Courseiva

CCNA AI Risk Governance And Framework Integration Questions

72 questions · AI Risk Governance And Framework Integration · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

You are mapping AI risks to the NIST AI RMF. Which step is essential when documenting the 'Map' function for a high-risk autonomous system?

A.Identifying and documenting the context and intended use
B.Updating the SOC2 Type II report
C.Automating the model deployment pipeline
D.Conducting a quarterly penetration test
AnswerA

The Map function establishes context: intended purpose, users, affected populations, operating environment and constraints. Documenting these for a high-risk autonomous system frames all subsequent risk identification and measurement, ensuring later Assess and Manage activities target the actual deployment scenario.

Why this answer

Identifying and documenting the context and intended use is the foundation of mapping AI risks to an enterprise framework.

Practice this question →
2
Multi-Selecthard

The AI Governance Committee is defining the roles for AI Risk oversight. Which TWO functions are essential for the 'Three Lines of Defense' model in AI Risk?

Select 2 answers
A.AI development teams performing self-assessments.
B.The AI Ethics Committee drafting external press releases.
C.The Chief Information Officer managing all AI infrastructure.
D.External vendors providing cloud infrastructure.
E.The AI Risk Management function providing independent oversight.
AnswersA, E

In the Three Lines of Defense model, the first line comprises operational and development teams who own and manage risk directly, performing self-assessments of their own AI systems. This makes AI development teams' self-assessments an essential first-line function.

Why this answer

In the Three Lines of Defense model, the first line consists of the operational teams that own and manage risk directly, so option A (AI development teams performing self-assessments) is correct because these teams are the ones building and running AI systems and must perform self-assessments as their first-line risk ownership responsibility. The second line provides independent oversight, monitoring, and challenge to the first line, so option E (the AI Risk Management function providing independent oversight) is correct because it is the dedicated risk function that establishes policies, frameworks, and independent review over AI risks. Option B is incorrect because drafting external press releases is a communications activity, not a risk oversight function within the Three Lines of Defense.

Option C is incorrect because managing AI infrastructure is an operational/technology responsibility that would sit in the first line, not a distinct defense layer for AI risk oversight. Option D is incorrect because external vendors supplying cloud infrastructure are third parties, not an internal line of defense in the model.

Exam trap

AAIR often tests the tendency to confuse operational or communications roles with the independent oversight functions required by the Three Lines of Defense model, so candidates must distinguish first-line ownership from second-line oversight.

Practice this question →
3
MCQeasy

What is the first step in performing an AI Risk Assessment?

A.Hiring a security consultant.
B.Updating the company website.
C.Running a bias test.
D.Defining the scope, context, and purpose of the AI system.
AnswerD

Defining scope, context and purpose establishes the boundaries, intended use and environment of the AI system, which every subsequent risk identification, analysis and evaluation activity depends on. Without this foundation, risks cannot be assessed against the correct operational and regulatory criteria.

Why this answer

Per ISO 31000 and NIST AI RMF, every risk assessment begins with establishing scope, context, and purpose — defining which AI system is being assessed, its boundaries, stakeholders, operating environment, and the objectives of the assessment. Without this foundational step, subsequent activities like bias testing or control selection lack a reference frame and may address the wrong risks or miss critical ones. This mirrors ISO 31000 Clause 6.3.1, which explicitly places 'defining scope and context' as the first activity in the risk assessment process.

Exam trap

AAIR often tests whether candidates recognize that scoping/context-setting is the mandatory first step, versus jumping to technical activities like bias testing that presuppose scope is already defined.

How to eliminate wrong answers

Option A is wrong because hiring a security consultant is a resourcing decision, not a methodological step — consultants may assist with the assessment but their engagement does not constitute the first analytical step. Option B is wrong because updating the company website is entirely unrelated to risk assessment methodology and represents a distractor. Option C is wrong because running a bias test is a specific technical assessment activity that presupposes you already know which model, dataset, and fairness dimensions are in scope — it cannot logically precede scoping.

Practice this question →
4
Multi-Selecthard

You are integrating AI governance into the existing Corporate Governance framework. Which THREE of the following activities are essential to ensure the Board of Directors maintains adequate oversight?

Select 3 answers
A.Reviewing and approving the organization's AI Risk Appetite Statement.
B.Installing software patches on all GPU servers.
C.Designating executive-level accountability for AI risk management outcomes.
D.Conducting daily code reviews of all AI training algorithms.
E.Establishing a reporting cadence for significant AI-related risk incidents and model performance trends.
AnswersA, C, E

Reviewing and approving the AI Risk Appetite Statement is a core Board responsibility, since setting risk tolerance is a governance function that cannot be delegated to management. This activity satisfies the stem's oversight constraint by ensuring the Board formally defines how much AI risk the organization is willing to accept before any AI initiative proceeds.

Why this answer

Option A is correct because the Board's core governance role includes setting and approving the organization's risk appetite, and an AI Risk Appetite Statement translates that mandate into explicit tolerance thresholds for AI-specific risks (e.g., bias, model drift, data privacy), giving the Board a formal basis for oversight. Option C is correct because designating executive-level accountability (e.g., a Chief AI Officer or an AI risk owner at the C-suite) establishes clear ownership and escalation paths, which is a fundamental governance control ensuring the Board can hold management responsible for AI risk outcomes. Option E is correct because a defined reporting cadence for significant AI-related risk incidents and model performance trends provides the Board with timely, recurring visibility into AI risk posture, enabling informed oversight and intervention consistent with corporate governance principles.

Options B and D are not Board-level governance activities: patching GPU servers is an operational IT maintenance task, and daily code reviews of training algorithms are tactical engineering controls, both of which belong to management and technical teams rather than the Board's oversight responsibilities.

Exam trap

AAIR often tests the confusion between operational/technical tasks (patching, code review) and genuine Board-level governance activities (appetite approval, accountability designation, reporting cadence).

Practice this question →
5
MCQmedium

A firm adopts the 'Three Lines of Defense' model for AI. What is the specific responsibility of the 'Third Line' (Internal Audit)?

A.Providing independent assurance on the design and effectiveness of the AI governance framework.
B.Approving AI model deployment.
C.Developing the AI models.
D.Defining the AI risk appetite.
AnswerA

Internal Audit sits outside management, so it provides independent assurance that the AI governance framework is designed and operating effectively. This satisfies the stem's Third Line definition, distinct from the First Line's ownership and the Second Line's oversight.

Why this answer

The Third Line of Defense in the Three Lines of Defense model is Internal Audit, which provides independent, objective assurance to the board and senior management on the design and operating effectiveness of the AI governance framework, including risk management and controls. It does not own or operate AI controls; it evaluates them. This independence is what distinguishes it from the First Line (business/IT operations) and Second Line (risk/compliance).

Exam trap

The trap here is confusing the oversight role of the Second Line (risk/compliance) with the independent assurance role of the Third Line (Internal Audit) — candidates often pick 'approving' or 'defining' activities that actually belong to management or the board.

How to eliminate wrong answers

Option B is wrong because approving AI model deployment is a First Line (business/technology owner) or governance committee responsibility, not an independent audit function — auditors must not approve the very things they later audit. Option C is wrong because developing AI models is a First Line operational activity performed by data science/engineering teams, which would destroy audit independence. Option D is wrong because defining the AI risk appetite is a board and executive management responsibility, often informed by the Second Line (risk function), not Internal Audit.

Practice this question →
6
MCQhard

When reporting AI risk to the board, which approach best demonstrates 'Risk Culture' maturity?

A.Listing all AI projects currently in production with their budget spend.
B.Reporting solely on the number of successful cyber attacks against the AI infrastructure.
C.Presenting a heatmap showing residual risk levels against the defined enterprise risk appetite.
D.Providing a list of all AI models currently undergoing training.
AnswerC

A residual-risk heatmap mapped to the enterprise risk appetite evidences mature risk culture because it shows governance actively comparing tolerated exposure against agreed limits, not merely listing threats. This satisfies the stem's reporting constraint: the board sees quantified, appetite-aligned decisions, demonstrating that risk ownership and escalation are embedded rather than ad hoc.

Why this answer

Presenting a heatmap of residual risk against the enterprise risk appetite demonstrates Risk Culture maturity because it shows the board not just what risks exist, but how they compare to the organization's stated tolerance thresholds. This reflects an integrated, governance-driven approach where risk is quantified, contextualized, and actively managed rather than merely inventoried. Mature risk culture requires translating technical AI risk into business-relevant terms that support informed decision-making at the board level.

Exam trap

The trap here is confusing activity reporting (projects, budgets, attacks) with risk reporting — candidates pick the option that sounds most 'executive' rather than the one that actually ties risk to appetite.

How to eliminate wrong answers

Option A is wrong because listing AI projects with budget spend is an asset/inventory report, not a risk report — it says nothing about likelihood, impact, or tolerance. Option B is wrong because counting successful cyber attacks is a lagging, narrow security metric that ignores model risk, bias, drift, and other AI-specific risks. Option D is wrong because listing models in training is an operational status update with no risk quantification or appetite alignment.

Practice this question →
7
Multi-Selecthard

Which THREE items should be included in an AI 'Risk Assessment' report for a new project?

Select 3 answers
A.Identification of potential failure modes and their impact.
B.The favorite color of the lead developer.
C.The residual risk level after applying controls.
D.A list of all competitors currently using the same software.
E.Documentation of mitigating controls for identified risks.
AnswersA, C, E

Identifying potential failure modes and their impact directly satisfies the risk assessment requirement by mapping what could go wrong and the severity of each outcome. This structured analysis lets stakeholders prioritise mitigations before deployment, covering both likelihood and consequence dimensions essential to a defensible AI risk report.

Why this answer

A complete report covers the risk identification, the impact analysis, and the control strategy.

Practice this question →
8
MCQmedium

What is the primary benefit of documenting 'AI Model Lineage'?

A.It ensures the model is smaller in file size.
B.It provides transparency, auditability, and the ability to reproduce models.
C.It helps the marketing team write better ads.
D.It makes the model run faster.
AnswerB

AI model lineage records the datasets, code, parameters and transformations that produced each model version. This traceable chain delivers transparency, supports audits, and lets teams reproduce or rebuild a model exactly, which is the primary benefit the question asks for.

Why this answer

Documenting AI Model Lineage provides transparency, auditability, and reproducibility by capturing the full chain of data sources, transformations, hyperparameters, code versions, and dependencies used to produce a model. This record allows auditors and regulators to trace how a model was built, verify compliance with policies, and reproduce or re-validate the model when needed. It is a foundational governance artifact rather than a performance optimization.

Exam trap

AAIR often tests the misconception that governance documentation like lineage improves model performance or efficiency, when its actual purpose is transparency, auditability, and reproducibility.

How to eliminate wrong answers

Option A is wrong because model lineage documentation has no effect on the file size of a model; file size is determined by architecture, parameter count, and quantization, not by documentation. Option C is wrong because lineage is a technical and governance record for traceability and compliance, not a marketing input for advertising copy. Option D is wrong because documentation does not change runtime performance; inference speed depends on model architecture, hardware, and optimization techniques such as quantization or pruning, not on lineage records.

Practice this question →
9
Multi-Selectmedium

Which TWO of the following governance actions should a Chief Risk Officer (CRO) implement to align AI risk with the COSO Enterprise Risk Management (ERM) framework?

Select 2 answers
A.Establish a cross-functional AI Risk Committee
B.Assign AI risk ownership to individual data scientists
C.Disable all open-source AI libraries
D.Mandate daily model training cycles
E.Define AI-specific risk appetite statements within the ERM policy
AnswersA, E

COSO ERM requires governance and oversight structures spanning the entity. A cross-functional AI Risk Committee embeds AI risk into that oversight layer, giving the CRO a formal body to assign accountability, escalate issues and integrate AI into existing ERM reporting lines.

Why this answer

Option A is correct because the COSO ERM framework emphasizes governance and operating structures, and a cross-functional AI Risk Committee establishes the oversight body needed to integrate AI risk across the enterprise and align it with strategic objectives. Option E is correct because COSO ERM requires defining risk appetite and tolerance, so AI-specific risk appetite statements embedded in the ERM policy ensure AI risks are governed within the organization's overall risk posture. Option B is incorrect because assigning AI risk ownership solely to individual data scientists fragments accountability and ignores COSO's principle of enterprise-level ownership and oversight.

Option C is incorrect because disabling all open-source AI libraries is a blunt technical control, not a governance action, and would impede innovation without addressing risk alignment. Option D is incorrect because mandating daily model training cycles is an operational/technical decision unrelated to COSO ERM governance alignment.

Exam trap

AAIR often tests the distinction between governance-level actions (committees, risk appetite) and operational/technical actions (disabling libraries, daily training), tempting candidates to select hands-on controls over framework alignment.

Practice this question →
10
Multi-Selecteasy

Which TWO of the following are considered 'High-Risk' AI use cases that require enhanced oversight by the Governance Committee?

