The remaining options do not belong: ignoring vendor feedback (B) removes a key input for continuous risk monitoring, letting the vendor set their own rules (C) abandons organizational oversight and accountability, and asking for a cafeteria menu (D) is irrelevant to AI risk management.

Answer

Ignoring the vendor's feedback

Answer

Allowing the vendor to set their own rules

Answer

Asking the vendor for their cafeteria menu

Question 3

Which TWO teams should define the 'Risk Appetite' for a new AI project?

Accepted Answer

Senior Leadership/Business Owners. Option A (Senior Leadership/Business Owners) is correct because risk appetite is a strategic decision about how much uncertainty and potential loss the organization is willing to accept in pursuit of the AI project's objectives, and only those accountable for business outcomes have the authority to set that threshold. Option B (The Risk Management/Compliance Office) is correct because this function translates leadership's tolerance into measurable risk limits, ensures alignment with regulatory and ethical obligations, and provides the governance framework for monitoring AI risks. Options C, D, and E are incorrect because a weather station, landscaping team, and company mascot have no governance authority, fiduciary responsibility, or risk oversight role in defining an AI project's risk appetite.

Answer

The local weather station

Answer

The office landscaping team

Answer

The company's mascot

Question 4

Your organization is experiencing 'AI Shadow IT'. What management action is most effective for bringing these initiatives into the Risk Program?

Accepted Answer

Implement a mandatory AI project registration and intake assessment process.. Visibility is the foundation of risk management. Implementing a centralized intake process forces shadow initiatives to be assessed.

Answer

Conduct a one-time audit of all network traffic.

Answer

Restrict all internet access to AI platforms.

Answer

Require managers to sign a liability waiver for their own AI projects.

Answer

multiple_choice

Question 5

When setting KPIs for an AI risk program, which metric is a leading indicator of potential model bias?

Accepted Answer

Demographic parity ratio in training data samples. Demographic parity ratio in training data samples is a leading indicator because it measures the representation of protected groups before the model is deployed. A skewed ratio (e.g., far from 1.0) signals that the model may learn biased patterns, allowing proactive mitigation. Unlike lagging metrics such as complaints, it provides early warning during data collection and preprocessing.

Answer

Average model inference latency

Answer

Percentage of customer complaints regarding AI decisions

Answer

Number of model updates per quarter

Question 6

An organization is establishing an AI governance framework. Which approach is most effective for aligning AI risk appetite with enterprise-wide risk management (ERM)?

Accepted Answer

Map AI-specific risk metrics to existing enterprise risk categories like operational, financial, and reputational risk.. Mapping AI-specific risk metrics to existing enterprise risk categories (operational, financial, reputational) integrates AI risk into ERM rather than treating it as a silo. This lets the organization express AI risk appetite in the same language and scales used for other risks, enabling consistent aggregation, reporting, and board-level oversight. It is the approach most aligned with COSO ERM and ISO 31000 integration principles.

Answer

Establish a top-down mandate that ignores business unit input to ensure uniformity.

Answer

Focus solely on technical model performance metrics to define the organizational risk appetite.

Answer

Create a separate AI-specific risk register that operates independently of the corporate risk register.

Question 7

The AI Risk Governance Committee is defining the risk appetite for a new generative AI chatbot. Which THREE factors must be considered to align with organizational risk tolerance?

Accepted Answer

Data privacy and residency requirements for training sets. Option B is correct because data privacy and residency requirements directly shape risk appetite: regulations like GDPR, HIPAA, or data-localization laws determine what training data may be used and where it can be stored, which bounds the acceptable risk for the chatbot. Option C is correct because model drift is a core AI risk factor — as data distributions shift, output accuracy degrades, so the committee must weigh the likelihood of drift against the organization's tolerance for degraded performance. Option D is correct because hallucination is a generative-AI-specific risk whose potential impact on brand reputation and customer trust must be assessed against the organization's risk tolerance. Option A is not a risk-appetite factor; sprint cadence is a delivery-process metric, not a measure of AI risk exposure. Option E is also not a risk-tolerance factor; GPU infrastructure cost is a budgeting concern, not a determinant of acceptable risk.

Answer

The speed of the development team's sprint cycles

Answer

The total cost of GPU infrastructure

Question 8

A firm is using the NIST AI Risk Management Framework to document its AI risk program. Which approach best ensures that AI risk metrics are dynamic?

Accepted Answer

Integrating model performance metrics into operational dashboards. Integrating model performance metrics into operational dashboards ensures that AI risk metrics are dynamic, as they are continuously updated and monitored in real time. This allows for timely detection of drift, bias, or degradation. Annual assessments and static thresholds are not dynamic.

Answer

Conducting annual risk assessments

Answer

Setting static thresholds for model accuracy

Answer

Limiting AI deployment to offline systems

Question 9

An enterprise is establishing its AI Governance Committee. Which stakeholder is most critical to include to ensure alignment between AI technical capabilities and the organization's enterprise risk appetite?

Accepted Answer

Chief Risk Officer. The Chief Risk Officer (CRO) owns the enterprise risk appetite and framework, so including the CRO ensures AI risks are calibrated to the organization's overall risk tolerance rather than treated as a standalone technical concern. The CRO can translate AI-specific risks (bias, model drift, regulatory exposure) into the enterprise risk taxonomy and ensure governance decisions align with board-approved risk limits. This alignment is the committee's core purpose, making the CRO the most critical stakeholder.

Answer

Head of Legal

Answer

Chief Information Security Officer

Answer

Lead Data Scientist

Question 10

A cross-functional committee is evaluating the deployment of a high-impact AI model. Which TWO factors are critical to include in the initial AI risk assessment to ensure comprehensive coverage?

Accepted Answer

The socio-technical implications and potential impact on protected groups.. Option B is correct because a comprehensive AI risk assessment must evaluate socio-technical implications, including how the model's deployment could disproportionately affect protected groups (e.g., by race, gender, age, or disability), which is central to fairness, equity, and regulatory compliance concerns such as those in the EU AI Act and NIST AI RMF. Option C is correct because understanding training data lineage—provenance, collection methods, and embedded bias sources—is essential to identifying data-driven risks like historical bias, sampling bias, and label bias that propagate into model outputs. Options A, D, and E are not critical initial risk-assessment factors: patching frequency (A) is a general infrastructure hygiene concern, the vendor name (D) is a procurement detail rather than a risk dimension, and the programming language (E) is an implementation choice that does not materially affect AI risk exposure.

Answer

The frequency of software patching for the underlying cloud infrastructure.

Answer

The name of the vendor providing the cloud compute resources.

Answer

The specific programming language used for the model development.