AI Governance And Program Management

A healthcare insurer has deployed an AI claims-triage model. Six months after launch, the model's denial rate for one demographic has drifted upward while overall accuracy remains stable. The AI program manager needs to detect and respond to this issue as part of ongoing AI governance. Which control is most appropriate?

When onboarding an AI startup vendor, what is the best strategy to manage 'Model Drift'?

In the context of the EU AI Act, what is the 'Provider's' obligation regarding conformity assessments for high-risk AI systems?

A multinational bank is establishing an AI governance program. The board asks the AI security manager to identify the key elements that must be included in the program's charter to ensure effective oversight. Which TWO elements are essential for the AI governance charter? (Choose two.)

What is the primary role of an 'AI Ethics Board' in an organization's governance structure?

An organization is using RAG (Retrieval-Augmented Generation). What is the primary governance concern for the retrieved documents?

An organization's AI governance committee is revising its AI risk taxonomy. The Chief Risk Officer wants to ensure that risks arising from third-party foundation model APIs are captured distinctly from risks of internally developed models. Which change to the taxonomy best achieves this?

Which department should own the 'AI Ethics Policy'?

A global retailer's AI program office is defining how AI risks will be escalated. The Chief Risk Officer wants assurance that a severe AI incident, such as a customer-facing model producing discriminatory pricing, reaches executive leadership within hours rather than days. Which element of the AI risk reporting structure is most critical to meet this requirement?

Which THREE actions should be included in an AI incident response plan?

Which TWO factors are critical when assessing the risk of a new Generative AI use case?

Which THREE factors increase 'AI Model Risk'?

A multinational bank's AI governance committee is drafting its first enterprise AI policy. The CISO asks how the policy should address third-party foundation models that are accessed via API but not fine-tuned or hosted internally. Which approach BEST aligns with ISACA AI governance principles?

A global bank has deployed a generative AI assistant to its wealth management advisors. The AI security manager must establish an oversight process that ensures the model's outputs remain aligned with the bank's risk appetite as market conditions and regulations evolve. Which ongoing activity should be the PRIMARY mechanism for this alignment?

A telecommunications provider has completed its first AI governance maturity assessment. Leadership wants to move from ad hoc AI oversight to a repeatable, enterprise-wide program that can demonstrate continuous improvement to the board. Which action best advances the program toward that goal?

A manufacturing firm uses an AI system to prioritize maintenance tasks. The AI governance lead must ensure that the system's decisions can be explained to regulators and affected employees. Which action BEST supports this requirement?

Which TWO aspects of 'Transparency' are most important for AI stakeholders?

A multinational bank has deployed an AI governance program aligned with the NIST AI Risk Management Framework. The Chief Risk Officer asks how to ensure that AI risks are consistently identified, assessed, and treated across all business units. Which structural element is most critical for achieving this consistency?

A company is adopting the ISO/IEC 42001 AI management system standard. What is the primary purpose of the 'Context of the Organization' clause?

A software company is rolling out an AI governance training program. The Chief Information Security Officer wants to ensure that all employees who build, deploy, or use AI systems understand the organization's expectations for responsible behavior, including prohibited uses. Which governance activity most directly establishes these expectations for the workforce?

An enterprise has deployed a third-party AI-powered hiring screening tool. The vendor recently updated its model, and the organization's HR team was not notified beforehand. The AI governance committee needs to ensure that such changes are managed consistently going forward. Which action should the committee take FIRST?

How does 'Continuous Monitoring' differ from 'Point-in-Time Auditing'?

Which mechanism best ensures 'Auditability' of AI decision-making?

An enterprise AI governance committee is defining a policy for generative AI tools used by employees. The CISO wants to ensure that any AI-generated content that is published externally or used in decision-making is reviewed by a human before release. Which governance control should be formally documented to enforce this requirement across all business units?

A retail company is deploying an AI-based customer sentiment analysis tool across its social media channels. The AI governance lead needs to ensure that the tool's data collection and processing comply with the organization's AI policy. Which document should the lead reference first to understand the organization's approved AI risk tolerance and control requirements?

A security manager is integrating AI governance into the existing NIST AI RMF framework. Which action best ensures alignment between AI security controls and business risk appetite?

Which team should lead the definition of 'AI Acceptable Use' policies?