Select 2 answers
A.Basic spell-checking software.
B.AI-powered biometric identification for facility access.
C.Automated recruitment and hiring filtering tools.
D.Email auto-complete features.
E.AI systems used for internal cafeteria menu suggestions.
AnswersB, C

Biometric identification for facility access processes special-category biometric data to make consequential decisions about individuals, placing it in the high-risk category under AI governance frameworks. It therefore requires enhanced oversight, impact assessment and Governance Committee review before deployment.

Why this answer

Option B is correct because AI-powered biometric identification for facility access processes sensitive biometric data and controls physical security, making it a high-risk use case that demands enhanced oversight by the Governance Committee. Option C is correct because automated recruitment and hiring filtering tools directly affect individuals' employment opportunities and can introduce bias or discrimination, which places them in the high-risk category requiring stricter governance. Options A and D are not high-risk since basic spell-checking and email auto-complete are low-impact productivity features with minimal risk to rights or safety.

Option E is also not high-risk because internal cafeteria menu suggestions have negligible impact on individuals and pose no significant compliance or ethical concerns.

Exam trap

AAIR often tests whether candidates can distinguish consequential, rights-affecting AI use cases from benign productivity tools, luring them into over- or under-classifying based on technical sophistication rather than impact.

Practice this question →
11
Multi-Selectmedium

Which THREE items are necessary for a comprehensive 'AI Governance Policy'?

Select 3 answers
A.Standard Operating Procedures (SOPs) for model lifecycle management.
B.A list of every single line of code in the production models.
C.The personal home addresses of all developers.
D.AI risk classification framework (e.g., Low, Medium, High).
E.Definition of roles and responsibilities for AI risk oversight.
AnswersA, D, E

SOPs translate governance principles into repeatable, auditable steps covering model development, validation, deployment, monitoring and retirement. Without documented lifecycle procedures, an AI governance policy remains aspirational and cannot demonstrate consistent, traceable control across every model the organisation operates.

Why this answer

Option A is correct because a comprehensive AI Governance Policy must include Standard Operating Procedures (SOPs) that define the repeatable processes for model lifecycle management, covering stages such as data collection, training, validation, deployment, monitoring, and retirement, which ensures consistency and accountability. Option D is correct because an AI risk classification framework (e.g., Low, Medium, High) is essential for tiering AI systems by potential impact, so that controls, review rigor, and approval levels are proportionate to the risk each system presents. Option E is correct because clearly defining roles and responsibilities for AI risk oversight establishes ownership and accountability — for example, who approves models, who monitors drift, and who handles incidents — which is a foundational element of any governance policy.

Option B is not appropriate because listing every single line of code is an impractical and unnecessary level of detail for a governance policy; governance addresses principles, controls, and processes rather than source code inventories. Option C is not appropriate because collecting developers' personal home addresses is irrelevant to AI governance and would raise serious privacy and data protection concerns.

Exam trap

AAIR often tests whether candidates can distinguish governance artifacts (policies, frameworks, role definitions) from operational or irrelevant items (source code listings, personal data) — distractors like 'every line of code' sound thorough but are impractical.

Practice this question →
12
MCQmedium

In the context of the Three Lines of Defense, which function constitutes the 'Second Line'?

A.The Internal Audit department.
B.The Board of Directors.
C.The AI Development team.
D.The AI Risk Management and Compliance teams.
AnswerD

The Second Line provides independent oversight and challenge of risk decisions made by the business. AI Risk Management and Compliance teams perform exactly this oversight function, sitting between operational management in the First Line and internal audit in the Third Line.

Why this answer

In the Three Lines of Defense model, the Second Line consists of risk management and compliance functions that provide oversight, guidance, and challenge to the First Line (operational/business teams). For AI governance, the AI Risk Management and Compliance teams own frameworks, policies, and monitoring that ensure AI development and deployment align with risk appetite and regulatory requirements. They are independent from day-to-day operations but not fully independent like Internal Audit.

Exam trap

AAIR often tests whether candidates can correctly place functions in the Three Lines model, so they misassign Internal Audit (Third Line) or the Board (governing body) to the Second Line, or mistake a First Line development team for an oversight function.

How to eliminate wrong answers

Option A is wrong because Internal Audit constitutes the Third Line — it provides independent assurance to the board and must remain free from management influence, which is why it cannot sit in the Second Line. Option B is wrong because the Board of Directors sits above the Three Lines model as the governing body that receives assurance from all three lines; it is not itself a line of defense. Option C is wrong because the AI Development team is a First Line function — it owns and manages risk directly through the act of building and operating AI systems.

Practice this question →
13
Multi-Selecthard

When integrating AI risk into existing ERM, which THREE aspects of an AI model lifecycle must be audited to ensure compliance?

Select 3 answers
A.Personnel physical security badges
B.Office climate control settings
C.Model validation results
D.Incident response logs
E.Data lineage and provenance
AnswersC, D, E

Model validation results evidence that the model meets defined performance, fairness and robustness thresholds before deployment. Auditing these records confirms independent testing occurred, satisfying the lifecycle compliance requirement for AI risk integration within enterprise risk management.

Why this answer

Model validation results (C) must be audited because they document whether the AI model meets its stated performance, fairness, and robustness criteria before and after deployment, which is a core control for AI risk within ERM. Incident response logs (D) are essential because they provide evidence that AI-related failures, bias events, or security incidents were detected, escalated, and remediated according to the organization's risk response procedures. Data lineage and provenance (E) must be audited to verify that training, validation, and production data sources are authorized, traceable, and compliant with privacy and quality requirements, which directly affects model reliability and regulatory compliance.

Personnel physical security badges (A) and office climate control settings (B) are facility and environmental controls unrelated to the AI model lifecycle, so they do not belong in an audit of AI risk integration into ERM.

Exam trap

AAIR often tests whether candidates can distinguish AI lifecycle audit artifacts from generic IT/facilities controls; the trap is selecting physical-security or environmental items that sound like 'audit' topics but have no bearing on model risk.

Practice this question →
14
Multi-Selectmedium

A firm is establishing an AI Governance Committee. Which TWO groups should be represented to ensure comprehensive oversight?

Select 2 answers
A.Data Privacy Office
B.Public relations
C.Legal and Compliance
D.Hardware vendors
E.External marketing agencies
AnswersA, C

The Data Privacy Office contributes expertise on personal data handling, consent, retention and cross-border transfer, ensuring AI initiatives satisfy privacy regulation. Their inclusion satisfies comprehensive oversight by covering data-subject impact and privacy risk, which technical and business representatives alone would not adequately assess.

Why this answer

Legal/Compliance and Data Privacy are essential for addressing the regulatory and ethical risks inherent in AI deployments.

Practice this question →
15
MCQeasy

An organization is establishing an AI Risk Committee. Which stakeholder is most critical to include to ensure alignment between enterprise risk appetite and technical AI capabilities?

A.Chief Risk Officer (CRO).
B.Chief Information Security Officer (CISO).
C.Lead Cloud Architect.
D.Head of Human Resources.
AnswerA

The Chief Risk Officer owns the enterprise risk appetite and translates it into tolerances the committee applies. Including the CRO ensures AI technical controls are calibrated to that appetite, satisfying the alignment requirement between governance and engineering capability.

Why this answer

The Chief Risk Officer (CRO) is the executive who owns the enterprise risk appetite and the ERM framework, making them the most critical member to align AI risk governance with the organization's overall risk posture. Including the CRO ensures AI risks are scored, escalated, and mitigated using the same taxonomy and tolerance thresholds applied to financial, operational, and strategic risks. Without CRO involvement, AI risk decisions can drift from enterprise risk appetite.

Exam trap

AAIR often tests the distinction between enterprise risk ownership (CRO) and domain-specific security ownership (CISO) — candidates pick the CISO because AI security sounds like a security problem, but the question asks about enterprise risk appetite alignment.

How to eliminate wrong answers

Option B is wrong because the CISO, while essential for security-specific risks, owns a narrower domain (cyber and information security) and does not set enterprise-wide risk appetite — their scope does not cover model bias, regulatory, or business risk. Option C is wrong because a Lead Cloud Architect is a technical infrastructure role with no enterprise risk mandate and no authority over risk tolerance decisions. Option D is wrong because the Head of HR governs people and culture, not enterprise risk appetite, and has no role in AI risk scoring or mitigation strategy.

Practice this question →
16
Multi-Selectmedium

Which THREE factors are essential to consider when determining the 'AI Risk Appetite' for an enterprise?

Select 3 answers
A.The current market share of the company.
B.The organization's tolerance for legal and reputational damage.
C.The complexity and autonomy level of the AI models being deployed.
D.The existing regulatory landscape and sector-specific compliance requirements.
E.Historical data volume.
AnswersB, C, D

Tolerance for legal and reputational damage directly bounds how much AI risk an enterprise will accept, satisfying the governance constraint that risk appetite must reflect consequences the board deems intolerable. Unlike technical metrics, this factor translates AI failures into enforceable liability and stakeholder trust thresholds, anchoring the appetite statement in measurable exposure limits.

Why this answer

Option B is correct because AI risk appetite must be calibrated to how much legal exposure and reputational harm the organization is willing to absorb, since these are the primary consequence categories of AI failures and directly bound the acceptable risk threshold. Option C is correct because the complexity and degree of autonomy of the deployed AI models determine the severity and likelihood of adverse outcomes, so higher autonomy or opacity requires a more conservative appetite. Option D is correct because the applicable regulatory landscape and sector-specific compliance obligations (for example, EU AI Act risk tiers, HIPAA, or financial-services rules) set non-negotiable limits that the risk appetite cannot exceed.

Option A is not essential because market share is a business-performance metric that does not define risk tolerance boundaries. Option E is not essential because historical data volume is an input to model development and data-governance decisions, not a determinant of how much AI risk the enterprise is willing to accept.

Exam trap

The trap is selecting business or technical metrics (market share, data volume) that sound relevant to AI but do not actually define risk tolerance — the exam tests whether you understand that risk appetite is about acceptable harm, not operational scale.

Practice this question →
17
Multi-Selectmedium

When designing an AI Risk Reporting dashboard for senior management, which TWO of the following should be visualized?

Select 2 answers
A.Server uptime percentages.
B.Raw model prediction scores for every transaction.
C.Status of compliance certifications for high-risk models.
D.Aggregate risk score per business unit.
E.Employee training attendance logs.
AnswersC, D

Displaying compliance certification status for high-risk models shows senior management whether regulatory and internal obligations are currently met, satisfying the stem's reporting requirement. It highlights expired or pending attestations needing escalation, complementing aggregate risk scoring with governance assurance.

Why this answer

Option C is correct because senior management needs visibility into the governance posture of high-risk AI models, and tracking the status of compliance certifications (e.g., ISO/IEC 42001, SOC 2, or EU AI Act conformity assessments) directly supports regulatory oversight and accountability. Option D is correct because an aggregate risk score per business unit condenses model-level risk metrics into a decision-ready KPI that lets executives compare exposure, prioritize mitigation funding, and track risk appetite across the organization. Option A is not appropriate because server uptime is an infrastructure/availability metric that belongs in IT operations dashboards, not an AI risk reporting view for executives.

Option B is not appropriate because raw per-transaction prediction scores are far too granular and technical for senior management, and would create noise rather than actionable risk insight. Option E is not appropriate because employee training attendance is a tactical HR/compliance activity metric, not a strategic AI risk indicator for the board or executive committee.

Exam trap

AAIR often tests audience-appropriateness — candidates pick technically detailed options (raw scores, uptime) because they sound data-driven, but executive dashboards require aggregated, governance-relevant metrics, not operational noise.

Practice this question →
18
MCQeasy

What is the goal of an AI 'Model Inventory'?

A.To maintain visibility over all AI models and their associated risk profiles.
B.To automatically delete old models.
C.To provide marketing data to competitors.
D.To increase the speed of model deployment.
AnswerA

A Model Inventory provides a centralised register of every AI model in use, capturing ownership, purpose and risk classification. This directly satisfies the stem's goal by delivering the visibility and risk-profile oversight that governance, audit and regulatory reporting demand across the organisation's AI estate.

Why this answer

An AI Model Inventory is a centralized register that maintains visibility over all AI models in use, including their purpose, owner, data sources, version, and risk classification. Its primary goal is governance and risk management — you cannot govern what you cannot see. It enables oversight, audit, and lifecycle management rather than deployment speed or data sharing.

Exam trap

The trap is confusing the inventory's governance purpose (visibility and risk tracking) with operational side effects (deletion, speed, data sharing) — candidates may pick an action that the inventory enables rather than its actual goal.

