199 questions total · 3pages · All types, answers revealed
Page 3 of 3
Which of the following is a key component of 'AI Risk Governance'?
Governance is defined by who is responsible and accountable for what.
Why this answer
Clear roles and responsibilities are essential for accountability, which is a core component of governance.
When establishing KPIs for an AI program, what is the risk of focusing solely on 'Model Accuracy'?
A singular focus on accuracy ignores the socio-technical dimensions of AI risk.
Why this answer
Accuracy ignores other vital risk factors like bias, fairness, and security, which could result in a high-performing but high-risk model.
In the context of AI Supply Chain risk, what is the primary governance objective when evaluating a vendor's AI model transparency?
Transparency and documentation are prerequisites for assessing third-party model risk.
Why this answer
Governance in the supply chain requires understanding the 'provenance' and 'limitations' of third-party models to ensure they align with internal risk requirements. Model cards provide the necessary documentation for this assessment.
What is 'Bias' in the context of AI risk?
This is the standard definition of AI bias.
Why this answer
Bias refers to systematic errors that lead to unfair or discriminatory outcomes, posing both social and regulatory risks.
Which TWO activities are part of the 'Risk Identification' step in the AI lifecycle?
Identifies where the model is likely to fail.
Why this answer
Bias testing and documentation of limitations are key risk identification activities.
You are auditing the integration of AI risk into the Enterprise Risk Management (ERM) system. Which finding indicates a failure in the governance structure?
This demonstrates that models are being released outside of the formal risk governance process.
Why this answer
A core tenet of AI governance is that risk assessments must occur before deployment. If models are deployed without being included in the ERM system, the governance process is bypassed, representing a failure in control.
A board of directors requests a dashboard view of AI model drift. Which metric is most appropriate for a board-level risk report?
Drift threshold violations indicate a system is deviating from its validated risk profile.
Why this answer
The board requires high-level risk indicators rather than granular performance metrics like F1 scores.
When coordinating between Legal and Data Science teams, what is the best way to handle 'Explainability' requirements?
This ensures compliance and oversight without compromising technical accuracy.
Why this answer
Bridging technical model features (shapley values, etc.) with legal disclosure requirements requires a common documentation template.
When setting KPIs for an AI risk program, which metric is a leading indicator of potential model bias?
Analyzing training data for representativeness identifies bias before the model is deployed.
Why this answer
Monitoring training data distribution is a leading indicator, whereas output monitoring is a lagging indicator.
When performing an AI risk assessment, which question is most appropriate to ask?
This addresses the core goal of risk assessment: analyzing potential negative outcomes.
Why this answer
Risk assessment focuses on impact and likelihood, and the potential for unintended harm is the core of AI risk analysis.
An organization is revising its AI Governance to include 'Human-in-the-loop' (HITL) requirements. Why is this a critical risk mitigation strategy?
HITL allows for intervention when the AI model produces unexpected or high-risk outcomes.
Why this answer
HITL provides a necessary safety net for models that may exhibit unpredictable behavior or lack explainability.
During the design phase of a machine learning model, a practitioner identifies that the training dataset has significant underrepresentation of a minority demographic. What is the most effective proactive risk mitigation strategy?
Synthetic data generation addresses the root cause of data imbalance during the design/data preparation phase.
Why this answer
Data augmentation or oversampling techniques are standard practices to address bias before training begins.
In a retail company, which AI risk is most likely to cause direct financial loss?
Pricing errors directly impact financial performance.
Why this answer
Inaccurate pricing models can lead to immediate and direct revenue loss, which is a clear financial risk.
When assessing the organizational readiness for AI risk governance, which TWO areas must be evaluated to ensure the framework is sustainable?
A multi-disciplinary approach is essential for holistic AI risk assessment.
Why this answer
Sustainable governance requires both the human element (culture/skills) and the procedural element (integration into existing systems).
When an AI model is updated (e.g., retrained on new data), what action is required from an AI Risk Governance perspective?
Changes require re-validation to ensure the model remains safe.
Why this answer
Any significant change to an AI model triggers a re-validation or reassessment to ensure the new version is still within risk thresholds.
Which TWO factors should be documented in an AI Model Card?
Knowing what the model is designed for is essential.
Why this answer
Model cards are designed to inform users about the model's performance and usage limits.
A board of directors requests a dashboard to monitor AI risk exposure. Which metric provides the most effective board-level oversight regarding AI regulatory compliance?
This provides a high-level view of governance efficacy and legal exposure.
