AAISM AI Governance And Program Management — 20 Questions

Question 1

A company is adopting the ISO/IEC 42001 AI management system standard. What is the primary purpose of the 'Context of the Organization' clause?

Accepted Answer

To define the boundaries and strategic intent of the AI management system.. This clause requires the organization to identify internal and external issues, stakeholder requirements, and the scope of the AIMS.

Answer

To specify hardware requirements for training.

Answer

To mandate the use of cloud-based AI services.

Answer

To identify all bugs in the production code.

Question 2

When drafting an AI policy, how should the organization address 'Human-in-the-Loop' (HITL) requirements?

Accepted Answer

Mandate HITL for high-impact or sensitive decision-making processes.. Policy must clearly define decision-making thresholds where automated systems require human intervention to mitigate high-impact risks.

Answer

Require HITL for every single AI inference.

Answer

Delegate HITL requirements to the software development team.

Answer

Exclude HITL to maximize system throughput.

Question 3

A multinational bank is deploying a proprietary LLM. Which approach provides the most robust assurance for model supply chain security?

Accepted Answer

Implementing an AI Software Bill of Materials (SBOM).. Software Bill of Materials (SBOM) for AI components is the industry standard for tracking dependencies and vulnerabilities in the AI lifecycle.

Answer

Scanning all model weights using antivirus.

Answer

Reviewing the vendor's marketing brochure.

Answer

Limiting model access via VPN.

Question 4

An AI security program manager is assessing AI risks. Which tool provides the most centralized oversight for AI model compliance?

Accepted Answer

An enterprise GRC platform with AI modules.. A GRC (Governance, Risk, and Compliance) platform configured for AI enables systematic tracking of risks and policy adherence.

Answer

A local Python script for model testing.

Answer

A public open-source project management board.

Answer

A standard spreadsheet file.

Question 5

When establishing an AI steering committee, which reporting cadence is most effective for ensuring board-level oversight of residual AI risk?

Accepted Answer

Quarterly strategic risk and compliance assessments.. Quarterly reporting aligns with standard enterprise risk management cadences for high-impact emerging technologies.

Answer

Weekly technical incident logs.

Answer

Annual compliance attestation only.

Answer

Real-time dashboard access for all directors.

Question 6

An enterprise is defining its 'AI System Inventory'. Which metadata attribute is most critical for assessing legal and regulatory risk?

Accepted Answer

Training data source and provenance.. Data origin and provenance are critical for determining compliance with GDPR, AI Act, and intellectual property requirements.

Answer

Hardware acceleration type.

Answer

Inference latency in milliseconds.

Answer

Model training compute cost.

Question 7

An AI security manager is implementing an AI governance framework using the NIST AI RMF. Which action best demonstrates the 'Govern' function for a new generative AI deployment?

Accepted Answer

Defining roles, responsibilities, and accountability for AI system outcomes.. The 'Govern' function focuses on establishing a culture of risk management, accountability, and organizational processes to manage AI risks.

Answer

Configuring API rate limits in the AI gateway.

Answer

Conducting a red-teaming exercise for prompt injection.

Answer

Performing automated unit testing on model outputs.

Question 8

Which metric is most appropriate for reporting the 'AI Security Posture' to the board?

Accepted Answer

Percentage of AI systems with completed risk assessments.. Percentage of models with completed risk assessments provides a clear indicator of governance coverage across the enterprise.

Answer

Number of GPU hours consumed.

Answer

Average model inference accuracy.

Answer

Total number of model versions created.

Question 9

What is the primary role of an 'AI Ethics Board' in an organization's governance structure?

Accepted Answer

Reviewing AI use cases against organizational values and principles.. Ethics boards provide guidance on moral and societal implications beyond legal compliance, ensuring alignment with organizational values.

Answer

Directing daily stock market trades.

Answer

Conducting server hardware maintenance.

Answer

Writing all the Python code for the AI.

Question 10

In the context of the EU AI Act, what is the 'Provider's' obligation regarding conformity assessments for high-risk AI systems?

Accepted Answer

Ensuring conformity assessment and compliance with technical standards.. Providers must ensure their systems undergo a conformity assessment and bear the CE marking before market entry.

Answer

Self-assessment is prohibited for all high-risk systems.

Answer

Providing a written promise of security.

Answer

Delegating all compliance to the system deployer.

Question 11

Which document should define the organization's stance on AI transparency and explainability?

Accepted Answer

The Corporate AI Policy.. The AI Policy is the foundational document that sets the requirements for transparency, accountability, and explainability across the enterprise.

Answer

The employee breakroom notice.

Answer

The server configuration log.

Answer

The marketing brochure.

Question 12

How should an organization classify AI systems for governance?

Accepted Answer

By the potential impact on safety, privacy, and business operations.. Risk-based classification (e.g., low, medium, high) allows the organization to allocate resources proportional to potential impact.

Answer

By the programming language used.

Answer

By the number of developers assigned.

Answer

By the date of deployment.

Question 13

When managing shadow AI, which strategy is most effective at the enterprise level?

Accepted Answer

Implementing AI-aware API discovery and CASB solutions.. A 'detect and onboard' approach using API discovery tools helps identify and bring unauthorized AI into the managed governance lifecycle.

Answer

Disabling all network access to the internet.

Answer

Ignoring the usage until a breach occurs.

Answer

Sending disciplinary emails to all employees.

Question 14

An AI security lead is configuring a 'Model Risk Management' (MRM) framework. What is the main objective of a 'Model Validation' report?

Accepted Answer

To provide independent verification of model performance and risk mitigation effectiveness.. Validation provides independent verification that the model performs as expected within its defined scope and limitations.

Answer

To market the model to external customers.

Answer

To reduce the model development time.

Answer

To guarantee 100% accuracy in all scenarios.

Question 15

When assessing a third-party AI provider, which document is most essential for due diligence?

Accepted Answer

A SOC 2 Type II audit report.. The System and Organization Controls (SOC) 2 Type II report provides independent assurance of the vendor's security and privacy controls.

Answer

A public press release.

Answer

A standard company invoice.

Answer

The employee directory.

Question 16

An AI project is failing to meet its security requirements. Which governance process should be triggered to address this?

Accepted Answer

Risk acceptance or remediation plan initiation.. The AI Risk Acceptance or Remediation process ensures that management formally decides whether to fix the issue or accept the risk, documenting the decision.

Answer

Re-training the model without a review.

Answer

Immediate deletion of all data.

Answer

Ignoring the policy until the end of the year.

Question 17

Which mechanism best ensures 'Auditability' of AI decision-making?

Accepted Answer

Maintaining immutable logs of inputs, model versions, and outputs.. Comprehensive logging of inputs, model parameters, and outputs is essential to recreate and audit decisions.

Answer

Deleting logs after 24 hours.

Answer

Using proprietary black-box models only.

Answer

Hardcoding all decisions.

Question 18

Who is ultimately responsible for the outcomes of an AI system deployed by a business unit?

Accepted Answer

The Business Unit Leader.. The Business Owner or designated executive holds accountability for the system's performance, risk, and compliance.

Answer

The Cloud Service Provider.

Answer

The external auditor.

Answer

The junior data scientist.

Question 19

What is the benefit of 'AI Model Watermarking' for governance?

Accepted Answer

Facilitating identification and provenance of AI-generated content.. Watermarking assists in identifying synthetic content, which is crucial for provenance and combating misinformation.

Answer

Improving model prediction speed.

Answer

Preventing unauthorized hardware usage.

Answer

Reducing model memory footprint.

Question 20

Which phase of the AI Lifecycle is most critical for 'Bias Detection'?

Accepted Answer

Model testing and evaluation.. Testing and evaluation (pre-deployment) is the primary window for detecting and mitigating bias before it impacts users.

Answer

Contract negotiation with vendors.

Answer

Model decommissioning.

Answer

Data center power-up.