How to eliminate wrong answers

Option B is wrong because automatically deleting old models is a lifecycle management action that may or may not be triggered by inventory data, but it is not the goal of the inventory itself — the inventory records and tracks models, it does not delete them. Option C is wrong because providing marketing data to competitors is nonsensical and contrary to the confidentiality purpose of an inventory; inventories are internal governance artifacts. Option D is wrong because increasing deployment speed is an operational benefit that might result from better visibility, but it is not the goal — the goal is risk visibility and accountability, and speed can even be constrained by governance.

Practice this question →
19
MCQhard

A multinational bank has assigned its AI governance responsibilities across the Three Lines of Defense. The second line has drafted an AI risk appetite statement, but the board wants assurance that the first line's AI use cases remain within that appetite. Which activity should the second line perform to provide this assurance while preserving its independence?

A.Directly approve or reject each first-line AI use case before deployment.
B.Independently review first-line AI risk assessments and challenge whether residual risk remains within the approved appetite.
C.Operate the AI monitoring dashboards and tune alert thresholds for model drift.
D.Commission an external audit of the AI governance program and report findings to the board.
AnswerB

Independent review and challenge of first-line AI risk assessments is a core second-line oversight activity. It provides assurance that residual risk is measured consistently against the board-approved appetite without taking ownership of the use case, preserving the objectivity required for effective Three Lines of Defense governance.

Why this answer

Second-line assurance over AI risk appetite is delivered through independent review and credible challenge of first-line assessments, not by taking over operational controls or audit functions. This keeps risk ownership with the first line while giving the board objective evidence that residual AI risk is being managed within the approved appetite.

Exam trap

The trap here is confusing oversight with ownership, assuming the second line must approve AI use cases rather than independently challenge the first line's risk assessments.

Practice this question →
20
MCQeasy

Which of the following is an example of an 'AI Risk' in a customer-facing service?

A.A chatbot providing inaccurate information to a customer.
B.The CEO deciding to change the corporate strategy.
C.The office printer running out of ink.
D.A scheduled maintenance window for the website.
AnswerA

Inaccurate chatbot responses are a risk because the generative model can produce plausible but false output, misleading customers and potentially causing harm or compliance breaches. This is an AI-specific risk, not a conventional infrastructure failure.

Why this answer

An AI risk in a customer-facing service is a harm or failure arising from the AI system's behavior — a chatbot providing inaccurate information is a classic example of hallucination/misinformation risk, which can mislead customers, cause financial or reputational harm, and create liability. It is directly attributable to the AI model's output quality and is a recognized risk category in AI governance frameworks.

Exam trap

AAIR often tests whether candidates can distinguish AI-specific risks (model behavior, data, output) from generic business or IT operational events — the distractors are mundane non-AI issues designed to look like risks.

How to eliminate wrong answers

Option B is wrong because a CEO changing corporate strategy is a business/strategic decision, not an AI system risk. Option C is wrong because a printer running out of ink is an operational facilities issue unrelated to AI. Option D is wrong because a scheduled maintenance window is planned IT operations, not an AI risk.

Practice this question →
21
MCQeasy

Which document should a practitioner review to determine the organization's threshold for acceptable AI model bias?

A.The vendor's Service Level Agreement (SLA).
B.The Enterprise Risk Appetite Statement.
C.The software's End User License Agreement (EULA).
D.The AI development team's sprint backlog.
AnswerB

The Enterprise Risk Appetite Statement formally records the organisation's willingness to accept risk, including the tolerance thresholds for AI model bias. It is the authoritative source for determining what level of bias is deemed acceptable.

Why this answer

The Enterprise Risk Appetite Statement is the governing document that defines how much risk the organization is willing to accept across its operations, including acceptable thresholds for AI model bias. It translates board-level risk tolerance into measurable limits that AI teams must design and validate against. Reviewing it tells a practitioner what bias level is tolerable versus what would breach organizational policy.

Exam trap

AAIR often tests whether candidates can distinguish governance documents (risk appetite, policy) from operational or legal documents (SLA, EULA, backlog), so the trap is selecting a document that sounds authoritative but does not define risk tolerance.

How to eliminate wrong answers

Option A is wrong because a vendor SLA defines service availability, support response times, and uptime commitments, not the organization's internal tolerance for model bias. Option C is wrong because an EULA is a legal license agreement governing software usage rights and liability, not a risk tolerance document. Option D is wrong because a sprint backlog is a tactical Agile artifact listing development tasks, not a governance document defining acceptable risk levels.

Practice this question →
22
MCQmedium

A manufacturing firm is adopting a 'Privacy by Design' approach for AI. How does this integrate with the AI Risk Governance framework?

A.Privacy becomes the responsibility of the vendor, not the company.
B.Privacy controls are integrated into the MLOps pipeline as automated gates.
C.Privacy is only reviewed after the model is deployed.
D.Privacy impact assessments are excluded to speed up model deployment.
AnswerB

Embedding privacy controls as automated gates in the MLOps pipeline enforces Privacy by Design at each stage, from data ingestion to model deployment, so privacy risk is governed continuously rather than reviewed once, integrating directly with the AI Risk Governance framework's controls.

Why this answer

Privacy by Design (PbD) is a proactive principle that requires embedding privacy protections into systems from the outset, not as an afterthought. In an AI Risk Governance framework, this translates to operationalizing privacy controls—such as data minimization, consent checks, and anonymization—as automated gates within the MLOps pipeline. This ensures that every model training, evaluation, and deployment step adheres to privacy requirements before progressing, making privacy an integral, continuous part of the AI lifecycle rather than a one-time or post-hoc review.

Exam trap

AAIR often tests the misconception that Privacy by Design is a post-deployment or vendor-only responsibility, when it actually requires proactive, organization-wide integration into every stage of the AI lifecycle.

How to eliminate wrong answers

Option A is wrong because Privacy by Design places responsibility on the organization deploying the AI, not solely on the vendor; the company remains accountable for compliance and ethical use. Option C is wrong because Privacy by Design mandates privacy considerations throughout the entire lifecycle, not just after deployment; post-deployment review is reactive and violates the proactive principle. Option D is wrong because Privacy Impact Assessments (PIAs) are a core component of Privacy by Design and AI risk governance; excluding them increases risk and non-compliance, directly contradicting the framework's goals.

Practice this question →
23
MCQhard

In the context of the AI RMF, what is the significance of the 'Measure' function for risk management?

A.To identify which employees have access to the AI system.
B.To set the budget for future AI projects.
C.To provide a score for the developers' performance.
D.To evaluate the model's performance and risk outcomes against established benchmarks.
AnswerD

The Measure function quantifies AI risk by testing, analysing and tracking model performance and outcomes against defined benchmarks and metrics. This produces the evidence needed to assess whether risks fall within tolerance, satisfying the stem's requirement to evaluate performance and risk outcomes.

Why this answer

The Measure function of the AI RMF is responsible for evaluating AI systems' performance, trustworthiness characteristics, and risk outcomes against defined benchmarks and metrics. It provides the quantitative and qualitative evidence needed to determine whether risks are within tolerance and whether the system meets its intended purpose. This function operationalizes the risk assessment by turning identified risks into measurable indicators.

Exam trap

AAIR often tests the confusion between Measure (evaluating performance and risk outcomes) and Manage (implementing risk treatments), causing candidates to select an operational or governance activity that belongs to a different function.

How to eliminate wrong answers

Option A is wrong because identifying employee access is an access control and identity management activity, which falls under the Govern or Manage functions, not Measure. Option B is wrong because setting budgets for future AI projects is a financial planning activity unrelated to the Measure function's purpose of evaluating model performance and risk outcomes. Option C is wrong because scoring developer performance is a human resources function; the Measure function evaluates the AI system and its risks, not individual employee productivity.

Practice this question →
24
MCQhard

An organization discovers that an AI model has learned a bias from training data. Per the AI Risk framework, what should be the immediate priority of the Governance function?

A.Suspend the model's usage and conduct a formal root cause analysis.
B.Wait for the quarterly board report to inform the board.
C.Fire the AI development team.
D.Retrain the model on the same data set to see if it fixes itself.
AnswerA

Suspending the model immediately contains the bias exposure while a formal root cause analysis traces the training-data defect, satisfying the Governance function's mandate to enforce accountability and risk controls before remediation. Governance prioritises containment and documented investigation over technical fixes, which belong to development teams once the risk is bounded.

Why this answer

When bias is discovered in a model, the Governance function's immediate priority is to suspend the model's usage to prevent ongoing harm and then conduct a formal root cause analysis to determine how the bias entered and how to remediate it. This aligns with the AI risk framework's emphasis on containment before correction, protecting affected stakeholders and preserving evidence. Waiting or retraining on the same data would perpetuate the harm.

Exam trap

AAIR often tests the instinct to jump to remediation or retraining, when the correct immediate governance action is containment (suspension) followed by root cause analysis to prevent ongoing harm.

How to eliminate wrong answers

Option B is wrong because waiting for a quarterly board report delays containment of an active harm and violates the principle of timely escalation and remediation in AI risk frameworks. Option C is wrong because firing the development team is a punitive, non-technical response that does not address the root cause and may destroy institutional knowledge needed for remediation. Option D is wrong because retraining on the same biased dataset will reproduce or amplify the bias; remediation requires data correction, re-sampling, or algorithmic mitigation, not repetition.

Practice this question →
25
MCQmedium

What is the primary risk associated with 'Shadow AI' in an organization?

A.It makes the network run slower.
B.It costs too much.
C.It makes the developers work too hard.
D.It bypasses established AI risk governance and compliance controls.
AnswerD

Shadow AI covers unsanctioned tools and models deployed outside IT visibility, so its primary risk is bypassing established AI risk governance and compliance controls. Because these systems evade approved review, monitoring and data-handling requirements, the organisation loses assurance over regulatory and ethical obligations.

Why this answer

Shadow AI refers to AI tools deployed without the knowledge or oversight of the governance team, creating invisible, unmanaged risks.

Practice this question →
26
MCQmedium

A retail insurer is mapping its new generative AI claims assistant against the NIST AI Risk Management Framework. The Chief Risk Officer wants the framework functions to be traceable to existing enterprise risk processes. Which mapping approach best integrates the AI RMF functions with the insurer's ERM framework?

A.Apply the AI RMF only after the generative AI assistant has been deployed to production.
B.Treat the AI RMF as a standalone compliance checklist separate from the ERM framework.
C.Replace the ERM framework with the AI RMF for all technology-related risks.
D.Map Govern, Map, Measure, and Manage outcomes to existing ERM risk identification, assessment, treatment, and monitoring activities.
AnswerD

Aligning the AI RMF functions with established ERM activities allows AI risks to be identified, assessed, treated, and monitored through processes the insurer already operates. This produces traceability from framework outcomes to risk register entries and board reporting, which is exactly the integration the CRO requires.

Why this answer

The AI RMF is most effective when its functions are threaded into existing ERM identification, assessment, treatment, and monitoring activities. This gives the insurer a single risk picture, traceable from AI-specific outcomes to enterprise risk registers and board reporting, rather than a parallel compliance exercise.

Exam trap

The trap here is treating the AI RMF as a separate compliance checklist instead of mapping its functions into the ERM processes the organization already uses.

Practice this question →
27
Multi-Selecthard

Which THREE components must be included in an AI Model 'Control Framework' to ensure effective risk mitigation?

Select 3 answers
A.Hardware power usage tracking.
B.Access management controls restricting model usage.
C.Public disclosure of all model architecture details.
D.Manual approval gates for model deployment.
E.Automated version control for model training code.
AnswersB, D, E

Access management controls restrict who and what can invoke the model, enforcing least privilege and preventing unauthorised use or data exposure. This satisfies the risk-mitigation requirement by governing model consumption, complementing data, monitoring and lifecycle controls within the Control Framework.

Why this answer

Option B (Access management controls restricting model usage) is correct because enforcing authentication, authorization, and least-privilege access to AI models prevents unauthorized use, tampering, or data exfiltration, which are core risk-mitigation controls in any AI control framework. Option D (Manual approval gates for model deployment) is correct because human-in-the-loop approval before promoting a model to production ensures that risk, compliance, and performance checks are satisfied before the model can affect real users or systems. Option E (Automated version control for model training code) is correct because tracking code, data, and configuration changes with automated version control provides reproducibility, auditability, and rollback capability, which are essential for detecting and remediating model-related risks.

Option A (Hardware power usage tracking) is not a required control-framework component for risk mitigation, as it addresses cost or sustainability monitoring rather than AI risk governance. Option C (Public disclosure of all model architecture details) is not required and would often increase risk by exposing intellectual property and attack surface, so it does not belong in a risk-mitigation control framework.

Exam trap

AAIR often tests the misconception that operational metrics like power usage or full transparency are core risk controls, when the focus should be on governance, security, and reproducibility mechanisms.

Practice this question →
28
MCQmedium

A multinational corporation is aligning its AI risk governance with the NIST AI Risk Management Framework (AI RMF). The Chief Risk Officer wants to ensure that the organization's risk appetite for AI is clearly articulated and integrated into decision-making. Which action best supports this objective?

A.Adopting the risk appetite of a leading technology company without modification to save time.
B.Delegating AI risk appetite definition to the data science team to ensure technical feasibility.
C.Developing a statement of AI risk appetite that defines acceptable levels of risk for different categories of AI systems, approved by the board.
D.Requiring all AI projects to undergo a full quantitative risk assessment using Monte Carlo simulation.
AnswerC

Developing a board-approved AI risk appetite statement directly supports the integration of risk appetite into decision-making. It provides clear guidance on acceptable risk levels, enabling consistent risk-based decisions across the organization. The AI RMF Govern function emphasizes the importance of a risk appetite framework. Board approval ensures top-level commitment and authority, making it a cornerstone of effective AI risk governance.

Why this answer

The correct action is to develop a board-approved statement of AI risk appetite that defines acceptable risk levels for different AI categories. This directly articulates risk appetite and integrates it into decision-making by providing clear guidance. It aligns with the AI RMF Govern function, which requires a risk appetite framework to guide AI risk management.

Board approval ensures authority and alignment with enterprise strategy.

Exam trap

The trap here is assuming that technical teams or external benchmarks can define risk appetite, when it is a strategic decision requiring board-level approval.

Practice this question →
29
MCQeasy

Which department is primarily responsible for ensuring AI models comply with data protection regulations like GDPR?

A.The Sales force.
B.The Accounting Department.
C.The Compliance/Legal Department and the Data Protection Officer.
D.The Janitorial staff.
AnswerC

The Compliance/Legal Department and the Data Protection Officer hold statutory accountability for GDPR adherence, interpreting lawful bases, data subject rights and cross-border transfer rules. They independently audit AI models and enforce remediation, satisfying the stem's requirement for regulatory compliance oversight rather than technical model development or deployment.

Why this answer

GDPR compliance for AI models requires legal interpretation of lawful basis, data subject rights, DPIA obligations, and cross-border transfer rules, which sit with the Compliance/Legal Department and the Data Protection Officer. The DPO is specifically mandated under GDPR Articles 37-39 to monitor compliance, advise on DPIAs, and act as the contact point with supervisory authorities. Engineering, sales, and finance teams may implement or consume the model, but they do not own the regulatory interpretation.

Exam trap

The trap is conflating data security ownership (CISO/IT) with data protection compliance ownership (DPO/Legal), causing candidates to select a technical or operational department instead of the legally designated compliance function.

How to eliminate wrong answers

Option A is wrong because Sales is a business function focused on revenue and customer relationships; it has no mandate or expertise to interpret GDPR obligations and may even have a conflict of interest in pushing model deployment. Option B is wrong because Accounting handles financial reporting and controls, not data-protection law, and GDPR compliance is not a financial-reporting function. Option D is wrong because Janitorial staff have no role in regulatory compliance, data governance, or AI oversight; this is a clearly absurd distractor testing whether the candidate recognizes the legally designated compliance roles.

Practice this question →
30
MCQhard

In the context of AI model risk management, what is the role of an 'AI Model Inventory' within the governance framework?

A.To track model metadata, risk ratings, and owners for oversight and audit purposes.
B.To store the actual training data sets for backup.
C.To limit the number of AI developers in the company.
D.To serve as a marketing catalog for external clients.
AnswerA

The inventory is the central register recording each model's metadata, risk rating and accountable owner, enabling ongoing oversight, review and audit evidence. This directly satisfies the governance requirement to maintain traceability and accountability across the model lifecycle.

Why this answer

An AI Model Inventory is the governance system of record that catalogs every model in production or development, capturing metadata such as purpose, owner, version, risk rating, validation status, and dependencies. Its role is to enable oversight, audit, and regulatory reporting by giving risk and compliance teams a single view of the AI estate. This is why option A is correct.

Exam trap

AAIR often tests whether candidates confuse the model inventory with a data repository or a marketing/HR tool; the trap is picking options that describe storing datasets or managing people rather than tracking model metadata and risk ratings.

How to eliminate wrong answers

Option B is wrong because the inventory stores metadata about models, not the training datasets themselves — data storage is handled by data lakes, warehouses, or feature stores. Option C is wrong because the inventory is not a headcount control; limiting developer numbers is an HR/access-management function unrelated to model governance. Option D is wrong because the inventory is an internal governance artifact, not a marketing catalog for external clients.

Practice this question →
31
MCQeasy

A retail company is developing an AI governance framework based on the NIST AI Risk Management Framework (AI RMF). The Chief Risk Officer wants to ensure that the framework includes a process for continuously monitoring AI risks and updating controls. Which AI RMF function primarily addresses this need?

A.Govern
B.Manage
C.Measure
D.Map
AnswerB

The Manage function is responsible for allocating resources to address AI risks, implementing risk responses, and continuously monitoring risks and controls. It involves ongoing oversight, updating controls as needed, and ensuring that risk management is dynamic. This directly addresses the need for continuous monitoring and updating of controls. Manage ensures that risk treatments are effective and adjusted over time.

Why this answer

The Manage function of the AI RMF is designed to continuously monitor AI risks, implement risk responses, and update controls as necessary. It ensures that risk management is an ongoing process, not a one-time activity. This aligns with the need for continuous monitoring and updating of controls to address evolving AI risks.

Exam trap

The trap here is confusing the Measure function with the Manage function; Measure assesses risks, but Manage oversees ongoing monitoring and control updates.

Practice this question →
32
MCQeasy

Which document defines the 'AI Risk Appetite' for an organization?

A.The Employee Training Manual.
B.The IT Service Catalog.
C.The AI Project Status Report.
D.The AI Risk Appetite Statement.
AnswerD

The AI Risk Appetite Statement is the governing document that formally records how much AI-related risk the organisation is willing to accept, giving risk owners the thresholds against which AI initiatives and controls are assessed.

Why this answer

The AI Risk Appetite Statement is the document approved by the Board that defines the risk tolerance for AI activities.

Practice this question →
33
Multi-Selecthard

Which THREE activities are part of the 'AI Risk Management' lifecycle?

Select 3 answers
A.Manual approval of all company emails.
B.Risk Treatment/Mitigation.
C.Risk Identification.
D.Ongoing Monitoring and Review.
E.Writing press releases about AI success.
AnswersB, C, D

Risk Treatment/Mitigation is a core phase of the AI Risk Management lifecycle, where identified and assessed risks are addressed through controls, transfer, avoidance or acceptance. It follows risk identification and analysis, reducing residual risk to acceptable levels before monitoring.

Why this answer

The AI Risk Management lifecycle follows the standard risk management process, which includes Risk Identification (C), where AI-related risks such as bias, data privacy issues, model drift, and security threats are systematically discovered and documented. Risk Treatment/Mitigation (B) is the phase where controls, safeguards, and remediation actions are selected and applied to reduce identified risks to acceptable levels. Ongoing Monitoring and Review (D) is essential because AI systems evolve through retraining, data changes, and environmental shifts, requiring continuous tracking of risk indicators and periodic reassessment of controls.

Option A (manual approval of all company emails) is an operational email-handling procedure, not an AI risk management lifecycle activity, and option E (writing press releases about AI success) is a communications/marketing task unrelated to identifying, treating, or monitoring AI risk.

Exam trap

AAIR often tests whether candidates can distinguish core risk lifecycle activities (identify, treat, monitor) from unrelated business or communications tasks, so distractors like email approval or press releases are designed to sound like governance but lack risk-management substance.

Practice this question →
34
MCQeasy

A multinational corporation is establishing an AI Risk Governance Committee. Who should chair this committee to ensure alignment with enterprise-wide risk appetite?

A.The Chief Technology Officer (CTO).
B.The Chief Risk Officer (CRO).
C.The Lead AI Data Scientist.
D.The Head of Marketing.
AnswerB

The Chief Risk Officer owns the enterprise risk appetite and reporting to the board, so chairing the AI Risk Governance Committee ensures AI risks are assessed against that same appetite. This satisfies the requirement for enterprise-wide alignment rather than a technology-focused or business-unit perspective.

Why this answer

The Chief Risk Officer (CRO) owns the enterprise risk management framework and is the executive accountable for aligning all risk domains — including AI risk — with the organization's stated risk appetite. Chairing the AI Risk Governance Committee ensures AI-specific risks (bias, model drift, regulatory exposure) are evaluated through the same lens as financial, operational, and strategic risks. This preserves a single, coherent risk taxonomy across the enterprise.

Exam trap

AAIR often tests role-to-responsibility mapping — candidates pick the CTO or a data scientist because they are 'closest to AI,' but the exam expects recognition that risk appetite alignment is a CRO function, not a technology function.

How to eliminate wrong answers

Option A is wrong because the CTO is a technology delivery executive focused on architecture and innovation, not on enterprise risk appetite — chairing a risk committee would create a conflict of interest between building and governing AI. Option C is wrong because a Lead AI Data Scientist operates at the technical implementation level and lacks the enterprise-wide risk mandate and board-level authority the role requires. Option D is wrong because the Head of Marketing is a business function leader with no ownership of enterprise risk frameworks and would lack the cross-functional authority to govern AI risk.

Practice this question →
35
MCQeasy

Why is 'AI Literacy' for the board of directors a key component of AI Governance?

A.To allow directors to code their own AI models.
B.To enable effective decision-making regarding AI adoption and risk management.
C.To replace the need for the Chief Risk Officer.
D.To reduce the cost of IT infrastructure.
AnswerB

Boards must weigh AI investment against ethical, regulatory and operational exposure, so literacy gives directors the vocabulary to interrogate risk appetite, challenge assurance evidence and approve adoption decisions with informed oversight rather than deferring entirely to technical teams.

Why this answer

Directors must understand AI risks and benefits to provide informed oversight and define the organization's risk appetite.

Practice this question →
36
MCQhard

An organization is using 'AI Model Monitoring' to track 'Concept Drift'. Why is this a risk governance issue?

A.It indicates the model is running out of memory.
B.It is not a risk issue; it is a maintenance issue.
C.It signals that the model's predictive accuracy is degrading due to changes in the data context.
D.It shows that the model is 'thinking' too slowly.
AnswerC

Concept drift means the statistical relationship between inputs and target changes, so the model's predictions become less accurate over time. That degradation is a governance concern because decisions based on stale models can cause harm, bias, or compliance breaches requiring oversight.

Why this answer

Concept drift occurs when the statistical properties of the target variable change over time, causing the model's predictions to become less accurate. This is a risk governance issue because degraded model performance can lead to poor business decisions, compliance violations, or harm to stakeholders. Monitoring for concept drift is essential to maintain model reliability and trustworthiness.

Exam trap

AAIR often tests the misconception that concept drift is a technical performance issue rather than a governance risk, leading candidates to overlook its impact on compliance and ethics.

How to eliminate wrong answers

Option A is wrong because concept drift is unrelated to memory usage; it concerns changes in data distribution. Option B is wrong because concept drift directly impacts model risk and requires governance oversight, not just routine maintenance. Option D is wrong because concept drift does not refer to computational speed but to changes in the relationship between input and output data.

Practice this question →
37
MCQeasy

Which document is the primary reference for defining an organization's AI Risk Governance structure?

A.The IT hardware inventory report.
B.The employee handbook.
C.The AI Governance Charter/Policy.
D.The AI project development backlog.
AnswerC

The AI Governance Charter or Policy formally assigns roles, decision rights, and oversight bodies, making it the foundational reference for the governance structure. Other artefacts such as risk registers or model cards operate within the authority this charter establishes.

Why this answer

The AI Governance Charter/Policy is the foundational document that defines the organization's AI risk governance structure, including roles, responsibilities, committees, and escalation paths. It is the authoritative reference that establishes how AI risk is owned, reviewed, and controlled across the enterprise. Other documents may reference it but do not define the governance structure itself.

Exam trap

AAIR often tests whether candidates confuse tactical project artifacts (backlogs, inventories) with the formal governance document that establishes authority and accountability.

How to eliminate wrong answers

Option A is wrong because an IT hardware inventory report lists physical assets and has no bearing on governance roles, policies, or risk ownership. Option B is wrong because the employee handbook covers general HR conduct and employment policies, not AI-specific governance structures. Option D is wrong because the AI project development backlog is a tactical work-tracking artifact, not a governance-defining document.

Practice this question →
38
MCQhard

When deploying a generative AI model, what 'Governance Control' is most critical for preventing the generation of harmful/inappropriate content?

A.Increase the number of GPUs to make it faster.
B.Only use the model in an internal environment without internet access.
C.Implement output guardrails and moderation layers.
D.Allow users to provide feedback directly to the model.
AnswerC

Output guardrails and moderation layers inspect model responses before delivery, filtering harmful or inappropriate content that input controls alone cannot catch. This directly satisfies the stem's requirement for the governance control most critical to preventing harmful generative output.

Why this answer

Guardrails are technical controls placed on top of models to intercept and filter output, which is a vital part of risk governance.

Practice this question →
39
Multi-Selectmedium

When building an AI Governance framework, which TWO of the following are essential for ensuring enterprise adoption?

Select 2 answers
A.Providing mandatory 40-hour weekly training sessions.
B.Integration with existing GRC and software delivery workflows.
C.Establishing a clear, collaborative engagement model between risk teams and developers.
D.Using only manual, spreadsheet-based tracking.
E.Requiring all developers to be lawyers.
AnswersB, C

Embedding governance controls into existing GRC and CI/CD tooling removes the need for separate approval portals, so teams satisfy policy checks within pipelines they already use. This directly addresses the adoption constraint: governance that adds friction or duplicate process is bypassed, whereas native integration makes compliance the path of least resistance.

Why this answer

Option B is correct because embedding AI governance controls directly into existing GRC platforms and CI/CD software delivery workflows (e.g., policy gates, automated evidence capture, approval steps) makes compliance a native part of how teams already work, which dramatically lowers friction and drives enterprise adoption. Option C is correct because a clear, collaborative engagement model between risk teams and developers—such as shared review boards, defined RACI, and joint risk-assessment sessions—removes the us-versus-them dynamic and ensures governance requirements are practical and understood, which is essential for sustained adoption. The remaining options do not belong: A is wrong because mandatory 40-hour weekly training is excessive and impractical, creating resistance rather than adoption; D is wrong because manual, spreadsheet-based tracking does not scale, is error-prone, and cannot integrate with enterprise workflows; and E is wrong because requiring all developers to be lawyers is neither feasible nor necessary for effective AI governance.

Practice this question →
40
MCQhard

An organization is evaluating 'Model Risk Management' (MRM) tools for its AI governance. What is the most critical feature to look for to ensure compliance with external regulatory requirements?

A.Automatic social media integration.
B.Comprehensive audit trails of model lineage, versions, and validation results.
C.The ability to run models on mobile devices.
D.The ability to add custom skins to the UI.
AnswerB

Comprehensive audit trails capture model lineage, versions and validation results, giving regulators an immutable record of how each model was built, changed and approved. This directly satisfies the external regulatory requirement for demonstrable, traceable model governance evidence across the model lifecycle.

Why this answer

External regulators require demonstrable traceability: who built the model, what data it used, which version is in production, and what validation it passed. Comprehensive audit trails of model lineage, versions, and validation results (B) provide exactly this evidence and are the cornerstone of MRM compliance. The other options are cosmetic or irrelevant to regulatory requirements.

Exam trap

AAIR often tests whether candidates recognize that regulatory compliance hinges on traceability and evidence (audit trails, lineage, validation records) rather than flashy features (mobile deployment, UI customization) — distractors appeal to product features, not compliance substance.

How to eliminate wrong answers

Option A is wrong because social media integration has no bearing on model risk management or regulatory compliance. Option C is wrong because running models on mobile devices is a deployment capability unrelated to MRM compliance. Option D is wrong because UI customization (custom skins) is a cosmetic feature with zero regulatory relevance.

Practice this question →
41
MCQmedium

How should an 'AI Ethics Committee' interact with the 'AI Risk Governance' body?

A.The Ethics Committee should be responsible for coding the AI.
B.The Ethics Committee should have final veto power over all projects.
C.The Ethics Committee should serve as an advisory body to the governance framework.
D.The Ethics Committee should replace the Risk Governance body.
AnswerC

An advisory role keeps ethics guidance feeding into governance without duplicating decision rights. The committee supplies ethical judgements and recommendations, while the governance body retains accountability for risk decisions and controls, satisfying the stem's requirement for a defined interaction between the two bodies.

Why this answer

An AI Ethics Committee should function as an advisory body that informs and guides the AI Risk Governance framework, providing ethical expertise, stakeholder perspectives, and recommendations on responsible AI use. It does not own the risk decisions or replace governance; instead, it feeds ethical considerations into the governance process so that risk owners can make informed, defensible choices. This separation preserves accountability while ensuring ethics is systematically considered.

Exam trap

AAIR often tests the misconception that an ethics committee should have veto power or replace governance, when its correct role is advisory — candidates confuse influence with authority.

How to eliminate wrong answers

Option A is wrong because coding AI is an engineering function, not the role of an ethics committee — conflating ethics oversight with development destroys independence. Option B is wrong because final veto power over all projects belongs to governance or executive leadership, not an advisory ethics body; giving veto power would blur accountability and stall operations. Option D is wrong because replacing the Risk Governance body eliminates the structured risk management function — ethics and risk governance are complementary, not substitutes.

Practice this question →
42
MCQhard

During a board-level review, a bank needs to demonstrate the effectiveness of its AI Risk Governance. Which metric should be presented to the board to align with the 'Accountability' principle of the AI RMF?

A.The total computational cost of running the models.
B.The percentage of AI models with documented, independent model risk management (MRM) validation.
C.The number of lines of code written for the AI model.
D.The frequency of model retraining cycles.
AnswerB

Documented independent MRM validation demonstrates that models face objective scrutiny separate from their developers, directly evidencing the accountability principle. The percentage metric shows governance coverage across the model inventory, proving oversight is systematic rather than ad hoc.

Why this answer

The Accountability principle of the AI RMF requires that organizations define, document, and assign responsibility for AI risk management, and demonstrate that those responsibilities are being fulfilled. The percentage of AI models with documented, independent MRM validation is a direct, quantifiable measure of whether independent oversight and accountability controls are operating effectively. This metric shows the board that model risk is being independently challenged and validated, which is the essence of accountability in AI governance.

Exam trap

AAIR often tests the confusion between operational metrics (retraining frequency, compute cost) and governance metrics (independent validation coverage), causing candidates to pick a metric that measures activity rather than accountability.

How to eliminate wrong answers

Option A is wrong because computational cost is a financial efficiency metric, not a governance or accountability measure — it says nothing about who is responsible for AI risk or whether controls are working. Option C is wrong because lines of code is a software development productivity metric with no bearing on AI risk governance or accountability. Option D is wrong because retraining frequency is an operational model maintenance metric; while it may indicate model freshness, it does not demonstrate independent validation or assigned accountability for risk outcomes.

Practice this question →
43
Multi-Selectmedium

The board requires a new reporting structure for AI risk. Which TWO of the following should be included in the quarterly AI Risk Report to effectively communicate risk posture?

Select 2 answers
A.The raw output from the model's most recent training iteration.
B.The daily CPU and memory metrics for the inference clusters.
C.The status of the AI risk control roadmap and effectiveness of implemented mitigations.
D.A list of all individual model parameters and weights.
E.An overview of current AI-related residual risks exceeding the organization's defined risk appetite.
AnswersC, E

Reporting roadmap status and mitigation effectiveness gives the board forward-looking assurance on residual AI risk, satisfying the stem's requirement to communicate risk posture rather than raw operational metrics. It shows which controls are live, which remain outstanding, and whether deployed mitigations actually reduce the identified exposures quarter on quarter.

Why this answer

Option C is correct because a quarterly AI Risk Report must communicate governance progress, so reporting the status of the AI risk control roadmap and the measured effectiveness of implemented mitigations shows whether planned controls are on track and actually reducing risk. Option E is correct because risk posture is defined by what remains after treatment, so an overview of current AI-related residual risks that exceed the organization's defined risk appetite gives the board the decision-relevant exceptions requiring acceptance, escalation, or further mitigation. Option A is not appropriate because raw training-iteration output is low-level engineering telemetry, not a risk-posture metric, and it does not map to risk appetite or control effectiveness.

Option B is not appropriate because daily CPU and memory metrics for inference clusters are operational performance data with no direct bearing on AI risk exposure at a quarterly governance level. Option D is not appropriate because listing all model parameters and weights is an unmanageable technical artifact dump that conveys no meaningful risk or control information to the board.

Exam trap

AAIR often tests whether candidates can distinguish strategic risk-posture reporting from operational/technical telemetry — the trap is selecting detailed technical artifacts (weights, CPU metrics, raw outputs) that feel data-rich but do not communicate governance-level risk.

Practice this question →
44
MCQmedium

What is the key purpose of the 'Govern' function in the NIST AI RMF?

A.To troubleshoot hardware issues.
B.To establish the organizational culture, policy, and procedures for AI risk management.
C.To define the marketing strategy for the AI products.
D.To code the AI algorithms.
AnswerB

Govern cultivates a risk-management culture by assigning accountability, defining policies, and documenting procedures across the AI lifecycle. It supplies the organisational scaffolding the other functions — Map, Measure, and Manage — rely on, rather than performing technical measurement itself.

Why this answer

The Govern function in the NIST AI RMF (AI Risk Management Framework 1.0) is one of the four core functions (Govern, Map, Measure, Manage) and is explicitly cross-cutting. Its purpose is to cultivate and implement a culture of risk management via policies, processes, procedures, roles, responsibilities, and accountability structures across the AI lifecycle. It is not a technical execution function — it establishes the organizational scaffolding that enables the other three functions to operate.

Exam trap

AAIR often tests whether candidates confuse the Govern function's organizational/policy focus with technical execution activities like coding, hardware troubleshooting, or business strategy — the trap is picking a plausible-sounding operational task instead of the cultural and procedural scope of Govern.

How to eliminate wrong answers

Option A is wrong because troubleshooting hardware is an operational IT activity, not a governance function — the NIST AI RMF Govern function addresses organizational policy and culture, not infrastructure maintenance. Option C is wrong because marketing strategy is a business/commercial activity unrelated to AI risk management; the AI RMF is concerned with risk, trustworthiness, and accountability, not product promotion. Option D is wrong because coding AI algorithms is a development/engineering activity that falls under implementation, not governance — Govern sets the rules and oversight, it does not write code.

Practice this question →
45
MCQhard

Why is 'Model Validation' (distinct from testing) essential in an AI Governance framework?

A.To ensure the developers have followed the coding standards.
B.To save money on cloud hosting.
C.To provide independent assurance that the model performs as expected and within risk thresholds.
D.To speed up the coding process.
AnswerC

Independent assurance is the crux: validation is performed by parties separate from the development team, so it satisfies governance's need for objective evidence that the model stays within defined risk thresholds. Testing, by contrast, is typically conducted by the builders themselves, which cannot deliver that impartial scrutiny.

Why this answer

Model Validation provides independent assurance that a model performs as expected and stays within defined risk thresholds. Unlike testing (which is typically performed by developers to check functional correctness), validation is an independent governance control that confirms the model meets business, ethical, and regulatory requirements before and after deployment. It is a core pillar of AI governance frameworks because it creates an auditable, objective checkpoint that separates the builder from the assessor.

Exam trap

AAIR often tests the distinction between testing (a developer activity focused on functional correctness) and validation (an independent governance activity focused on assurance and risk thresholds), causing candidates to pick the developer-centric option.

How to eliminate wrong answers

Option A is wrong because coding standards compliance is a software quality/development practice concern, not the purpose of independent model validation in a governance framework. Option B is wrong because cost savings on cloud hosting is a financial/operational optimization unrelated to validation's assurance objective. Option D is wrong because speeding up coding is a developer productivity goal, whereas validation actually adds a deliberate review gate that can slow delivery in exchange for assurance.

Practice this question →
46
MCQmedium

A firm is integrating AI into its ERM (Enterprise Risk Management). What is the primary benefit of a 'Common Risk Taxonomy' for AI?

A.It forces all AI models to be identical.
B.It ensures consistent risk identification, communication, and reporting across the organization.
C.It makes AI code easier to write.
D.It eliminates the need for risk assessments.
AnswerB

A common risk taxonomy supplies shared categories and definitions, so AI risks are identified, communicated and reported using identical terminology across business units. This directly satisfies the stem's requirement for consistent enterprise-wide risk management rather than fragmented, unit-specific registers.

Why this answer

A common taxonomy ensures that AI risk is understood and communicated consistently across the enterprise.

Practice this question →
47
MCQmedium

An organization is considering outsourcing its AI development. How should the 'AI Risk Governance' policy be adjusted for third-party vendors?

A.Include mandatory audit rights, model validation requirements, and risk-sharing clauses in the vendor contract.
B.Assume that the vendor's own governance is sufficient.
C.Only evaluate the vendor for financial stability.
D.Exclude outsourced AI from the internal risk assessment.
AnswerA

Third-party outsourcing transfers execution but not accountability. Contractual audit rights, model validation requirements and risk-sharing clauses preserve the organisation's ability to inspect vendor models, verify performance claims and allocate liability, keeping governance effective across the vendor boundary.

Why this answer

Third-party risk management must include audit rights and clear accountability for the vendor's models.

Practice this question →
48
Multi-Selecthard

Which THREE components must be included in an AI Risk Register to satisfy ISO/IEC 42001 requirements?