Why this answer
Board members require high-level indicators of systemic risk rather than granular technical metrics. Tracking the percentage of AI systems with completed regulatory impact assessments provides oversight on compliance posture.
Which TWO actions are required to manage 'Third-Party' AI risks?
You must vet the vendor's own risk management.
Why this answer
Management requires due diligence and contractual oversight.
Which THREE areas should be covered in an AI risk management program?
Technical performance is a critical risk area.
Why this answer
Comprehensive AI programs address technical, legal, and operational risks.
To mitigate 'Training-Serving Skew' in the AI lifecycle, what is the best practice for data processing pipelines?
A feature store enforces consistency, eliminating the risk of different transformations.
Why this answer
Using a unified feature store ensures that the exact same transformation logic is used for both training and inference.
What is the primary role of the AI 'Data Steward' within the AI Governance framework?
Data stewardship is foundational to ensuring that training data does not introduce risk.
Why this answer
The data steward is responsible for ensuring the quality, security, and ethical use of data throughout the AI lifecycle.
Your organization is integrating AI risks into the existing COSO Enterprise Risk Management (ERM) framework. Which action best ensures that AI-specific model drift risk is formally addressed within the 'Review and Revision' component?
This aligns with the requirement to review risk management performance against evolving risks.
Why this answer
The COSO ERM framework's 'Review and Revision' component requires assessing whether the risk management practices remain effective as the risk landscape changes. Integrating AI model performance monitoring into established periodic risk reviews ensures the organization adapts to evolving model behaviors.
Which THREE types of 'Bias' need to be managed in an AI project?
This happens when data collection methods are flawed.
Why this answer
Common forms of AI bias include sampling, measurement, and algorithmic bias.
A cross-functional committee is evaluating the deployment of a high-impact AI model. Which TWO factors are critical to include in the initial AI risk assessment to ensure comprehensive coverage?
Socio-technical impact is a core requirement for high-impact AI risk assessments.
Why this answer
Data lineage and socio-technical impact are critical for high-impact AI assessments.
Which of the following is a key objective of an AI Risk Management Program?
The objective is to enable innovation while managing risk appropriately.
Why this answer
The primary objective is to balance the benefits of AI with the potential risks to the organization.
A financial institution is integrating AI risk into its ERM framework. Which action most effectively aligns AI risk appetite with enterprise risk appetite?
This establishes clear boundaries that align with the broader ERM appetite.
Why this answer
Defining quantitative risk thresholds in the AI governance policy ensures alignment with the organization's overall risk capacity.
A company is deploying an AI system that interacts with human users. According to the AI RMF, what should be the focus of the 'Map' function in the risk governance process?
Mapping the context and impact is central to identifying risk vectors.
Why this answer
Mapping involves understanding the context, intended use, and the human-AI interaction points to identify potential harms.
When a 'Data Drift' alert is triggered in a production environment, what is the first step in the risk management lifecycle?
Validating the drift ensures the team understands the cause before altering the model.
Why this answer
The first step is always to validate the alert to ensure it's not a false positive before taking drastic action.
Which TWO types of documentation are critical for AI Transparency requirements?
Data transparency is crucial for assessing data-driven risks.
Why this answer
Model Cards (transparency) and Data Sheets for Datasets (provenance) are the standard documentation requirements for transparent AI.
Which TWO metrics are most appropriate for measuring the effectiveness of an AI Risk Program?
This tracks program responsiveness and risk occurrence.
Why this answer
Percentage of models risk-assessed and the number of incidents are clear quantitative KPIs for program success.
A financial institution uses an AI model to approve loans. After deployment, they notice the model is rejecting loan applications from a specific region at a rate 30% higher than historical human benchmarks. What is the most appropriate next step in the risk lifecycle?
This identifies if the model is responding to a shift in input population or if the bias is inherent to the model logic.
Why this answer
Investigation of bias requires a root cause analysis of input distributions and model weights compared to the baseline.
Which of the following is an example of 'Data Quality Risk' in the AI lifecycle?
Inaccurate labels lead to poor model training and incorrect predictions.
Why this answer
Data quality risk includes issues like missing values, noisy data, or incorrect labeling that degrade model performance.
Which THREE strategies are effective for mitigating 'Adversarial Risk' in an AI lifecycle?
Makes reconnaissance and model inversion harder.
Why this answer
Input sanitization, rate limiting, and adversarial training are established security controls for AI.
You are mapping existing ISO 31000 risk management processes to an AI-specific application. Which step is most crucial to ensure 'Risk Treatment' is appropriately scaled for AI?
ISO 31000 mandates proportionality, which in AI is achieved through risk-based tiering.