When establishing an AI steering committee, which reporting cadence is most effective for ensuring board-level oversight of residual AI risk?

A multinational bank is deploying a proprietary LLM. Which approach provides the most robust assurance for model supply chain security?

A healthcare organization has an AI governance policy that requires all AI systems to undergo a pre-deployment risk assessment. A data science team is eager to deploy a new diagnostic model and argues that the assessment will delay a critical clinical trial. As the AI governance lead, which action best upholds the governance program while addressing the team's urgency?

Which metric is most appropriate for reporting the 'AI Security Posture' to the board?

A global manufacturer is standing up an AI governance program and must assign accountability for AI risks across the enterprise. The Chief Risk Officer wants to ensure that accountability is clearly allocated for both model development and ongoing operation. Which TWO structural elements are most essential to establish this accountability? (Choose two.)

A multinational financial services firm has deployed a generative AI assistant for its customer support agents. The AI governance committee has approved the tool, but the Chief Information Security Officer is concerned that the firm cannot demonstrate to regulators that the AI's outputs are being monitored for harmful or biased content on an ongoing basis. Which of the following is the MOST appropriate control to address this concern?

When managing shadow AI, which strategy is most effective at the enterprise level?

An AI governance lead is drafting the organization's AI policy hierarchy. The board has approved a high-level AI principles statement. The lead now needs a document that translates those principles into mandatory, auditable requirements that apply to all AI systems, including those built by third parties on the organization's behalf. Which document type best fits this need?

An organization's AI governance office is defining the responsibilities of the first-line, second-line, and third-line functions for AI risk. A newly hired AI risk manager asks which function should independently assess whether the AI governance framework is designed and operating effectively. Which function is responsible?

A healthcare insurer deploys an AI model to prioritize prior-authorization requests. During post-deployment monitoring, the AI governance lead discovers the model's denial rate for one demographic group is materially higher than for others, though overall accuracy meets the target. Which action should the governance lead take FIRST?

A multinational corporation is establishing an AI governance program. The board has asked the AI security manager to identify the essential components that must be in place to ensure the program can enforce accountability across business units. (Choose two.)

What does 'Model Explainability' (XAI) primarily support in governance?

Which TWO components are essential for a robust AI Governance framework?

What is the primary function of an 'AI Steering Committee'?

A telecommunications company operates AI systems in twelve countries. Its AI governance committee must design a control testing program that provides assurance to the board that AI controls are operating effectively. The committee wants testing that is independent of the teams building and running the models. Which approach best meets this objective?

An AI project is failing to meet its security requirements. Which governance process should be triggered to address this?

Which THREE activities should be included in an AI Security Governance Program to effectively manage model supply chain risks?

During an internal audit of the AI program, it is found that the organization lacks a 'Model Inventory'. What is the most immediate risk to the AI security program?

Which TWO areas should be covered by an AI procurement policy?

Which scenario best illustrates an 'AI Security Incident'?

An AI security team needs to ensure that internal AI tools comply with the organization's 'Human-in-the-Loop' policy. Which architectural control best enforces this governance requirement?

A healthcare insurer is integrating a third-party AI diagnostic triage tool into its claims processing workflow. The AI security manager must ensure the vendor's model updates do not introduce new risks without the insurer's knowledge. Which contractual and technical control is MOST effective for this purpose?

A multinational bank's AI governance lead is mapping AI systems to regulatory obligations across jurisdictions. The bank uses a single credit-scoring model that is trained in the EU, deployed in the US and Singapore, and fine-tuned locally. Which governance artifact is most critical to maintain so the bank can demonstrate compliance with differing regional AI regulations?

When assessing a third-party AI provider, which document is most essential for due diligence?

Which control is most effective against 'Prompt Injection' attacks?

A global bank's AI governance committee is drafting its first enterprise AI policy. The CISO argues that a single 'AI Security Policy' owned by security is sufficient because most AI risk is security risk. The Chief Data Officer counters that the program needs a governing body with cross-functional authority. Which action best establishes durable AI governance accountability for the enterprise?

A global logistics company uses an AI system to optimize delivery routes. The AI governance committee is concerned that the system's decisions may inadvertently favor certain regions due to historical data biases. Which governance mechanism is MOST effective for continuously monitoring and mitigating this risk throughout the AI lifecycle?

