AAIR Practice Questions

Question 1

A bank's AI Governance policy requires a 'bias test' for all customer-facing models. What is the most important element to document in the audit trail?

Accepted Answer

The test methodology, criteria for success, and the specific mitigation steps taken.. For an AI bias test audit trail, the defensible record must show how the test was conducted, what threshold defined pass/fail, and what was done when bias was detected — this is what regulators and auditors need to reconstruct the decision. Documenting methodology, success criteria, and mitigation steps demonstrates due diligence and reproducibility, which is the core purpose of an audit trail. Operational trivia like hours, salaries, or tool names does not establish that the model was actually tested for fairness.

Answer

The number of hours the test took to run.

Answer

The salary of the testers.

Answer

The name of the software used for the test.

Question 2

What is the primary risk objective of 'Model Versioning' in the AI lifecycle?

Accepted Answer

To ensure auditability, reproducibility, and the ability to roll back to a known stable state.. Model versioning exists to provide auditability (who changed what and when), reproducibility (recreate any past model and its results), and rollback capability (revert to a known stable version when a new release degrades). These properties are foundational for incident response, regulatory review, and safe continuous delivery of AI systems.

Answer

To prevent unauthorized users from viewing the code.

Answer

To reduce the amount of disk space used.

Answer

To increase the model's speed in production.

Question 3

What is the primary purpose of an 'AI Risk Dashboard' for executive leadership?

Accepted Answer

To provide high-level visibility into AI risk posture and trends. An AI Risk Dashboard aggregates key risk indicators, model performance metrics, and compliance status into a concise executive view. Its primary purpose is to give leadership high-level visibility into the organization's AI risk posture and emerging trends so they can make informed strategic decisions. It does not replace governance bodies or expose raw technical logs.

Answer

To replace the need for an AI ethics committee

Answer

To provide raw model logs to the public

Answer

To monitor individual developer productivity

Question 4

What is the 'Accountability' principle in the NIST AI RMF intended to address?

Accepted Answer

Ensuring that there is clear ownership and responsibility for AI system performance and safety.. The Accountability principle in the NIST AI RMF (part of the Govern function) is about ensuring clear ownership and responsibility for AI system performance, safety, and outcomes throughout the lifecycle. It answers 'who is responsible?' so that risks are managed, issues are escalated, and redress is possible. It is not about explainability, bug-freeness, or speed.

Answer

Ensuring the AI can explain itself.

Answer

Making sure the model is free of bugs.

Answer

Ensuring that the AI system is fast.

Question 5

Which of the following is a key component of 'AI Risk Governance'?

Accepted Answer

The definition of roles and responsibilities. A key component of AI Risk Governance is the definition of roles and responsibilities, which establishes accountability for risk management across the organization. This includes specifying who owns AI risks, who approves deployments, and who monitors ongoing performance. Without clear roles, governance breaks down and risks go unmanaged.

Answer

The choice of programming language

Answer

The vendor of the cloud hosting platform

Answer

The speed of model deployment

Question 6

In the context of AI Supply Chain risk, what is the primary governance objective when evaluating a vendor's AI model transparency?

Accepted Answer

To confirm the vendor's model satisfies the internal 'Model Card' and transparency requirements for risk assessment.. The primary governance objective when evaluating a vendor's AI model transparency is to ensure the vendor provides sufficient documentation — such as model cards, datasheets, and transparency reports — to assess risks related to bias, explainability, and compliance. Confirming that the vendor's model satisfies internal Model Card and transparency requirements enables the organization to perform due diligence and integrate the model into its risk management framework.

Answer

To minimize the number of API calls made to the vendor.

Answer

To verify the vendor's financial stability and market share.

Answer

To ensure the vendor's training data includes proprietary internal company data.

Question 7

You are auditing the integration of AI risk into the Enterprise Risk Management (ERM) system. Which finding indicates a failure in the governance structure?

Accepted Answer

AI models deployed in production are missing from the centralized enterprise risk register.. A centralized enterprise risk register is the authoritative inventory of organizational risks; if production AI models are absent from it, the governance structure has failed to integrate AI risk into ERM — meaning those models are unmanaged, unreviewed, and invisible to executive and Board oversight. This is a structural governance failure because it breaks the linkage between AI risk identification and enterprise-level risk aggregation, violating the principle that all material risks must flow into the ERM.

Answer

The risk assessment template is 20 pages long.

Answer

The AI risk register is updated annually instead of monthly.

Answer

The AI risk committee meets quarterly rather than monthly.

Question 8

When coordinating between Legal and Data Science teams, what is the best way to handle 'Explainability' requirements?

Accepted Answer

Require Data Science to translate technical model output into plain language documentation. Explainability requirements exist so that non-technical stakeholders — Legal, compliance, regulators, and affected individuals — can understand how a model reaches decisions. The Data Science team owns the technical model and is best positioned to translate its behavior into plain-language documentation that Legal can review and rely on. This preserves the division of labor: Data Science explains, Legal interprets and applies.

Answer

Restrict Legal from reviewing AI model outputs

Answer

Let Legal define the technical parameters of the models

Answer

Only document model logic when a lawsuit occurs

Question 9

When setting KPIs for an AI risk program, which metric is a leading indicator of potential model bias?

Accepted Answer

Demographic parity ratio in training data samples. Demographic parity ratio in training data samples is a leading indicator because it measures the representation of protected groups before the model is deployed. A skewed ratio (e.g., far from 1.0) signals that the model may learn biased patterns, allowing proactive mitigation. Unlike lagging metrics such as complaints, it provides early warning during data collection and preprocessing.

Answer

Average model inference latency

Answer

Percentage of customer complaints regarding AI decisions

Answer

Number of model updates per quarter

Question 10

Which THREE actions should be taken when integrating AI risk into the broader ERM (Enterprise Risk Management) framework?

Accepted Answer

Establish aligned risk scoring criteria across all business functions.. Option B is correct because integrating AI risk into ERM requires a consistent, enterprise-wide risk scoring methodology so AI risks can be compared, aggregated, and prioritized alongside operational, financial, and compliance risks in the same register. Option D is correct because a shared risk taxonomy must be extended to capture AI-specific concepts such as model bias, data drift, hallucination, and model opacity; without common definitions, AI risks cannot be consistently identified, classified, or reported across functions. Option E is correct because AI risk owners must sit within the same governance and escalation channels (e.g., the same risk committee and reporting lines) as other risk owners, ensuring AI risk is not siloed and receives the same oversight, accountability, and board visibility as traditional risks. Option A does not belong because outsourcing all AI risk management removes internal ownership and accountability, which contradicts ERM principles of retained responsibility and integrated oversight. Option C does not belong because prohibiting every AI initiative with any inherent risk is an avoid-or-eliminate approach rather than risk-based management, and it would block innovation instead of treating, transferring, or accepting AI risk within defined tolerances.

Answer

Outsource all AI risk management to a third-party consultant.

Answer

Prohibit all AI initiatives that carry any inherent risk.

Question 11

Which phase of the AI lifecycle is most critical for initial risk mitigation?

Accepted Answer

Design and Problem Formulation.. The Design and Problem Formulation phase is most critical for initial risk mitigation because this is where the problem is scoped, objectives are defined, and potential risks are identified before any model is built. Decisions made here — such as choosing the use case, defining success metrics, identifying affected stakeholders, and assessing ethical/legal constraints — determine the risk profile of the entire project. Once a model is trained and deployed, many risks are already baked in and far more costly to remediate.

Answer

Deployment.

Answer

Decommissioning.

Answer

Model Monitoring.

Question 12

During the design phase of a machine learning model, a practitioner identifies that the training dataset has significant underrepresentation of a minority demographic. What is the most effective proactive risk mitigation strategy?

Accepted Answer

Apply synthetic data generation techniques to balance the training distribution.. When a training dataset underrepresents a demographic, the most effective proactive mitigation at the design phase is to correct the data distribution itself — synthetic data generation (e.g., SMOTE, CTGAN, or targeted augmentation) can increase representation of the minority group so the model learns its patterns rather than defaulting to the majority. Addressing the root cause in the data is preferable to downstream patches because it improves model behavior for the affected group across all future inferences.

Answer

Deploy the model with a human-in-the-loop oversight mechanism.

Answer

Monitor prediction confidence intervals during the post-deployment phase.

Answer

Increase the regularization parameters in the model architecture.

Question 13

Which activity is a foundational requirement for building a sustainable AI risk program?

Accepted Answer

Creating an enterprise AI inventory. A sustainable AI risk program requires knowing what AI exists across the enterprise — an AI inventory is the foundational artifact that every other activity (policy, monitoring, audit, vendor review) depends on. Without it, risk assessments are incomplete and controls cannot be scoped. This is why inventory creation is consistently the first and most cited foundational requirement.

Answer

Signing contracts with AI vendors

Answer

Automating all model retraining cycles

Answer

Purchasing third-party AI auditing tools

Question 14

Which TWO factors should be documented in an AI Model Card?

Accepted Answer

Intended use cases. Option D (Intended use cases) is correct because an AI Model Card is designed to document the purpose and appropriate applications of a model, so consumers know what tasks it was built for and where it should be deployed. Option E (Model limitations and known risks) is correct because Model Cards must disclose known biases, failure modes, out-of-scope scenarios, and other risks so users can make informed decisions about deployment. Options A, B, and C are incorrect because favorite snacks, stock prices, and new-hire handbooks are unrelated to model transparency, performance, or governance, and are not part of standard Model Card documentation such as that proposed by Mitchell et al. or required under emerging AI regulations.

Answer

The developer's favorite snacks

Answer

The current stock price of the company

Answer

The employee handbook for new hires

Question 15

An organization is integrating AI risk into its enterprise risk management (ERM) framework. What is the first step in this integration process?

Accepted Answer

Identify and classify all AI applications by criticality and risk level.. Integrating AI risk into ERM begins with discovery and classification — you cannot govern, monitor, or write policy for AI applications you haven't identified. Identifying and classifying all AI applications by criticality and risk level establishes the risk register baseline that every subsequent control (monitoring, policy, ownership) depends on. This mirrors the standard ERM sequence: identify, assess, treat, monitor.

Answer

Assign a Chief AI Officer.

Answer

Install automated model monitoring tools.

Answer

Create an AI acceptable use policy.

ISACA Advanced in AI Risk AAIR practice test

Three ways to study

Study AAIR by domain

Study AAIR by topic

AI Risk Program Management practice questions

AI Risk Governance And Framework Integration practice questions

AI Lifecycle Risk Management practice questions

AAIR fundamentals practice questions

AAIR scenario practice questions

AAIR troubleshooting practice questions

ISACA Advanced in AI Risk (AAIR) (AAIR) practice questions