AAISM AI Governance And Program Management Practice Test 7 — 15 Questions

Question 1

A healthcare provider is deploying an AI triage tool that recommends patient priority in the emergency department. The governance committee wants to ensure that the tool's decisions can be explained to clinicians and regulators. Which practice best supports this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Maintaining model documentation that records features, decision logic, and known limitations. Model documentation that records features, decision logic, and known limitations is the practice that enables the provider to explain triage recommendations to clinicians and regulators. It creates an inspectable record of how the model behaves, which is what explainability governance requires, unlike architecture choice, access restriction, or dataset size.

Answer

Restricting access to the model's source code to the vendor only

Answer

Increasing the size of the training dataset to improve accuracy

Answer

Using only open-source model architectures for the triage tool

Question 2

A healthcare insurer deploys an AI model to prioritize prior-authorization requests. During post-deployment monitoring, the AI governance lead discovers the model's denial rate for one demographic group is materially higher than for others, though overall accuracy meets the target. Which action should the governance lead take FIRST?

Accepted Answer

Document the finding, validate the disparity with a fairness assessment, and escalate through the AI risk escalation process for a remediation decision.. When monitoring reveals a material fairness concern, governance requires validation and escalation before remediation. The disparity may stem from data quality, proxy variables, or genuine model bias, and only a structured assessment can determine the appropriate response. Escalating through the defined risk process ensures legal, compliance, and clinical stakeholders make an informed, documented decision rather than reacting prematurely.

Answer

Adjust the model's decision threshold until denial rates are equal across all demographic groups.

Answer

Take no action because overall accuracy meets the target and the disparity may reflect legitimate clinical differences.

Answer

Immediately retire the model and revert to fully manual review for all prior-authorization requests.

Question 3

An AI governance lead is drafting the organization's AI policy hierarchy. The board has approved a high-level AI principles statement. The lead now needs a document that translates those principles into mandatory, auditable requirements that apply to all AI systems, including those built by third parties on the organization's behalf. Which document type best fits this need?

Accepted Answer

An AI standard that specifies mandatory controls, roles, and evidence requirements mapped to each principle.. Policy hierarchies typically run from principles at the top, to standards that make requirements mandatory and auditable, to procedures that describe execution. The board-approved principles need a binding translation that applies across all AI systems, including third-party-built ones, and that specifies controls, roles, and evidence. A standard fills that layer and can be incorporated into third-party contracts, unlike procedures, position papers, or charters.

Answer

An AI position paper that explains the organization's philosophy and intended direction on AI ethics.

Answer

A set of AI procedures that describe step-by-step how individual teams perform model reviews.

Answer

An AI charter that establishes the governance committee's membership and meeting cadence.

Question 4

A healthcare insurer is integrating a third-party AI diagnostic triage tool into its claims processing workflow. The AI security manager must ensure the vendor's model updates do not introduce new risks without the insurer's knowledge. Which contractual and technical control is MOST effective for this purpose?

Accepted Answer

Mandating a documented model change management process with advance notification, impact assessment, and insurer approval for material updates.. The core risk is undisclosed or unassessed model updates by a third party. Only a contractual requirement for documented model change management, with advance notification and insurer approval for material changes, provides proactive governance over those updates. SOC 2 reports, audit clauses, and firewalls address adjacent concerns but do not give the insurer timely visibility and control over AI model changes that could alter triage outcomes.

Answer

Deploying a web application firewall in front of the vendor's API to filter malicious inputs.

Answer

Requiring the vendor to provide a SOC 2 Type II report annually.

Answer

Including a right-to-audit clause that allows the insurer to inspect the vendor's development environment on 30 days' notice.

Question 5

A global manufacturer is standing up an AI governance program and must assign accountability for AI risks across the enterprise. The Chief Risk Officer wants to ensure that accountability is clearly allocated for both model development and ongoing operation. Which TWO structural elements are most essential to establish this accountability? (Choose two.)

Accepted Answer

A RACI matrix that assigns AI risk ownership to named roles across the lifecycle. A RACI matrix assigning AI risk ownership to named roles across the lifecycle and a board-approved governance charter defining decision rights and escalation paths together establish clear, enforceable accountability. The matrix provides role-level ownership for development and operations, while the charter provides formal authority and escalation, ensuring no gaps remain.

Answer

A centralized AI ethics committee that reviews all AI projects before launch

Answer

A quarterly AI performance dashboard presented to the executive committee

Answer

A vendor risk assessment template for third-party AI components

Question 6

A retail company's AI governance policy requires that all AI systems undergo a risk assessment before deployment. A business unit wants to deploy a chatbot for customer service that uses a large language model (LLM) from a public API. The business unit argues that because the LLM is pre-trained and hosted externally, a full risk assessment is unnecessary. What should the governance team do?

