AAISM AI Governance And Program Management Practice Test 6 — 15 Questions

Question 1

A healthcare insurer is standing up an AI governance program and must decide which structural components to include in its governance framework to ensure AI systems are developed and operated consistently across business units. (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A defined governance body with assigned decision rights for AI approvals, exceptions, and oversight. A functioning AI governance framework rests on two structural pillars: a documented policy framework that sets principles, risk appetite, and mandatory controls, and a governance body with assigned decision rights for approvals, exceptions, and oversight. Together they ensure consistent treatment of AI across units, while controls and communications support execution.

Answer

A vendor contract template requiring AI suppliers to disclose training data sources

Answer

A monthly newsletter summarizing emerging AI regulations for interested employees

Answer

A data loss prevention tool configured to block outbound transfers of model weights

Question 2

An enterprise has deployed a third-party AI-powered hiring screening tool. The vendor recently updated its model, and the organization's HR team was not notified beforehand. The AI governance committee needs to ensure that such changes are managed consistently going forward. Which action should the committee take FIRST?

Accepted Answer

Add a contractual clause requiring advance notification and review of material model changes before deployment.. The governance committee must close the gap that allowed an unannounced vendor model change to affect hiring. A contractual requirement for advance notification and review creates a repeatable control, ensuring the organization can evaluate risks and performance before changes go live. This approach balances operational continuity with oversight, directly addressing the third-party change management deficiency without overreacting or neglecting the root cause.

Answer

Immediately terminate the vendor relationship and build an in-house model.

Answer

Require the vendor to provide the model's source code for internal review.

Answer

Instruct HR to manually re-screen all candidates processed since the update.

Question 3

An enterprise AI governance committee is defining a policy for generative AI tools used by employees. The CISO wants to ensure that any AI-generated content that is published externally or used in decision-making is reviewed by a human before release. Which governance control should be formally documented to enforce this requirement across all business units?

Accepted Answer

A human-in-the-loop (HITL) review requirement in the AI acceptable use policy. A documented human-in-the-loop requirement in the AI acceptable use policy is the only option that creates a preventive, auditable governance control mandating human validation before AI-generated content is published or used in decisions. DLP, training, and audits are supporting measures but do not enforce the specific review gate the CISO requires.

Answer

An annual third-party audit of the AI governance program

Answer

A data loss prevention (DLP) rule that blocks uploads to public generative AI sites

Answer

A mandatory AI awareness training module for all employees

Question 4

An organization is establishing an AI governance program. The Chief Executive Officer asks the AI governance lead to define the program's scope. Which of the following should be the PRIMARY focus when defining the scope of AI governance?

Accepted Answer

All AI systems and processes across the organization, including those developed internally and procured from third parties.. The primary focus should be all AI systems across the organization, both internal and third-party, to ensure comprehensive risk management and consistent governance. Narrowing scope to customer-facing, internally developed, or PII-only systems creates blind spots and fails to address the full spectrum of AI risks.

Answer

Only AI systems that are customer-facing, as they pose the highest reputational risk.

Answer

Only AI systems developed by the internal data science team, since the organization has direct control over them.

Answer

AI systems that use personally identifiable information (PII), as they are subject to privacy regulations.

Question 5

A software company is rolling out an AI governance training program. The Chief Information Security Officer wants to ensure that all employees who build, deploy, or use AI systems understand the organization's expectations for responsible behavior, including prohibited uses. Which governance activity most directly establishes these expectations for the workforce?

Accepted Answer

Publishing an AI acceptable use policy that defines permitted, restricted, and prohibited AI behaviors. Expectations for responsible AI behavior are established through a published acceptable use policy that enumerates permitted, restricted, and prohibited uses. Training, monitoring, and bounty programs support the policy, but the policy itself is the instrument that defines expectations and provides the basis for consistent enforcement across the workforce.

Answer

Establishing a bug bounty program that rewards employees for reporting AI model vulnerabilities

Answer

Deploying an AI-powered anomaly detection system to monitor employee endpoint activity

Answer

Requiring annual security awareness training that includes a general module on emerging technologies

Question 6

A global bank's AI governance program is being audited. The auditors find that the bank has a robust AI risk assessment process for new models, but no mechanism to monitor risks that emerge after deployment, such as data drift or changing regulatory requirements. Which control should the governance team implement to address this gap?