Select 3 answers
A.Hardware procurement schedules
B.Technical documentation of model architecture
C.Identification of relevant stakeholders
D.Assessment of AI risk levels (likelihood and impact)
E.AI system description and intended use
AnswersC, D, E

ISO 42001 emphasizes stakeholder communication and consultation.

Why this answer

ISO/IEC 42001 requires an AI risk register to capture the context and scope of each AI system, so option E (AI system description and intended use) is correct because the register must document what the system does, its purpose, and boundaries to properly frame the associated risks. Option C (identification of relevant stakeholders) is correct because ISO/IEC 42001 emphasizes accountability and interested-party considerations, requiring the register to name the parties affected by or responsible for the AI system. Option D (assessment of AI risk levels with likelihood and impact) is correct because the standard follows a risk-based approach where each identified risk must be evaluated for likelihood and impact to prioritize treatment.

Option A (hardware procurement schedules) is not part of the risk register content under ISO/IEC 42001, as procurement logistics are operational records rather than risk documentation. Option B (technical documentation of model architecture) is also not a required register component, since architecture details belong to technical documentation and model cards, not the risk register itself.

Exam trap

AAIR often tests the confusion between technical documentation (model architecture) and the risk register's required system description and intended use, causing candidates to select architecture details as a register component.

Practice this question →
49
MCQmedium

During a board meeting, the Chief Risk Officer needs to present AI model performance trends. Which metric is most critical for board-level reporting?

A.Data scientists' training hours per quarter
B.Computational resource utilization percentage
C.Model latency in milliseconds
D.Frequency and severity of model drift incidents
AnswerD

Drift incident frequency and severity translate technical model degradation into business risk terms boards govern: how often performance decays and how much harm results. This quantifies operational stability and oversight effectiveness better than granular statistical metrics.

Why this answer

Model drift directly affects model reliability, business outcomes, and risk exposure — it signals that a deployed model's predictions may no longer be valid, which is a material risk the board must understand. Frequency and severity of drift incidents quantify both how often models degrade and how impactful those degradations are, making it the most decision-relevant metric for board-level risk reporting.

Exam trap

AAIR often tests audience-appropriate metrics — candidates pick technical metrics (latency, utilization) because they are familiar, but board-level reporting requires risk and business-impact framing, which drift incidents provide.

How to eliminate wrong answers

Option A is wrong because training hours measure team activity, not model performance or business risk — it is an operational HR metric. Option B is wrong because compute utilization is an infrastructure efficiency metric, not a model performance or risk indicator. Option C is wrong because latency is a technical performance metric that matters to engineering SLAs but does not convey model correctness, fairness, or business risk to a board audience.

Practice this question →
50
MCQhard

An organization is integrating AI risk into its existing ISO 31000 framework. How should the 'Risk Assessment' process be modified to account for AI-specific 'black box' issues?

A.Remove the risk identification step, as AI risks are too unpredictable.
B.Replace the qualitative assessment with a purely quantitative financial impact model.
C.Add a model explainability and interpretability assessment step to the process.
D.Delegate all risk assessments to the external software vendor.
AnswerC

Black-box AI models resist conventional ISO 31000 assessment because their reasoning is opaque. Adding an explainability and interpretability assessment step lets assessors evaluate how outputs are produced, satisfying the framework's need to identify and analyse AI-specific risks.

Why this answer

Inclusion of model explainability assessments is necessary to address the opacity inherent in deep learning models.

Practice this question →
51
MCQmedium

An organization is using a centralized AI Governance structure. What is the biggest risk of this approach compared to a decentralized one?

A.Higher infrastructure costs.
B.Lack of standardized policy.
C.Operational bottlenecks and delayed AI project timelines.
D.Increased risk of shadow AI.
AnswerC

Centralised AI governance routes all approvals, reviews and policy decisions through one body, so requests queue behind limited reviewers. That concentration creates operational bottlenecks and delays project timelines, which is the principal trade-off versus decentralised, domain-embedded governance.

Why this answer

A centralized AI Governance structure concentrates decision-making, policy approval, and review authority in a single body. While this ensures consistency, it creates a single queue through which all AI projects must pass, producing operational bottlenecks and delayed project timelines. The other options describe risks more associated with decentralized or ungoverned structures.

Exam trap

AAIR often tests the trade-off between consistency and speed in governance design — the trap is selecting a risk (like lack of standards or shadow AI) that actually belongs to the opposite governance model.

How to eliminate wrong answers

Option A is wrong because higher infrastructure costs are not an inherent consequence of centralizing governance — governance structure is about decision rights, not compute spend. Option B is wrong because lack of standardized policy is a risk of decentralized governance, where each unit sets its own rules; centralization actually promotes standardization. Option D is wrong because increased shadow AI is more likely under weak or decentralized governance, where teams bypass oversight; a strong central function typically reduces shadow AI.

Practice this question →
52
MCQmedium

A bank's AI Governance policy requires a 'bias test' for all customer-facing models. What is the most important element to document in the audit trail?

A.The number of hours the test took to run.
B.The test methodology, criteria for success, and the specific mitigation steps taken.
C.The salary of the testers.
D.The name of the software used for the test.
AnswerB

Documenting the test methodology, success criteria and mitigation steps proves the bias test was rigorous and that identified disparities were remediated, not merely measured. This satisfies the governance policy's audit requirement by evidencing both the assessment approach and the corrective action taken.

Why this answer

For an AI bias test audit trail, the defensible record must show how the test was conducted, what threshold defined pass/fail, and what was done when bias was detected — this is what regulators and auditors need to reconstruct the decision. Documenting methodology, success criteria, and mitigation steps demonstrates due diligence and reproducibility, which is the core purpose of an audit trail. Operational trivia like hours, salaries, or tool names does not establish that the model was actually tested for fairness.

Exam trap

The trap is selecting a concrete-sounding but irrelevant detail (tool name, runtime, tester identity) instead of the governance substance — AAIR often tests whether candidates understand that audit trails must prove methodology, criteria, and remediation, not just that a test occurred.

How to eliminate wrong answers

Option A is wrong because test duration is an operational metric with no bearing on whether the bias test was valid, reproducible, or acted upon — auditors cannot assess fairness from a runtime figure. Option C is wrong because tester salaries are irrelevant to model fairness and would not appear in a governance audit trail. Option D is wrong because naming the software tool alone does not document what was tested, against what criteria, or what remediation followed — tool identity without methodology is not evidence of a meaningful bias assessment.

Practice this question →
53
MCQmedium

When reporting to the Board, what is the best way to present 'AI Risk'?

A.State that AI is completely safe and requires no oversight.
B.Provide a list of all model parameters.
C.Link AI risks to overall business impact, strategic goals, and current risk appetite.
D.Give a 4-hour technical lecture on deep learning.
AnswerC

Boards govern through financial and strategic consequence, not technical detail. Expressing AI risk as business impact tied to strategic goals and the stated risk appetite lets directors compare it against other enterprise risks and prioritise investment, satisfying the reporting audience constraint.

Why this answer

Board-level reporting requires translating technical AI risk into business language. Option C does this by connecting AI risks to overall business impact, strategic goals, and the organization's risk appetite—the three dimensions boards care about most. This approach enables informed governance decisions, resource allocation, and risk tolerance setting, which are the board's actual responsibilities.

It aligns with AAIR's emphasis on AI governance being integrated into enterprise risk management rather than treated as a purely technical concern.

Exam trap

AAIR often tests the distinction between technical AI details and business-oriented governance communication, trapping candidates who confuse model transparency with board-level risk reporting.

How to eliminate wrong answers

Option A is wrong because claiming AI is completely safe and requires no oversight is factually incorrect and dangerously naive; all AI systems carry risks such as bias, drift, and adversarial vulnerability, and governance frameworks like AAIR explicitly require oversight. Option B is wrong because listing all model parameters is a technical detail that provides no meaningful risk or business context to a board; it confuses model transparency with governance reporting and fails to address impact, likelihood, or mitigation. Option D is wrong because a 4-hour technical lecture on deep learning is inappropriate for a board audience; it focuses on how models work rather than the business risks and strategic implications, and it ignores the board's need for concise, decision-oriented information.

Practice this question →
54
MCQhard

What is the 'Accountability' principle in the NIST AI RMF intended to address?

A.Ensuring the AI can explain itself.
B.Ensuring that there is clear ownership and responsibility for AI system performance and safety.
C.Making sure the model is free of bugs.
D.Ensuring that the AI system is fast.
AnswerB

Accountability assigns clear ownership for AI system performance and safety across the lifecycle, ensuring identifiable parties answer for outcomes. This addresses the governance gap where harms occur but no role owns remediation, complementing the RMF's other trustworthiness characteristics.

Why this answer

The Accountability principle in the NIST AI RMF (part of the Govern function) is about ensuring clear ownership and responsibility for AI system performance, safety, and outcomes throughout the lifecycle. It answers 'who is responsible?' so that risks are managed, issues are escalated, and redress is possible. It is not about explainability, bug-freeness, or speed.

Exam trap

The trap is confusing Accountability with Explainability or general quality attributes — candidates often pick 'the AI can explain itself' because both relate to trust, but accountability is about human ownership and responsibility, not model transparency.

How to eliminate wrong answers

Option A is wrong because ensuring the AI can explain itself is the Explainability/Interpretability principle, which is related but distinct from Accountability — a model can be explainable yet have no clear owner. Option C is wrong because making sure the model is free of bugs is a software quality/validation concern, not the accountability principle; no model is ever fully bug-free, and accountability is about ownership of residual risk. Option D is wrong because ensuring the AI system is fast is a performance requirement, entirely unrelated to accountability, which concerns responsibility and governance.

Practice this question →
55
MCQmedium

In the context of AI Supply Chain risk, what is the primary governance objective when evaluating a vendor's AI model transparency?

A.To minimize the number of API calls made to the vendor.
B.To verify the vendor's financial stability and market share.
C.To ensure the vendor's training data includes proprietary internal company data.
D.To confirm the vendor's model satisfies the internal 'Model Card' and transparency requirements for risk assessment.
AnswerD

The governance objective is verifying that the vendor's model documentation meets internal Model Card and transparency requirements, enabling informed risk assessment of the AI supply chain. This satisfies the stem's focus on evaluating model transparency as part of third-party risk governance.

Why this answer

The primary governance objective when evaluating a vendor's AI model transparency is to ensure the vendor provides sufficient documentation — such as model cards, datasheets, and transparency reports — to assess risks related to bias, explainability, and compliance. Confirming that the vendor's model satisfies internal Model Card and transparency requirements enables the organization to perform due diligence and integrate the model into its risk management framework.

Exam trap

AAIR often tests the confusion between transparency requirements and unrelated vendor evaluation criteria like cost, financial health, or data inclusion, leading candidates to select operational or commercial metrics instead of governance-focused ones.

How to eliminate wrong answers

Option A is wrong because minimizing API calls is a cost or performance optimization, not a governance objective related to transparency. Option B is wrong because financial stability and market share are vendor viability concerns, not directly related to AI model transparency or risk assessment. Option C is wrong because including proprietary internal company data in the vendor's training set would be a data leakage risk, not a governance objective; transparency requires understanding what data was used, not ensuring internal data is included.

Practice this question →
56
MCQhard

You are auditing the integration of AI risk into the Enterprise Risk Management (ERM) system. Which finding indicates a failure in the governance structure?

A.The risk assessment template is 20 pages long.
B.The AI risk register is updated annually instead of monthly.
C.The AI risk committee meets quarterly rather than monthly.
D.AI models deployed in production are missing from the centralized enterprise risk register.
AnswerD

The enterprise risk register is the central artefact through which governance bodies aggregate, prioritise and monitor risk. Production AI models absent from it cannot be governed, reported or escalated, so this finding directly evidences a breakdown in the ERM governance structure rather than a technical control weakness.

Why this answer

A centralized enterprise risk register is the authoritative inventory of organizational risks; if production AI models are absent from it, the governance structure has failed to integrate AI risk into ERM — meaning those models are unmanaged, unreviewed, and invisible to executive and Board oversight. This is a structural governance failure because it breaks the linkage between AI risk identification and enterprise-level risk aggregation, violating the principle that all material risks must flow into the ERM.

Exam trap

AAIR often tests the distinction between process maturity issues (meeting frequency, template length, update cadence) and genuine structural governance failures (AI models missing from the enterprise risk register).

How to eliminate wrong answers

Option A is wrong because a 20-page risk assessment template is a documentation length issue, not a governance failure — thoroughness in templates is generally desirable and does not indicate broken oversight. Option B is wrong because annual risk register updates may be insufficient for fast-moving AI but the frequency alone is a process maturity concern, not a structural governance failure; many organizations update registers quarterly or on a trigger basis. Option C is wrong because quarterly committee meetings can be adequate depending on the organization's AI risk profile and materiality — meeting frequency is a cadence choice, not evidence of a broken governance structure.

Practice this question →
57
MCQeasy

A board of directors requests a dashboard view of AI model drift. Which metric is most appropriate for a board-level risk report?

A.Feature drift threshold violations
B.Mean Squared Error (MSE)
C.GPU utilization percentage
D.Latency per inference request
AnswerA

Feature drift threshold violations express model degradation as a count of breached statistical limits, giving the board a quantified, governance-level risk indicator. This satisfies the stem's requirement for a board-appropriate metric rather than operational or engineering-level detail.

Why this answer

Feature drift threshold violations are the most appropriate board-level metric because they directly signal when input data distributions have shifted beyond acceptable bounds, which is the leading indicator of model risk. Boards need a governance-level signal of emerging model unreliability, not raw performance numbers. Threshold violations translate technical drift into a risk posture that non-technical directors can act on.

Exam trap

AAIR often tests the distinction between technical ML metrics (MSE, latency) and governance-level risk indicators, causing candidates to pick a familiar performance metric instead of a risk-reporting metric.

How to eliminate wrong answers

Option B is wrong because MSE is a model performance metric that measures prediction error on a dataset, not a governance-level drift indicator, and it requires technical interpretation. Option C is wrong because GPU utilization is an infrastructure capacity metric unrelated to model risk or drift. Option D is wrong because latency per inference is an operational performance metric that reflects serving efficiency, not model behavior degradation.

Practice this question →
58
MCQhard

A healthcare organization is implementing the NIST AI Risk Management Framework (AI RMF) and wants to ensure that its AI governance structure addresses the 'Govern' function's requirement for clear roles and responsibilities. The Chief AI Officer proposes several actions. Which action best satisfies the requirement for accountability and oversight?

A.Creating a volunteer-based AI ethics council without formal authority or reporting lines to the board.
B.Outsourcing AI risk oversight to an external consulting firm to gain objective expertise.
C.Assigning the Chief Data Scientist as the sole owner of all AI risk decisions to ensure technical expertise.
D.Establishing an AI Governance Committee with representation from legal, compliance, business units, and data science, and defining a RACI matrix for AI risk decisions.
AnswerD

Establishing an AI Governance Committee with cross-functional representation and a RACI matrix directly addresses the Govern function's call for clear roles and responsibilities. It ensures diverse perspectives, avoids conflicts of interest, and defines accountability for AI risk decisions. This structure promotes oversight and enables effective challenge. The RACI matrix clarifies who is responsible, accountable, consulted, and informed, which is essential for governance.

Why this answer

The correct action is to establish an AI Governance Committee with cross-functional representation and a RACI matrix. This creates clear roles and responsibilities, ensures diverse oversight, and defines accountability for AI risk decisions. It aligns with the AI RMF Govern function's requirement for clear roles and responsibilities, promoting effective challenge and integration with enterprise governance.

Exam trap

The trap here is equating technical expertise with governance authority, overlooking the need for independent oversight and diverse representation.

Practice this question →
59
MCQhard

An organization is revising its AI Governance to include 'Human-in-the-loop' (HITL) requirements. Why is this a critical risk mitigation strategy?

A.It removes the requirement for model bias testing.
B.It is required for every AI model regardless of impact.
C.It ensures human oversight for critical decisions, reducing the risk of 'black box' failures.
D.It eliminates the need for any other automated risk controls.
AnswerC

Human-in-the-loop places a person in the decision path for consequential outputs, so opaque model reasoning is reviewed before action. This directly mitigates black-box failure risk, which the stem identifies as the governance concern driving the HITL requirement.

Why this answer

Human-in-the-loop (HITL) is a critical risk mitigation because it places a human reviewer in the decision path for consequential AI outputs, providing a check against opaque 'black box' failures, edge cases, and harmful errors that automated controls may miss. It preserves meaningful human judgment and accountability where the cost of an AI mistake is high. It does not replace other controls or eliminate testing obligations.

Exam trap

The trap is treating HITL as a silver bullet that replaces other controls (bias testing, monitoring) or as universally mandatory — the exam tests whether you understand it is a risk-based, complementary control, not a substitute for the rest of the governance framework.

How to eliminate wrong answers

Option A is wrong because HITL does not remove the need for model bias testing — bias testing is a separate, mandatory control that must continue regardless of human oversight, and humans themselves can introduce bias. Option B is wrong because HITL is not required for every AI model; it is risk-based and typically reserved for high-impact or high-autonomy use cases, while low-risk models may operate without it. Option D is wrong because HITL is one control among many and does not eliminate the need for automated monitoring, logging, drift detection, access controls, or other safeguards — defense in depth still applies.

Practice this question →
60
MCQmedium

When an AI model is updated (e.g., retrained on new data), what action is required from an AI Risk Governance perspective?

A.The model should be renamed to show it is a new version.
B.No action is needed as the underlying architecture is unchanged.
C.The model should be re-validated to ensure it still meets risk thresholds.
D.The model should be automatically deployed without review.
AnswerC

Retraining alters a model's weights, outputs and failure modes, so prior validation evidence no longer describes the deployed system. Re-validation against the original risk thresholds confirms the updated model still performs within approved tolerances, satisfying the governance requirement that material model changes trigger fresh assessment before continued use.

Why this answer

Retraining a model on new data changes its behavior, so from a risk governance perspective it must be re-validated against the same risk thresholds (accuracy, fairness, robustness, compliance) before being trusted in production. Renaming or assuming no action is needed ignores the fact that the model's outputs and risk profile may have changed. Automatic deployment without review bypasses required oversight.

Exam trap

AAIR often tests whether candidates recognize that retraining is a material change requiring re-validation — the trap is assuming that unchanged architecture or a simple rename satisfies governance requirements.

How to eliminate wrong answers

Option A is wrong because renaming the model is a cosmetic versioning step and does not satisfy the substantive requirement to re-assess its risk and performance. Option B is wrong because unchanged architecture does not mean unchanged behavior — new training data can alter predictions, bias, and failure modes, so re-validation is required. Option D is wrong because automatically deploying a retrained model without review violates change-management and model-risk governance controls.

Practice this question →
61
MCQmedium

A board of directors requests a dashboard to monitor AI risk exposure. Which metric provides the most effective board-level oversight regarding AI regulatory compliance?

A.Percentage of critical AI systems that have undergone a formal regulatory compliance impact assessment.
B.Mean Time to Detect (MTTD) for model adversarial attacks.
C.Current GPU utilization rates for production inference clusters.
D.Average latency of API requests for generative AI models.
AnswerA

This metric directly evidences whether each critical AI system has been assessed against applicable regulations, giving the board measurable coverage of compliance obligations rather than operational or performance indicators. It quantifies exposure from unassessed systems, supporting governance decisions on regulatory risk.

Why this answer

The board's primary concern is regulatory compliance and risk exposure, not operational performance. The percentage of critical AI systems that have undergone a formal regulatory compliance impact assessment directly measures the organization's adherence to frameworks like the EU AI Act, NIST AI RMF, or ISO/IEC 42001. This metric provides assurance that high-risk AI systems are being evaluated against legal and ethical requirements, which is a core board-level oversight responsibility.

Exam trap

AAIR often tests the distinction between operational metrics (MTTD, latency, utilization) and governance metrics (compliance assessment coverage), so candidates must recognize that board-level oversight focuses on regulatory adherence, not technical performance.

How to eliminate wrong answers

Option B is wrong because MTTD for adversarial attacks is a security operations metric that measures detection speed, not regulatory compliance posture. Option C is wrong because GPU utilization is an infrastructure efficiency metric, irrelevant to compliance oversight. Option D is wrong because API latency is a performance metric that does not reflect adherence to AI regulations or risk management frameworks.

Practice this question →
62
MCQeasy

What is the primary role of the AI 'Data Steward' within the AI Governance framework?

A.To oversee the lifecycle of the data, ensuring its quality and compliance.
B.To manage the budget for AI hardware.
C.To build the model architecture.
D.To handle marketing and customer relations.
AnswerA

The Data Steward owns data quality, lineage and compliance across the AI lifecycle, ensuring training and inference data meets regulatory and organisational standards. This satisfies the governance framework's need for accountability over data assets, distinct from model validation or ethical review roles.

Why this answer

The AI Data Steward owns the data lifecycle within the AI governance framework — ensuring datasets are accurate, complete, appropriately sourced, and compliant with privacy and licensing requirements throughout collection, use, retention, and disposal. This role is the data-side counterpart to model governance, ensuring that what feeds the model is trustworthy and lawful. Budget, architecture, and marketing responsibilities belong to entirely different roles.

Exam trap

The trap is conflating the Data Steward with the ML Engineer or Data Scientist — AAIR tests whether candidates recognize that the steward governs data quality and compliance across the lifecycle, not model construction or infrastructure.

How to eliminate wrong answers

Option B is wrong because AI hardware budgeting is a financial/IT procurement function, not a data governance responsibility — the steward does not control capital expenditure. Option C is wrong because building model architecture is the job of data scientists and ML engineers, not the data steward, whose focus is the data feeding the model rather than the model itself. Option D is wrong because marketing and customer relations are business functions unrelated to data lifecycle governance, quality assurance, or regulatory compliance.

Practice this question →
63
MCQmedium

Your organization is integrating AI risks into the existing COSO Enterprise Risk Management (ERM) framework. Which action best ensures that AI-specific model drift risk is formally addressed within the 'Review and Revision' component?

A.Integrating model performance metrics into the quarterly enterprise risk assessment and management review processes.
B.Establishing automated triggers within the CI/CD pipeline to halt deployment if drift exceeds threshold.
C.Mapping AI model inventory to the IT asset register in the CMDB.
D.Assigning a Data Scientist to the Board Risk Committee.
AnswerA

Embedding model performance metrics into quarterly enterprise risk assessments directly satisfies the 'Review and Revision' component, which requires organisations to identify and assess changes that substantially affect the ERM framework. Continuous monitoring of drift indicators through existing governance reviews ensures AI-specific risks are formally revisited rather than managed in isolation.

Why this answer

COSO ERM's 'Review and Revision' component requires that risk responses be reassessed and adjusted as conditions change. Integrating model performance metrics (including drift indicators) into the quarterly enterprise risk assessment and management review processes ensures drift risk is formally reviewed, escalated, and acted upon at the governance level. This embeds AI risk into existing ERM cadence rather than treating it as a purely technical pipeline concern.

Exam trap

AAIR often tests the confusion between technical monitoring controls (CI/CD triggers, automated drift detection) and governance-level review processes — candidates pick the technical control when the question asks about a COSO ERM component.

How to eliminate wrong answers

Option B is wrong because automated CI/CD drift triggers are a technical control within the 'Implement' or operational layer, not a governance review mechanism under COSO's 'Review and Revision' component. Option C is wrong because mapping models to the CMDB is an asset inventory activity supporting 'Identify' and 'Assess,' not periodic review and revision. Option D is wrong because assigning a Data Scientist to the Board Risk Committee is a resourcing/structure action, not a process for reviewing and revising AI risk responses.

Practice this question →
64
MCQeasy

A financial institution is integrating AI risk into its ERM framework. Which action most effectively aligns AI risk appetite with enterprise risk appetite?

A.Defining quantitative risk thresholds in the AI governance policy
B.Purchasing cybersecurity insurance for AI systems
C.Assigning AI risk ownership to the IT department
D.Implementing a standalone AI audit program
AnswerA

Defining quantitative thresholds in the AI governance policy directly satisfies the stem's alignment constraint: it translates the enterprise risk appetite statement into measurable AI tolerances, so AI initiatives are approved or escalated against the same monetary and likelihood limits used across other risk domains.

Why this answer

Defining quantitative risk thresholds in the AI governance policy is correct because it translates the enterprise's stated risk appetite into measurable, enforceable limits that AI initiatives must respect. Risk appetite only becomes operational when expressed as concrete metrics (e.g., maximum acceptable bias score, error rate, or financial exposure), allowing AI risk to be aggregated and compared alongside other enterprise risks in the ERM framework. This creates direct traceability between board-level tolerance and day-to-day AI decisions.

Exam trap

AAIR often tests the confusion between risk appetite alignment (defining measurable thresholds) and risk mitigation or transfer activities (insurance, audits, ownership assignment), tempting candidates to pick controls that address symptoms rather than governance alignment.

How to eliminate wrong answers

Option B is wrong because cybersecurity insurance is a risk transfer mechanism that addresses residual financial impact after an incident, not a means of aligning AI risk appetite with enterprise risk appetite. Option C is wrong because assigning AI risk ownership solely to IT creates a siloed, technology-centric view that fails to integrate AI risk into enterprise-wide governance and can conflict with the Three Lines of Defense model. Option D is wrong because a standalone AI audit program provides independent assurance after the fact but does not itself define or align risk appetite thresholds with the ERM framework.