A multinational corporation is establishing an AI governance board. The board's charter must define its responsibilities for overseeing AI risks across the enterprise. Which TWO responsibilities are most critical for the board to own? (Choose two.)

Which TWO reporting formats are effective for executive AI oversight?

A global bank's AI governance program is being audited. The auditors find that the bank has a robust AI risk assessment process for new models, but no mechanism to monitor risks that emerge after deployment, such as data drift or changing regulatory requirements. Which control should the governance team implement to address this gap?

An enterprise is defining its 'AI System Inventory'. Which metadata attribute is most critical for assessing legal and regulatory risk?

When drafting an AI policy, how should the organization address 'Human-in-the-Loop' (HITL) requirements?

What is the primary role of 'Model Versioning' in AI governance?

A board of directors requests a summary of AI risk exposure. Which metric provides the most relevant insight into AI security program maturity?

An organization is establishing an AI governance program. The Chief Executive Officer asks the AI governance lead to define the program's scope. Which of the following should be the PRIMARY focus when defining the scope of AI governance?

A retail company is standing up an AI governance program and must define how AI risk appetite will be expressed and operationalized across the enterprise. Which TWO elements are necessary to translate an executive AI risk appetite statement into day-to-day governance? (Choose two.)

A global manufacturer is standing up an AI governance committee. The CISO wants to ensure the committee can make defensible decisions about high-risk AI deployments. Which TWO responsibilities are MOST essential for this committee to own directly? (Choose two.)

Which TWO activities ensure 'AI Safety' in development?

Which document outlines the 'Roles and Responsibilities' for AI security?

Which document should define the organization's stance on AI transparency and explainability?

An organization is updating its AI governance policy for high-risk systems. Which TWO requirements should be mandated to ensure accountability and forensic capability?

A financial services firm has deployed an AI governance framework with a central AI risk committee. Business units complain that the committee is a bottleneck, delaying low-risk AI pilots by weeks. The Chief AI Officer wants to maintain oversight while accelerating delivery. Which governance design change best addresses this?

Which THREE factors are critical when establishing an AI risk reporting structure for executive leadership?

Which phase of the AI Lifecycle is most critical for 'Bias Detection'?

Which THREE items should be included in an 'AI Inventory'?

An AI security lead is configuring a 'Model Risk Management' (MRM) framework. What is the main objective of a 'Model Validation' report?

When conducting an AI audit, what should be the primary focus of the 'Data Governance' review?

A retail company's AI governance policy requires that all AI systems undergo a risk assessment before deployment. A business unit wants to deploy a chatbot for customer service that uses a large language model (LLM) from a public API. The business unit argues that because the LLM is pre-trained and hosted externally, a full risk assessment is unnecessary. What should the governance team do?

A software company's AI governance team is defining metrics to report to the board quarterly. The board wants assurance that AI risks are being managed, not just a list of models deployed. Which metric set BEST supports that objective?

Which TWO aspects of 'Compliance' must be addressed by an AI governance program?

A retail company's board asks the CISO to explain how AI risk appetite is translated into operational limits. The CISO proposes a tiered control model based on use-case criticality. Which element is MOST essential for the board to approve to make the tiered model enforceable?

What is the benefit of 'AI Model Watermarking' for governance?

A manufacturing firm's AI governance lead is designing the enterprise AI policy hierarchy. The board has approved a high-level AI principles statement. Business units now need actionable rules for selecting and deploying vendors that supply AI-enabled equipment. Which artifact should the governance lead create next?

A company is performing an 'AI Impact Assessment' (AIA). Which domain is the most critical for identifying 'Privacy' risks?

An AI security manager is implementing an AI governance framework using the NIST AI RMF. Which action best demonstrates the 'Govern' function for a new generative AI deployment?

A financial services firm's AI governance committee is reviewing a new generative AI tool that creates personalized investment advice. The CISO asks the AI security manager to define accountability for the tool's outputs. According to ISACA's AI governance principles, who should ultimately be accountable for the ethical and secure use of the AI system?

An AI security program manager is assessing AI risks. Which tool provides the most centralized oversight for AI model compliance?