Why this answer
Risk treatment in AI requires context-aware decisions based on the risk profile of the specific model (e.g., impact of failure). Tiering controls based on the model's risk impact ensures that high-risk models receive more robust mitigations.
Which of the following is a classic example of 'AI Hallucination' that needs monitoring?
Hallucination is the generation of incorrect, fabricated, but plausible-looking info.
Why this answer
Hallucinations are incorrect or nonsensical outputs that can pose reputational risks to an organization.
A retail company uses an AI model for dynamic pricing. The model's risk score recently exceeded the 'Moderate' threshold. As per the AI Governance framework, what is the mandatory next step?
Escalation ensures that risk owners are aware and can decide on remediation.
Why this answer
When an AI risk score crosses a predefined threshold, escalation to the risk committee or manual oversight is required.
Why is it critical to have 'Human-in-the-Loop' (HITL) for high-risk AI decisions?
Human review is a fundamental control for managing high-risk automated decisions.
Why this answer
HITL ensures that a person reviews critical decisions, providing an essential safeguard against machine errors.
Which TWO teams should be involved in the initial risk review for an AI chatbot?
They understand the technical limitations of the bot.
Why this answer
Chatbots interact directly with users, requiring input from Legal (for compliance) and Data Science (for technical behavior).
In the context of the 'AI Lifecycle', what is the risk of 'Model Decay'?
This is the definition of model decay; the model's predictive value decreases because the 'world' it was trained on has moved on.
Why this answer
Model decay (or obsolescence) occurs when the environment changes such that the model's learned patterns are no longer valid.
When integrating AI risk into the corporate GRC (Governance, Risk, and Compliance) platform, what is the best practice for handling 'AI Model Drift' alerts?
GRC integration allows for consistent monitoring and auditing of model health.
Why this answer
Model drift alerts should be categorized as risk indicators and integrated into the GRC's automated incident response or reporting workflow.
When reporting AI risks to the Board of Directors, which THREE elements should be included to ensure informed decision-making?
Ethical alignment is a critical board-level oversight responsibility.
Why this answer
Board-level reports must focus on strategic impact, compliance posture, and high-level risk exposure.
Which THREE factors should be evaluated when reviewing an AI model for 'Fairness'?
Fairness is measured by comparing outcomes between groups.
Why this answer
Fairness assessment covers data representation, metric definitions, and outcome disparities.
Which governance mechanism is most effective for ensuring that AI ethical risks are addressed during the 'Design' phase of the AI Lifecycle?
Stage-gate processes force compliance with governance requirements before moving to the next phase.
Why this answer
Ethical AI reviews (sometimes called 'Ethics by Design' reviews) are proactive assessments conducted during the design phase to identify potential negative societal impacts before code is written, integrating ethics into the development lifecycle.
A financial firm is integrating AI risk into its ERM. The Chief Risk Officer asks for a mapping between the NIST AI Risk Management Framework (RMF) and the existing COSO ERM framework. Which action most effectively facilitates this alignment?
Aligning framework functions ensures that AI-specific risks are visible within the existing enterprise reporting structure.
Why this answer
Mapping functions like 'Govern' and 'Map' in NIST AI RMF directly correlate to COSO's 'Governance and Culture' and 'Strategy and Objective-Setting' components.
A company is integrating an AI model that uses 'Online Inference'. What is the most significant risk regarding model security?
Exposed endpoints allow attackers to query the model repeatedly to reconstruct training data or extract model logic.
Why this answer
Online inference endpoints are exposed to the public/network, creating surface area for adversarial attacks.
Which of the following is a primary risk during the 'Deployment' stage of the AI lifecycle?
The 'training-serving skew' is a major risk during deployment.
Why this answer
Deployment involves the risk of performance degradation, infrastructure failure, or unexpected interactions with other systems.
When an AI model fails in production, what is the 'Post-Mortem' goal?
The primary goal is organizational learning and risk reduction.
Why this answer
The goal is to identify the root cause so that the AI risk framework can be updated to prevent recurrence.
Which team is usually responsible for the 'Technical Implementation' of risk controls in an AI model?
The team building the model must implement the controls.
Why this answer
Data Science and Machine Learning Engineers are responsible for embedding the risk controls (e.g., constraints, filters) into the models themselves.
In an AI risk program, how should 'Residual Risk' be treated?
Formal acceptance and periodic review are required to keep the risk within defined bounds.
Why this answer
Residual risk is the risk that remains after controls are applied; it must be periodically reviewed against the established appetite.
Page 3 of 3
Practice AAIR by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →