AI Governance And Program Management

A company is adopting the ISO/IEC 42001 AI management system standard. What is the primary purpose of the 'Context of the Organization' clause?

When drafting an AI policy, how should the organization address 'Human-in-the-Loop' (HITL) requirements?

A multinational bank is deploying a proprietary LLM. Which approach provides the most robust assurance for model supply chain security?

An AI security program manager is assessing AI risks. Which tool provides the most centralized oversight for AI model compliance?

When establishing an AI steering committee, which reporting cadence is most effective for ensuring board-level oversight of residual AI risk?

An enterprise is defining its 'AI System Inventory'. Which metadata attribute is most critical for assessing legal and regulatory risk?

An AI security manager is implementing an AI governance framework using the NIST AI RMF. Which action best demonstrates the 'Govern' function for a new generative AI deployment?

Which metric is most appropriate for reporting the 'AI Security Posture' to the board?

What is the primary role of an 'AI Ethics Board' in an organization's governance structure?

In the context of the EU AI Act, what is the 'Provider's' obligation regarding conformity assessments for high-risk AI systems?

Which document should define the organization's stance on AI transparency and explainability?

How should an organization classify AI systems for governance?

When managing shadow AI, which strategy is most effective at the enterprise level?

An AI security lead is configuring a 'Model Risk Management' (MRM) framework. What is the main objective of a 'Model Validation' report?

When assessing a third-party AI provider, which document is most essential for due diligence?

An AI project is failing to meet its security requirements. Which governance process should be triggered to address this?

Which mechanism best ensures 'Auditability' of AI decision-making?

Who is ultimately responsible for the outcomes of an AI system deployed by a business unit?

What is the benefit of 'AI Model Watermarking' for governance?

Which phase of the AI Lifecycle is most critical for 'Bias Detection'?

An organization is using RAG (Retrieval-Augmented Generation). What is the primary governance concern for the retrieved documents?

When onboarding an AI startup vendor, what is the best strategy to manage 'Model Drift'?

A company is performing an 'AI Impact Assessment' (AIA). Which domain is the most critical for identifying 'Privacy' risks?

Which team should lead the definition of 'AI Acceptable Use' policies?

Which activity is part of 'Ongoing AI Monitoring'?

Which scenario best illustrates an 'AI Security Incident'?

When evaluating AI 'Bias', which concept must be governed first?

What is the goal of an 'AI Security Awareness Program'?

Which control is most effective against 'Prompt Injection' attacks?

When conducting an AI audit, what should be the primary focus of the 'Data Governance' review?

An organization is implementing 'Red Teaming' for AI. What is the main governance objective?

What is the primary role of 'Model Versioning' in AI governance?

What does 'Model Explainability' (XAI) primarily support in governance?

When a model fails in production, what is the first step in the 'Incident Response' process?

Which document outlines the 'Roles and Responsibilities' for AI security?

Which metric should be used to track 'Data Quality' for AI training?

A company is developing an internal LLM-based tool. Which activity is required for 'Accountability'?

What is the primary function of an 'AI Steering Committee'?

What is 'AI Risk Appetite'?

What is the primary risk associated with 'Data Poisoning' in an AI governance program?

How does 'Continuous Monitoring' differ from 'Point-in-Time Auditing'?

Which department should own the 'AI Ethics Policy'?

Which TWO factors are critical when assessing the risk of a new Generative AI use case?

Which THREE actions should be included in an AI incident response plan?

Which TWO areas should be covered by an AI procurement policy?

Which THREE metrics should be monitored for 'Model Performance' and security?

Which TWO components are essential for a robust AI Governance framework?

Which THREE security controls are effective against 'Data Leakage' in AI?

Which THREE documents are vital for an AI audit trail?

Which TWO activities ensure 'AI Safety' in development?

Which THREE factors increase 'AI Model Risk'?

Which TWO aspects of 'Transparency' are most important for AI stakeholders?

Which TWO reporting formats are effective for executive AI oversight?

Which THREE items should be included in an 'AI Inventory'?

Which TWO aspects of 'Compliance' must be addressed by an AI governance program?

Which THREE activities help manage 'AI Lifecycle' risk?

Which TWO strategies are recommended for 'Human-in-the-Loop' governance?

A security manager is integrating AI governance into the existing NIST AI RMF framework. Which action best ensures alignment between AI security controls and business risk appetite?

A board of directors requests a summary of AI risk exposure. Which metric provides the most relevant insight into AI security program maturity?

An AI security team needs to ensure that internal AI tools comply with the organization's 'Human-in-the-Loop' policy. Which architectural control best enforces this governance requirement?

When designing a secure AI development lifecycle (SDLC), which of the following is an essential governance activity during the 'Model Deployment' phase?

A firm is drafting a policy for 'AI Use in Marketing'. Which element is most important to include to ensure alignment with existing data protection regulations?

During an internal audit of the AI program, it is found that the organization lacks a 'Model Inventory'. What is the most immediate risk to the AI security program?

Which THREE activities should be included in an AI Security Governance Program to effectively manage model supply chain risks?

Which THREE factors are critical when establishing an AI risk reporting structure for executive leadership?

An organization is updating its AI governance policy for high-risk systems. Which TWO requirements should be mandated to ensure accountability and forensic capability?

A multinational bank has deployed an AI governance program aligned with the NIST AI Risk Management Framework. The Chief Risk Officer asks how to ensure that AI risks are consistently identified, assessed, and treated across all business units. Which structural element is most critical for achieving this consistency?

A healthcare organization has an AI governance policy that requires all AI systems to undergo a pre-deployment risk assessment. A data science team is eager to deploy a new diagnostic model and argues that the assessment will delay a critical clinical trial. As the AI governance lead, which action best upholds the governance program while addressing the team's urgency?

A multinational financial services firm has deployed a generative AI assistant for its customer support agents. The AI governance committee has approved the tool, but the Chief Information Security Officer is concerned that the firm cannot demonstrate to regulators that the AI's outputs are being monitored for harmful or biased content on an ongoing basis. Which of the following is the MOST appropriate control to address this concern?

A global retailer is expanding its AI governance program to include third-party AI vendors. The Chief AI Officer wants to ensure that vendor-provided AI systems are subject to the same risk management rigor as internally developed models. Which TWO activities should be prioritized to integrate third-party AI into the governance framework? (Choose two.)

A multinational bank's AI governance committee is drafting its charter. The General Counsel insists that the charter explicitly state who bears ultimate responsibility for the organization's AI-related legal and regulatory outcomes, and that this be documented and approved at the highest level. Which element of the AI governance charter is the General Counsel requiring?

A global retailer's AI program office is defining how AI risks will be escalated. The Chief Risk Officer wants assurance that a severe AI incident, such as a customer-facing model producing discriminatory pricing, reaches executive leadership within hours rather than days. Which element of the AI risk reporting structure is most critical to meet this requirement?

A healthcare organization is deploying an AI system to triage patient symptoms. The AI governance committee is reviewing the program's compliance with the organization's AI ethics principles. Which of the following is the MOST effective way to ensure that the AI system's decisions are explainable to clinicians and patients?

A technology company has developed an AI model for autonomous decision-making in its supply chain. The AI governance team is tasked with establishing a process for continuous monitoring of the model's performance and risk. Which of the following is the MOST critical element to include in the monitoring process to detect model drift?

A healthcare insurer is standing up an AI governance program and must decide which structural components to include in its governance framework to ensure AI systems are developed and operated consistently across business units. (Choose two.)

An enterprise has deployed a third-party AI-powered hiring screening tool. The vendor recently updated its model, and the organization's HR team was not notified beforehand. The AI governance committee needs to ensure that such changes are managed consistently going forward. Which action should the committee take FIRST?

An enterprise AI governance committee is defining a policy for generative AI tools used by employees. The CISO wants to ensure that any AI-generated content that is published externally or used in decision-making is reviewed by a human before release. Which governance control should be formally documented to enforce this requirement across all business units?

An organization is establishing an AI governance program. The Chief Executive Officer asks the AI governance lead to define the program's scope. Which of the following should be the PRIMARY focus when defining the scope of AI governance?

A software company is rolling out an AI governance training program. The Chief Information Security Officer wants to ensure that all employees who build, deploy, or use AI systems understand the organization's expectations for responsible behavior, including prohibited uses. Which governance activity most directly establishes these expectations for the workforce?

A global bank's AI governance program is being audited. The auditors find that the bank has a robust AI risk assessment process for new models, but no mechanism to monitor risks that emerge after deployment, such as data drift or changing regulatory requirements. Which control should the governance team implement to address this gap?

A multinational bank's AI governance lead is mapping AI systems to regulatory obligations across jurisdictions. The bank uses a single credit-scoring model that is trained in the EU, deployed in the US and Singapore, and fine-tuned locally. Which governance artifact is most critical to maintain so the bank can demonstrate compliance with differing regional AI regulations?

A telecommunications provider has completed its first AI governance maturity assessment. Leadership wants to move from ad hoc AI oversight to a repeatable, enterprise-wide program that can demonstrate continuous improvement to the board. Which action best advances the program toward that goal?

An organization's AI governance committee is revising its AI risk taxonomy. The Chief Risk Officer wants to ensure that risks arising from third-party foundation model APIs are captured distinctly from risks of internally developed models. Which change to the taxonomy best achieves this?

A retail company's board has approved an AI governance charter. The Chief AI Officer must now establish a mechanism to ensure that AI risks are escalated to the board when they exceed defined thresholds. Which element is most essential for this escalation mechanism to function effectively?

A multinational corporation is establishing an AI governance board. The board's charter must define its responsibilities for overseeing AI risks across the enterprise. Which TWO responsibilities are most critical for the board to own? (Choose two.)

A multinational bank's AI governance committee is drafting its first enterprise AI policy. The CISO asks how the policy should address third-party foundation models that are accessed via API but not fine-tuned or hosted internally. Which approach BEST aligns with ISACA AI governance principles?

A financial services firm has deployed an AI governance framework with a central AI risk committee. Business units complain that the committee is a bottleneck, delaying low-risk AI pilots by weeks. The Chief AI Officer wants to maintain oversight while accelerating delivery. Which governance design change best addresses this?

A global bank has deployed a generative AI assistant to its wealth management advisors. The AI security manager must establish an oversight process that ensures the model's outputs remain aligned with the bank's risk appetite as market conditions and regulations evolve. Which ongoing activity should be the PRIMARY mechanism for this alignment?

A healthcare organization uses an AI system to prioritize patient follow-up calls. The system was trained on historical data that underrepresented certain demographic groups. The governance team wants to implement a control that detects and mitigates bias in the model's outputs on an ongoing basis. Which approach is most effective?

A healthcare provider is deploying an AI triage tool that recommends patient priority in the emergency department. The governance committee wants to ensure that the tool's decisions can be explained to clinicians and regulators. Which practice best supports this requirement?

A healthcare insurer deploys an AI model to prioritize prior-authorization requests. During post-deployment monitoring, the AI governance lead discovers the model's denial rate for one demographic group is materially higher than for others, though overall accuracy meets the target. Which action should the governance lead take FIRST?

An AI governance lead is drafting the organization's AI policy hierarchy. The board has approved a high-level AI principles statement. The lead now needs a document that translates those principles into mandatory, auditable requirements that apply to all AI systems, including those built by third parties on the organization's behalf. Which document type best fits this need?

A healthcare insurer is integrating a third-party AI diagnostic triage tool into its claims processing workflow. The AI security manager must ensure the vendor's model updates do not introduce new risks without the insurer's knowledge. Which contractual and technical control is MOST effective for this purpose?

A global manufacturer is standing up an AI governance program and must assign accountability for AI risks across the enterprise. The Chief Risk Officer wants to ensure that accountability is clearly allocated for both model development and ongoing operation. Which TWO structural elements are most essential to establish this accountability? (Choose two.)

A retail company's AI governance policy requires that all AI systems undergo a risk assessment before deployment. A business unit wants to deploy a chatbot for customer service that uses a large language model (LLM) from a public API. The business unit argues that because the LLM is pre-trained and hosted externally, a full risk assessment is unnecessary. What should the governance team do?

A retail company's board asks the CISO to explain how AI risk appetite is translated into operational limits. The CISO proposes a tiered control model based on use-case criticality. Which element is MOST essential for the board to approve to make the tiered model enforceable?

A global bank's AI governance committee is drafting its first enterprise AI policy. The CISO argues that a single 'AI Security Policy' owned by security is sufficient because most AI risk is security risk. The Chief Data Officer counters that the program needs a governing body with cross-functional authority. Which action best establishes durable AI governance accountability for the enterprise?

A multinational retailer is expanding its AI governance program to cover AI systems developed by its regional subsidiaries. The central AI governance office wants to ensure that subsidiary-developed AI systems are consistently registered, risk-assessed, and monitored. Which two governance mechanisms best achieve this consistency? (Choose two.)

A retail company's AI governance committee is drafting a policy for employee use of public generative AI tools. The Chief Information Security Officer wants to ensure the policy addresses the most significant risk of data leakage. Which policy element is MOST directly aimed at preventing sensitive corporate data from being exposed through these tools?

A global manufacturer is standing up an AI governance committee. The CISO wants to ensure the committee can make defensible decisions about high-risk AI deployments. Which TWO responsibilities are MOST essential for this committee to own directly? (Choose two.)

A healthcare insurer has deployed an AI claims-triage model. Six months after launch, the model's denial rate for one demographic has drifted upward while overall accuracy remains stable. The AI program manager needs to detect and respond to this issue as part of ongoing AI governance. Which control is most appropriate?

An organization's AI governance office is defining the responsibilities of the first-line, second-line, and third-line functions for AI risk. A newly hired AI risk manager asks which function should independently assess whether the AI governance framework is designed and operating effectively. Which function is responsible?

A manufacturing firm uses an AI system to prioritize maintenance tasks. The AI governance lead must ensure that the system's decisions can be explained to regulators and affected employees. Which action BEST supports this requirement?

A retail company is standing up an AI governance program and must define how AI risk appetite will be expressed and operationalized across the enterprise. Which TWO elements are necessary to translate an executive AI risk appetite statement into day-to-day governance? (Choose two.)

A software company's AI governance team is defining metrics to report to the board quarterly. The board wants assurance that AI risks are being managed, not just a list of models deployed. Which metric set BEST supports that objective?

A multinational corporation is establishing an AI governance program. The board has asked the AI security manager to identify the essential components that must be in place to ensure the program can enforce accountability across business units. (Choose two.)

A manufacturing firm's AI governance lead is designing the enterprise AI policy hierarchy. The board has approved a high-level AI principles statement. Business units now need actionable rules for selecting and deploying vendors that supply AI-enabled equipment. Which artifact should the governance lead create next?

A telecommunications company operates AI systems in twelve countries. Its AI governance committee must design a control testing program that provides assurance to the board that AI controls are operating effectively. The committee wants testing that is independent of the teams building and running the models. Which approach best meets this objective?

A financial services firm's AI governance committee is establishing an enterprise-wide AI risk register. The CISO insists that every AI system be assigned a single residual risk rating at deployment so that systems can be ranked and remediation budgets allocated. During a pilot, a credit-scoring model was rated 'medium' residual risk, but six months later it was found to be making materially biased decisions for a protected class after a subtle drift in borrower behavior. Which governance approach BEST addresses this failure while preserving the committee's ability to rank systems?

A financial services firm's AI governance committee is reviewing a new generative AI tool that creates personalized investment advice. The CISO asks the AI security manager to define accountability for the tool's outputs. According to ISACA's AI governance principles, who should ultimately be accountable for the ethical and secure use of the AI system?

A retail company is deploying an AI-based customer sentiment analysis tool across its social media channels. The AI governance lead needs to ensure that the tool's data collection and processing comply with the organization's AI policy. Which document should the lead reference first to understand the organization's approved AI risk tolerance and control requirements?

A global logistics company uses an AI system to optimize delivery routes. The AI governance committee is concerned that the system's decisions may inadvertently favor certain regions due to historical data biases. Which governance mechanism is MOST effective for continuously monitoring and mitigating this risk throughout the AI lifecycle?

A multinational bank is establishing an AI governance program. The board asks the AI security manager to identify the key elements that must be included in the program's charter to ensure effective oversight. Which TWO elements are essential for the AI governance charter? (Choose two.)

A technology company's AI governance team is reviewing its AI incident response plan. A recent incident involved an AI model that generated offensive language in customer interactions. The team wants to ensure future incidents are handled consistently. Which governance artifact should define the steps for detecting, reporting, and remediating AI-related incidents?