A technology company has developed an AI model for autonomous decision-making in its supply chain. The AI governance team is tasked with establishing a process for continuous monitoring of the model's performance and risk. Which of the following is the MOST critical element to include in the monitoring process to detect model drift?

When a model fails in production, what is the first step in the 'Incident Response' process?

A multinational bank's AI governance committee is drafting its charter. The General Counsel insists that the charter explicitly state who bears ultimate responsibility for the organization's AI-related legal and regulatory outcomes, and that this be documented and approved at the highest level. Which element of the AI governance charter is the General Counsel requiring?

Which THREE activities help manage 'AI Lifecycle' risk?

Which metric should be used to track 'Data Quality' for AI training?

What is the primary risk associated with 'Data Poisoning' in an AI governance program?

A multinational retailer is expanding its AI governance program to cover AI systems developed by its regional subsidiaries. The central AI governance office wants to ensure that subsidiary-developed AI systems are consistently registered, risk-assessed, and monitored. Which two governance mechanisms best achieve this consistency? (Choose two.)

A healthcare organization uses an AI system to prioritize patient follow-up calls. The system was trained on historical data that underrepresented certain demographic groups. The governance team wants to implement a control that detects and mitigates bias in the model's outputs on an ongoing basis. Which approach is most effective?

A retail company's AI governance committee is drafting a policy for employee use of public generative AI tools. The Chief Information Security Officer wants to ensure the policy addresses the most significant risk of data leakage. Which policy element is MOST directly aimed at preventing sensitive corporate data from being exposed through these tools?

A firm is drafting a policy for 'AI Use in Marketing'. Which element is most important to include to ensure alignment with existing data protection regulations?

What is the goal of an 'AI Security Awareness Program'?

Which THREE documents are vital for an AI audit trail?

Who is ultimately responsible for the outcomes of an AI system deployed by a business unit?

When evaluating AI 'Bias', which concept must be governed first?

How should an organization classify AI systems for governance?

A healthcare provider is deploying an AI triage tool that recommends patient priority in the emergency department. The governance committee wants to ensure that the tool's decisions can be explained to clinicians and regulators. Which practice best supports this requirement?

A healthcare organization is deploying an AI system to triage patient symptoms. The AI governance committee is reviewing the program's compliance with the organization's AI ethics principles. Which of the following is the MOST effective way to ensure that the AI system's decisions are explainable to clinicians and patients?

A company is developing an internal LLM-based tool. Which activity is required for 'Accountability'?

Which TWO strategies are recommended for 'Human-in-the-Loop' governance?

A retail company's board has approved an AI governance charter. The Chief AI Officer must now establish a mechanism to ensure that AI risks are escalated to the board when they exceed defined thresholds. Which element is most essential for this escalation mechanism to function effectively?

A healthcare insurer is standing up an AI governance program and must decide which structural components to include in its governance framework to ensure AI systems are developed and operated consistently across business units. (Choose two.)

A financial services firm's AI governance committee is establishing an enterprise-wide AI risk register. The CISO insists that every AI system be assigned a single residual risk rating at deployment so that systems can be ranked and remediation budgets allocated. During a pilot, a credit-scoring model was rated 'medium' residual risk, but six months later it was found to be making materially biased decisions for a protected class after a subtle drift in borrower behavior. Which governance approach BEST addresses this failure while preserving the committee's ability to rank systems?

A global retailer is expanding its AI governance program to include third-party AI vendors. The Chief AI Officer wants to ensure that vendor-provided AI systems are subject to the same risk management rigor as internally developed models. Which TWO activities should be prioritized to integrate third-party AI into the governance framework? (Choose two.)

When designing a secure AI development lifecycle (SDLC), which of the following is an essential governance activity during the 'Model Deployment' phase?

A technology company's AI governance team is reviewing its AI incident response plan. A recent incident involved an AI model that generated offensive language in customer interactions. The team wants to ensure future incidents are handled consistently. Which governance artifact should define the steps for detecting, reporting, and remediating AI-related incidents?

Which THREE security controls are effective against 'Data Leakage' in AI?

Which THREE metrics should be monitored for 'Model Performance' and security?

Which activity is part of 'Ongoing AI Monitoring'?

What is 'AI Risk Appetite'?

An organization is implementing 'Red Teaming' for AI. What is the main governance objective?