Accepted Answer

Require the business unit to conduct a risk assessment focused on the specific use case and data flows.. The governance team should require a risk assessment tailored to the specific use case and data flows. This ensures that risks unique to the integration—such as data privacy, model bias, and output accuracy—are evaluated and managed. It upholds the governance policy while allowing the business to proceed responsibly, balancing innovation with oversight.

Answer

Approve the deployment immediately because the LLM provider is responsible for all risks.

Answer

Waive the risk assessment because the LLM is a third-party service.

Answer

Prohibit the use of public LLM APIs entirely.

Question 7

A retail company's board asks the CISO to explain how AI risk appetite is translated into operational limits. The CISO proposes a tiered control model based on use-case criticality. Which element is MOST essential for the board to approve to make the tiered model enforceable?

Accepted Answer

Defined risk tiers with mandatory controls, approval authorities, and review cadences for each tier.. Risk appetite becomes actionable when expressed as tiers with mandatory controls, defined approval authorities, and review cadences. This structure lets the board set tolerance while management implements proportionate safeguards, and it gives auditors objective criteria to test. Vendor lists, uniform testing, and insurance are supporting elements but do not by themselves enforce differentiated risk treatment across AI use cases.

Answer

A list of approved AI vendors and their current security certifications.

Answer

A requirement that all AI systems, regardless of use case, undergo the same annual penetration test.

Answer

A commitment to purchase cyber insurance covering AI-related incidents before any deployment.

Question 8

A global bank's AI governance committee is drafting its first enterprise AI policy. The CISO argues that a single 'AI Security Policy' owned by security is sufficient because most AI risk is security risk. The Chief Data Officer counters that the program needs a governing body with cross-functional authority. Which action best establishes durable AI governance accountability for the enterprise?

Accepted Answer

Charter a cross-functional AI governance board with an executive sponsor, a defined decision-rights matrix, and a standing reporting cadence to the board of directors.. Durable AI governance accountability comes from a chartered, cross-functional body with an executive sponsor, documented decision rights, and a reporting cadence to the board. This structure ensures every AI risk domain has an accountable owner and that trade-offs are adjudicated rather than defaulting to one function. Policies and attestations are supporting artifacts, not substitutes for governance infrastructure, and decentralized self-governance fragments accountability.

Answer

Delegate all AI governance decisions to the CISO and require quarterly security metrics to be the sole input to the risk committee.

Answer

Assign each business unit to govern its own AI systems independently and report only material incidents to the CISO after remediation is complete.

Answer

Publish an AI acceptable use policy signed by the CEO and rely on annual employee attestation to enforce compliance across business units.

Question 9

A multinational retailer is expanding its AI governance program to cover AI systems developed by its regional subsidiaries. The central AI governance office wants to ensure that subsidiary-developed AI systems are consistently registered, risk-assessed, and monitored. Which two governance mechanisms best achieve this consistency? (Choose two.)

Accepted Answer

A federated AI governance model in which each subsidiary appoints an accountable AI risk owner who applies centrally defined risk assessment criteria and reports into the central AI inventory.. Consistency across subsidiaries is best achieved by combining a federated governance model with accountable local AI risk owners and a shared governance platform that standardizes intake, risk assessment, and monitoring. The federated model supplies local accountability and context, while the platform enforces common data structures and gives the central office enterprise-wide visibility. Together they cover registration, assessment, and monitoring without centralizing every decision.

Answer

An annual attestation from each subsidiary's CIO that all AI systems comply with the central AI policy.

Answer

A central mandate requiring every subsidiary AI project to be approved by the central AI governance office before any development begins.

Answer

A requirement that all subsidiary AI systems use the same foundation model provider as the parent company.

Question 10

A retail company's AI governance committee is drafting a policy for employee use of public generative AI tools. The Chief Information Security Officer wants to ensure the policy addresses the most significant risk of data leakage. Which policy element is MOST directly aimed at preventing sensitive corporate data from being exposed through these tools?

Accepted Answer

Prohibiting the input of confidential, personal, or proprietary data into public generative AI tools.. The most direct way to prevent sensitive data leakage through public generative AI tools is to prohibit entering such data into them. This policy element removes the risky behaviour itself, rather than relying on training, access controls, or endpoint monitoring that do not specifically address the content shared with external AI services. It is clear, enforceable, and targeted at the root cause.

Answer

Requiring employees to complete annual security awareness training.

Answer

Mandating multi-factor authentication for all corporate accounts.

Answer

Deploying endpoint detection and response agents on all employee laptops.