Practice this question →
65
MCQmedium

A company is deploying an AI system that interacts with human users. According to the AI RMF, what should be the focus of the 'Map' function in the risk governance process?

A.Choosing the most efficient algorithm.
B.Identifying stakeholders, intended use, and potential human impacts.
C.Selecting the cloud service provider.
D.Calculating the total budget for the project.
AnswerB

The Map function establishes context by documenting intended purpose, stakeholders, affected populations and potential human impacts, forming the baseline for subsequent risk measurement and treatment. This satisfies the AI RMF requirement to frame risks before assessing them.

Why this answer

In the NIST AI RMF, the Map function focuses on understanding the context of the AI system: identifying stakeholders, intended use, affected populations, and potential human impacts. It establishes the foundation for risk assessment by framing what the system does, who it affects, and what could go wrong. This contextual mapping is essential before measuring or managing risks.

Exam trap

AAIR often tests the specific purpose of each AI RMF function, so the trap is confusing Map (context and stakeholder identification) with technical, financial, or procurement decisions that belong to other phases.

How to eliminate wrong answers

Option A is wrong because choosing the most efficient algorithm is a technical design decision, not the purpose of the Map function, which is about context and risk framing. Option C is wrong because selecting a cloud service provider is an infrastructure/procurement decision, not risk mapping. Option D is wrong because calculating the project budget is a financial planning activity, not part of the AI RMF Map function.

Practice this question →
66
MCQmedium

You are mapping existing ISO 31000 risk management processes to an AI-specific application. Which step is most crucial to ensure 'Risk Treatment' is appropriately scaled for AI?

A.Automating all risk logging in the SIEM.
B.Discontinuing the use of third-party AI APIs to avoid vendor risk.
C.Standardizing all AI models under one security policy regardless of function.
D.Implementing a tiered control framework where mitigations scale based on the system's impact assessment.
AnswerD

A tiered control framework directly satisfies the scaling constraint by matching mitigation strength to each system's assessed impact level, rather than applying uniform controls across all AI systems. This ensures high-impact deployments receive proportionately stronger treatment, aligning ISO 31000 risk treatment with AI-specific risk magnitudes.

Why this answer

A tiered control framework is the correct answer because ISO 31000's Risk Treatment step requires selecting controls proportionate to the assessed risk level. For AI, this means mitigations (e.g., human-in-the-loop review, explainability requirements, monitoring intensity) must scale with the system's impact classification — a low-risk internal chatbot needs lighter controls than a high-risk hiring or medical diagnostic model. This impact-based tiering directly operationalizes ISO 31000's principle that treatment options be evaluated against risk criteria and organizational context.

Exam trap

AAIR often tests the misconception that any single control (logging, policy standardization, or vendor elimination) satisfies Risk Treatment, when ISO 31000 actually demands proportionate, impact-scaled mitigation selection.

How to eliminate wrong answers

Option A is wrong because automating risk logging in a SIEM addresses detection and monitoring, not Risk Treatment design — SIEM logging is a detective control, not a scaled mitigation framework. Option B is wrong because blanket discontinuation of third-party AI APIs is a risk avoidance strategy applied indiscriminately, which violates ISO 31000's requirement that treatment be proportionate and context-driven; it also ignores that vendor risk can be managed through contractual and technical controls. Option C is wrong because standardizing all AI models under one policy regardless of function ignores the impact assessment entirely, defeating the purpose of scaling treatment to risk level.

Practice this question →
67
MCQmedium

A global bank has adopted the NIST AI Risk Management Framework (AI RMF) and wants to ensure that its AI risk governance is integrated with its existing enterprise risk management (ERM) processes. The Chief Risk Officer asks the AI governance lead to identify the primary mechanism for achieving this integration. Which action best accomplishes this?

A.Mapping the AI RMF core functions to the bank's existing ERM risk categories and reporting lines.
B.Delegating all AI risk decisions to the data science team to ensure technical accuracy.
C.Adopting a separate AI risk framework that replaces the bank's existing ERM framework.
D.Creating a standalone AI risk register that is maintained separately from the enterprise risk register.
AnswerA

Mapping AI RMF functions to existing ERM categories and reporting lines directly integrates AI risk into established governance structures, ensuring consistent risk assessment, reporting, and oversight. This avoids creating parallel, disconnected processes and leverages existing ERM frameworks for AI-specific risks, which is a key goal of the AI RMF Govern function. It enables the bank to treat AI risk as a subset of enterprise risk, facilitating holistic management.

Why this answer

The correct action is to map AI RMF core functions to the bank's existing ERM risk categories and reporting lines. This integrates AI risk into established governance structures, ensuring consistent oversight and reporting. It leverages existing ERM processes rather than creating parallel systems, which aligns with the AI RMF's emphasis on integration.

This approach facilitates holistic risk management and avoids silos.

Exam trap

The trap here is assuming that AI risk requires a completely separate framework, rather than integrating it into existing ERM processes.

Practice this question →
68
MCQmedium

When integrating AI risk into the corporate GRC (Governance, Risk, and Compliance) platform, what is the best practice for handling 'AI Model Drift' alerts?

A.Send all alerts to the help desk.
B.Ignore drift alerts until a manual audit happens annually.
C.Integrate drift alerts as risk indicators in the GRC platform for automated tracking.
D.Disable the alerts to prevent 'alert fatigue'.
AnswerC

Feeding drift alerts into the GRC platform as risk indicators lets thresholds, ownership and remediation workflows trigger automatically, satisfying the requirement to integrate AI risk into existing governance processes rather than handling drift in isolated ML tooling.

Why this answer

Best practice is to integrate model drift alerts directly into the GRC platform as risk indicators, so they are tracked, scored, and routed through the same governance workflows as other enterprise risks. This enables automated tracking, trend analysis, and timely escalation. The other options either misroute alerts, ignore them, or suppress them, all of which defeat the purpose of drift monitoring.

Exam trap

AAIR often tests whether candidates treat drift alerts as noise to be suppressed or as governance signals to be integrated — the trap is choosing 'disable alerts' or 'ignore until audit' as a shortcut for alert fatigue.

How to eliminate wrong answers

Option A is wrong because sending all drift alerts to the help desk misroutes a model-risk signal to a team without the authority or context to assess AI risk. Option B is wrong because ignoring drift alerts until an annual audit leaves the model unmonitored for up to a year, allowing silent degradation. Option D is wrong because disabling alerts to avoid fatigue removes the very signal needed to detect model degradation — the correct response is tuning and prioritization, not suppression.

Practice this question →
69
Multi-Selectmedium

When reporting AI risks to the Board of Directors, which THREE elements should be included to ensure informed decision-making?

Select 3 answers
A.List of all developers who worked on the model.
B.Granular technical logs of model inference errors.
C.Qualitative overview of ethical AI alignment with company values.
D.Summary of current AI risk appetite and threshold breaches.
E.Strategic assessment of regulatory compliance and potential legal exposure.
AnswersC, D, E

A qualitative overview of ethical AI alignment maps model behaviour and governance choices to stated company values, giving the Board the value-based context needed to judge reputational and ethical exposure. This satisfies the requirement for informed decision-making beyond purely quantitative risk metrics.

Why this answer

Option C is correct because a qualitative overview of ethical AI alignment with company values gives the Board the governance-level context needed to judge whether AI use is consistent with the organization's stated principles and risk culture. Option D is correct because reporting the current AI risk appetite together with any threshold breaches tells the Board whether actual risk exposure remains within the limits they approved, which is essential for informed oversight and escalation. Option E is correct because a strategic assessment of regulatory compliance and potential legal exposure highlights material obligations, enforcement trends, and liabilities that could affect strategy, reputation, and financial standing.

Options A and B are not appropriate for Board-level reporting: a list of developers is an operational staffing detail, and granular technical logs of model inference errors are too low-level and tactical, belonging instead to engineering or model-risk teams rather than the Board.

Practice this question →
70
Multi-Selectmedium

Which THREE factors should be evaluated when reviewing an AI model for 'Fairness'?

Select 3 answers
A.Performance disparity across different demographic cohorts.
B.The number of hours the server was powered on.
C.Defined metrics for success that explicitly account for equity.
D.Training data representation across protected groups.
E.The model's file size in kilobytes.
AnswersA, C, D

Fairness requires measuring whether model outcomes differ across protected groups, so comparing error rates, selection rates and accuracy between demographic cohorts exposes disparate impact. This directly satisfies the stem's demand for a fairness factor, since parity across cohorts is the defining test of equitable model behaviour.

Why this answer

Option A is correct because fairness review requires measuring performance disparity across different demographic cohorts — comparing metrics such as accuracy, precision, recall, or false positive/negative rates between protected groups reveals disparate impact. Option C is correct because fairness cannot be assessed without defined metrics for success that explicitly account for equity, such as equalized odds, demographic parity, or equal opportunity, which operationalize what 'fair' means for the use case. Option D is correct because training data representation across protected groups directly affects model behavior; underrepresentation or historical bias in the data propagates into biased predictions, so representation must be audited.

Option B is not relevant because server uptime is an infrastructure/availability metric unrelated to model fairness. Option E is not relevant because model file size in kilobytes is a storage or deployment concern, not a fairness indicator.

Exam trap

AAIR often tests the distinction between fairness factors and irrelevant operational metrics, and candidates may mistakenly include infrastructure or storage metrics as fairness considerations.

Practice this question →
71
MCQmedium

A financial firm is integrating AI risk into its ERM. The Chief Risk Officer asks for a mapping between the NIST AI Risk Management Framework (RMF) and the existing COSO ERM framework. Which action most effectively facilitates this alignment?

A.Replace the COSO risk taxonomy with the NIST AI RMF taxonomy entirely.
B.Automate all AI model monitoring using only the NIST RMF 'Measure' function.
C.Assign AI model owners to report directly to the NIST oversight board.
D.Map NIST AI RMF 'Govern' and 'Map' functions to COSO 'Governance and Culture' components.
AnswerD

The Govern and Map functions address governance structures, roles and context setting, mirroring COSO's Governance and Culture components. This mapping lets the firm slot AI-specific controls into existing ERM governance, satisfying the CRO's requirement for a coherent cross-framework alignment rather than parallel, disconnected risk registers.

Why this answer

Mapping the NIST AI RMF 'Govern' and 'Map' functions to COSO's 'Governance and Culture' component is the most effective alignment action because both address oversight, accountability, and risk context. COSO ERM's Governance and Culture component parallels the AI RMF's emphasis on governance structures and risk mapping, enabling the firm to integrate AI risk into existing ERM processes without replacing them. This mapping preserves the firm's investment in COSO while satisfying NIST AI RMF expectations.

Exam trap

The trap is choosing an action that replaces or bypasses the existing framework rather than mapping to it; candidates must recognize that alignment means integration, not substitution, and that NIST is not an oversight authority.

How to eliminate wrong answers

Option A is wrong because replacing the COSO taxonomy entirely would discard the firm's established ERM framework, create disruption, and is not a mapping action; alignment means integrating, not replacing. Option B is wrong because automating monitoring using only the 'Measure' function ignores the other AI RMF functions and does not address the CRO's request for a mapping between frameworks. Option C is wrong because assigning AI model owners to report directly to a NIST oversight board is an organizational change that does not facilitate framework alignment and misrepresents NIST as an oversight body rather than a standards publisher.

Practice this question →
72
Multi-Selecthard

A financial services firm is integrating the NIST AI Risk Management Framework (AI RMF) into its existing governance structure. The AI governance lead is tasked with ensuring that the 'Govern' function is properly implemented. Which two actions are essential for establishing effective AI risk governance? (Choose two.)

Select 2 answers
A.Ensuring that all AI models are developed using a single, standardized programming language.
B.Requiring that all AI risk decisions be made by the Chief Technology Officer.
C.Establishing a process for regular review and update of AI risk policies and procedures.
D.Defining and documenting roles and responsibilities for AI risk management across the organization.
E.Implementing a policy that prohibits the use of AI in any customer-facing applications.
AnswersC, D

Establishing a process for regular review and update of AI risk policies ensures that governance remains relevant as AI technologies and risks evolve. The Govern function emphasizes the need for policies and procedures to be maintained and updated. This process helps the organization adapt to new regulatory requirements, changes in risk appetite, and lessons learned. It is a key component of a living governance framework, preventing stagnation and ensuring ongoing alignment with organizational objectives.

Why this answer

The essential actions for effective AI risk governance under the Govern function are defining and documenting roles and responsibilities, and establishing a process for regular review and update of AI risk policies. These ensure accountability, clarity, and adaptability. The other options are either technical details, centralize authority inappropriately, or represent excessive risk avoidance, none of which are required by the AI RMF Govern function.

Exam trap

The trap here is confusing technical standardization or risk avoidance with governance requirements, which focus on organizational structures and processes.

Practice this question →

Ready to test yourself?

Try a timed practice session using only AI Risk Governance And Framework Integration questions.

Start 20-question session