Accepted Answer

A periodic AI model re-validation and risk reassessment process tied to a defined schedule and trigger events.. The audit gap is the absence of post-deployment risk monitoring. A periodic re-validation and reassessment process, scheduled and event-triggered, ensures that models are continually evaluated against performance, data drift, and regulatory changes. This control provides the necessary oversight to maintain risk management throughout the AI lifecycle and satisfies the auditors' concern about ongoing risk identification.

Answer

A requirement for business units to self-certify that their AI models remain compliant.

Answer

A one-time review of all deployed models at the end of the fiscal year.

Answer

An annual penetration test of the AI infrastructure.

Question 7

A multinational bank's AI governance lead is mapping AI systems to regulatory obligations across jurisdictions. The bank uses a single credit-scoring model that is trained in the EU, deployed in the US and Singapore, and fine-tuned locally. Which governance artifact is most critical to maintain so the bank can demonstrate compliance with differing regional AI regulations?

Accepted Answer

A regulatory obligation register mapped to each AI system and its deployment locations. A regulatory obligation register mapped to each AI system and deployment location is the artifact that connects jurisdictional legal requirements to specific model instances, including local fine-tuned variants. It supports evidence of compliance, gap analysis, and change management as regulations evolve, which model cards, DPAs, and penetration tests cannot provide on their own.

Answer

A penetration test report for the model's API endpoints

Answer

A data processing agreement (DPA) with the cloud provider hosting the model

Answer

A model card that documents intended use, training data, and performance metrics

Question 8

A telecommunications provider has completed its first AI governance maturity assessment. Leadership wants to move from ad hoc AI oversight to a repeatable, enterprise-wide program that can demonstrate continuous improvement to the board. Which action best advances the program toward that goal?

Accepted Answer

Adopting a recognized AI governance framework and mapping current practices to its domains to identify and close gaps. Moving from ad hoc oversight to a repeatable program requires a structured reference model. Adopting a recognized AI governance framework and mapping current practices to its domains lets the organization benchmark maturity, prioritize gaps, and report measurable progress to the board, which is the essence of continuous improvement.

Answer

Hiring a Chief AI Officer to personally approve every AI use case before deployment

Answer

Purchasing an AI governance platform to centralize policy documents and workflow approvals

Answer

Commissioning an external legal review of all AI regulations applicable to the telecommunications sector

Question 9

An organization's AI governance committee is revising its AI risk taxonomy. The Chief Risk Officer wants to ensure that risks arising from third-party foundation model APIs are captured distinctly from risks of internally developed models. Which change to the taxonomy best achieves this?

Accepted Answer

Add a 'Model Provenance' dimension that classifies each AI system by whether its underlying model is externally sourced, internally trained, or fine-tuned from an external base.. The CRO wants third-party foundation model API risk separated from internally developed model risk. A provenance dimension accomplishes this by tagging each AI system with how its model was obtained, allowing risk assessors to apply specific controls for external dependencies such as vendor model updates, contractual data handling, and upstream bias. The other options either distort scores, collapse AI risk into generic vendor risk, or apply uniform treatment.

Answer

Create a separate 'Vendor Management' risk category and move all AI systems procured from third parties into it.

Answer

Increase the likelihood rating of all AI systems that use any external API by a fixed factor of two.

Answer

Require every AI system to undergo a full security assessment regardless of whether the model is internal or external.

Question 10

A retail company's board has approved an AI governance charter. The Chief AI Officer must now establish a mechanism to ensure that AI risks are escalated to the board when they exceed defined thresholds. Which element is most essential for this escalation mechanism to function effectively?

Accepted Answer

A defined AI risk appetite statement with quantified tolerance thresholds. A defined AI risk appetite statement with quantified tolerance thresholds is the essential foundation for board escalation because it establishes objective criteria for when a risk exceeds acceptable levels. Without agreed tolerances, escalation decisions are subjective and inconsistent, undermining the governance charter's intent.

Answer

An employee suggestion box for AI-related concerns

Answer

A monthly newsletter summarizing AI industry trends

Answer

A list of all AI vendors currently under contract

Question 11

A multinational corporation is establishing an AI governance board. The board's charter must define its responsibilities for overseeing AI risks across the enterprise. Which TWO responsibilities are most critical for the board to own? (Choose two.)

Accepted Answer

Ensuring that AI risk management processes are integrated into enterprise risk management.. The governance board's most critical responsibilities are setting the AI risk appetite and ensuring AI risk management is integrated into enterprise risk management. These activities provide strategic direction and embed AI risk oversight into the broader organizational risk framework, which are essential for effective governance. Technical and operational tasks are delegated to management and staff.

Answer

Conducting individual performance reviews of AI developers.

Answer

Writing the code for AI risk mitigation controls.

Answer

Reviewing and approving the technical architecture of each AI model.

Question 12

A multinational bank's AI governance committee is drafting its first enterprise AI policy. The CISO asks how the policy should address third-party foundation models that are accessed via API but not fine-tuned or hosted internally. Which approach BEST aligns with ISACA AI governance principles?

Accepted Answer

Include third-party API models in the AI inventory and apply proportionate controls such as vendor due diligence, output validation, and contractual security requirements.. Governance scope is determined by the organization's use of AI, not by who owns the model. Third-party API models influence decisions, process data, and create regulatory exposure, so they must be inventoried and governed proportionately. Contractual controls, vendor assessment, and output validation are the practical levers available when the organization cannot inspect weights or training data.

Answer

Require the vendor to share full model weights and training data before the API can be approved for any business use.

Answer

Delegate all responsibility for the third-party model to the procurement team, since the relationship is contractual rather than technical.

Answer

Exclude third-party API models from the AI policy because the organization does not own the model weights or training data.

Question 13

A financial services firm has deployed an AI governance framework with a central AI risk committee. Business units complain that the committee is a bottleneck, delaying low-risk AI pilots by weeks. The Chief AI Officer wants to maintain oversight while accelerating delivery. Which governance design change best addresses this?

Accepted Answer

Delegate approval authority for low-risk AI use cases to business-unit AI risk champions using a pre-approved risk pattern library, with the central committee retaining review of high-risk and novel cases.. The bottleneck stems from a single-tier approval model in which all AI pilots, regardless of risk, route through the central committee. Delegating low-risk approvals to trained business-unit champions using pre-approved patterns keeps the central committee as the owner of the risk framework and the approver of high-risk or novel cases, while materially reducing cycle time for routine pilots. This is a governance design change rather than a capacity or oversight removal.

Answer

Dissolve the central AI risk committee and assign all AI risk decisions to each business unit's existing operational risk function.

Answer

Keep the central committee as the sole approver but add more staff and increase meeting frequency to clear the backlog.

Answer

Allow business units to self-certify all AI pilots as low risk and proceed without notifying the central committee.

Question 14

A global bank has deployed a generative AI assistant to its wealth management advisors. The AI security manager must establish an oversight process that ensures the model's outputs remain aligned with the bank's risk appetite as market conditions and regulations evolve. Which ongoing activity should be the PRIMARY mechanism for this alignment?

Accepted Answer

Implementing a continuous AI risk monitoring and reporting program with defined KRIs and periodic model performance reviews.. Aligning an AI system with evolving risk appetite requires ongoing, measurable oversight, not one-time or static controls. A continuous risk monitoring and reporting program with defined KRIs and periodic model performance reviews directly connects live AI behaviour to governance thresholds, enabling detection of drift and timely escalation. Penetration tests, attestations, and archiving are valuable but do not provide the continuous linkage needed for sustained alignment.

Answer

Archiving all AI-generated client communications for seven years to satisfy recordkeeping requirements.

Answer

Requiring wealth advisors to sign an annual attestation that they have read the AI acceptable use policy.

Answer

Conducting an annual third-party penetration test of the AI model's API endpoints.

Question 15

A healthcare organization uses an AI system to prioritize patient follow-up calls. The system was trained on historical data that underrepresented certain demographic groups. The governance team wants to implement a control that detects and mitigates bias in the model's outputs on an ongoing basis. Which approach is most effective?

Accepted Answer

Implement continuous monitoring of model outputs with fairness metrics and a defined mitigation workflow.. Continuous monitoring with fairness metrics and a mitigation workflow is the most effective approach because it provides ongoing detection and correction of bias in production. It acknowledges that bias is not a one-time issue and requires sustained vigilance. This control enables the governance team to fulfill its responsibility to ensure equitable AI outcomes and comply with regulations.

Answer

Rely on the vendor's claims that the model is fair and unbiased.

Answer

Remove all demographic data from the training set to prevent bias.

Answer

Conduct a one-time bias audit before deployment and document the results.