Question 11

A global manufacturer is standing up an AI governance committee. The CISO wants to ensure the committee can make defensible decisions about high-risk AI deployments. Which TWO responsibilities are MOST essential for this committee to own directly? (Choose two.)

Accepted Answer

Resolving escalated AI risk issues and directing remediation when monitoring or audit identifies unacceptable risk.. A governance committee's essential authorities are approving high-risk use cases against defined criteria and resolving escalated risk issues with documented decisions. These responsibilities ensure accountability, consistency with risk appetite, and auditability. Implementation, daily monitoring, and contract negotiation are execution activities that belong to engineering, operations, and procurement, and assigning them to the committee would undermine its oversight independence.

Answer

Performing daily operational monitoring of model drift and data pipeline health for every deployed model.

Answer

Negotiating pricing and service-level agreements with third-party AI model providers.

Answer

Writing and maintaining the production code for all AI models used in manufacturing operations.

Question 12

A healthcare insurer has deployed an AI claims-triage model. Six months after launch, the model's denial rate for one demographic has drifted upward while overall accuracy remains stable. The AI program manager needs to detect and respond to this issue as part of ongoing AI governance. Which control is most appropriate?

Accepted Answer

Implement continuous post-deployment monitoring with disaggregated performance metrics by protected group and defined thresholds that trigger review or rollback.. The scenario describes demographic performance drift hidden by stable aggregate accuracy, which only disaggregated, continuous monitoring can detect. Defining thresholds in advance converts detection into action, enabling review, retraining, or rollback. Pre-deployment validation, blanket manual review, and annual revalidation all fail to provide timely, subgroup-level detection and response, which is the core governance requirement for a live high-impact model.

Answer

Re-run the pre-deployment validation test suite and confirm the model still passes its original acceptance thresholds.

Answer

Increase the human review rate for all denied claims from ten percent to one hundred percent and pause model retraining indefinitely.

Answer

Document the drift in the model risk register and schedule a comprehensive model revalidation for the next annual review cycle.

Question 13

An organization's AI governance office is defining the responsibilities of the first-line, second-line, and third-line functions for AI risk. A newly hired AI risk manager asks which function should independently assess whether the AI governance framework is designed and operating effectively. Which function is responsible?

Accepted Answer

The third line, because internal audit provides independent assurance on the design and operating effectiveness of the governance framework.. In the three-lines model, the first line owns and manages AI risk, the second line defines the framework and monitors compliance, and the third line provides independent assurance on the design and operating effectiveness of the framework. Because the third line is independent of both operating AI systems and defining the framework, it is the function responsible for objective assessment and reporting to the board.

Answer

A joint task force of the first and second lines, because combining operational and risk expertise produces the most accurate assessment.

Answer

The second line, because it defines the AI risk framework and monitors first-line compliance with it.

Answer

The first line, because it owns and operates the AI systems and therefore understands their controls best.

Question 14

A manufacturing firm uses an AI system to prioritize maintenance tasks. The AI governance lead must ensure that the system's decisions can be explained to regulators and affected employees. Which action BEST supports this requirement?

Accepted Answer

Using a model-agnostic explanation technique, such as SHAP or LIME, to generate feature importance for each maintenance prioritization decision.. To explain individual AI decisions, the firm needs case-level insight into which factors drove each prioritization. Model-agnostic techniques like SHAP or LIME generate feature importance that translates model behaviour into understandable terms for regulators and employees. Logging, aggregate metrics, and human review support governance but do not provide the specific reasoning behind a given decision, making them insufficient for this requirement.

Answer

Requiring human review of every maintenance prioritization decision before it is executed.

Answer

Publishing the model's overall accuracy and F1 score on a validation dataset.

Answer

Maintaining a detailed log of all model inputs, outputs, and the version of the model used for each decision.

Question 15

A retail company is standing up an AI governance program and must define how AI risk appetite will be expressed and operationalized across the enterprise. Which TWO elements are necessary to translate an executive AI risk appetite statement into day-to-day governance? (Choose two.)

Accepted Answer

A documented mapping of each AI risk category to an accountable owner and the control evidence required to demonstrate adherence.. Translating AI risk appetite into practice requires quantified tolerance thresholds tied to use-case tiers with escalation paths, plus a mapping of each risk category to an accountable owner and required control evidence. These two elements make appetite measurable, assignable, and auditable. Uniform review, sentiment surveys, and zero-tolerance declarations do not produce measurable limits or ownership and therefore cannot operationalize an appetite statement.

Answer

A policy statement declaring that the enterprise has zero tolerance for any AI-related harm across all use cases.

Answer

A requirement that every AI use case, regardless of risk, undergo the same full review by the central governance board.

Answer

A quarterly survey of employees to gauge general comfort with AI and adjust the risk appetite based on sentiment.