I85PREP
⌘ K
AAISM study materials
AAISM study resources

AAISM practice questions

One question at a time. Build your AAISM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1AI Governance and Program Management

Under the NIST AI Risk Management Framework, which function is primarily responsible for establishing governance structures such as policies, roles, and accountability for AI risk?

  1. MEASURE
  2. MAP
  3. GOVERN Correct answer.
  4. MANAGE

Explanation

The GOVERN function establishes and maintains the organizational culture, policies, and accountability structures needed for AI risk management. MAP, MEASURE, and MANAGE address context, assessment, and treatment of risks rather than the governance scaffolding itself.

Question 2AI Governance and Program Management

An organization is defining an AI governance committee. Which design choice best supports effective oversight across the enterprise?

  1. Limiting membership to a single business unit to speed decisions
  2. Assigning the committee only to review marketing claims about AI features
  3. Delegating all AI decisions to individual data scientists without review
  4. Giving the committee a charter with defined authority, membership, and escalation paths Correct answer.

Explanation

Effective AI governance requires a clear charter that specifies authority, cross-functional membership, and escalation routes. Without defined authority and representation, oversight bodies cannot enforce decisions or resolve cross-unit conflicts.

Question 3AI Governance and Program Management

Which practice most directly supports AI accountability within a governance program?

  1. Defining named accountable owners for each AI system and documenting decisions Correct answer.
  2. Allowing model developers to self-attest without independent review
  3. Relying on vendor assurances about model behavior
  4. Publishing a general ethical principles statement once at launch

Explanation

Accountability requires identifiable owners and documented decisions so responsibility can be traced. General statements or vendor assurances do not create enforceable lines of responsibility.

Question 4AI Governance and Program Management

An AI program manager needs to classify a new generative AI tool used to draft customer emails. Which governance artifact should be completed first to determine applicable controls?

  1. An AI risk classification and use-case intake assessment Correct answer.
  2. A vendor invoice reconciliation
  3. A quarterly board presentation
  4. A model performance benchmark report

Explanation

Intake and risk classification determine the use case's risk tier, which then drives which controls apply. Benchmarking, reporting, and finance tasks follow once the classification and control requirements are known.

Question 5AI Governance and Program Management

What is the primary purpose of an AI system inventory in a governance program?

  1. To provide a maintained record of AI systems, owners, and risk attributes for oversight Correct answer.
  2. To track employee training completion
  3. To replace the need for individual risk assessments
  4. To document only open-source model licenses

Explanation

An AI inventory creates visibility into what AI systems exist, who owns them, and their risk characteristics, enabling oversight and prioritization. It complements rather than replaces risk assessments.

Question 6AI Governance and Program Management

Which metric best indicates whether an AI governance program is operating effectively rather than merely existing?

  1. The percentage of AI systems that completed required risk reviews before deployment Correct answer.
  2. The count of AI-related news articles monitored
  3. The total budget allocated to the AI team
  4. The number of pages in the AI policy document

Explanation

Effectiveness is shown by whether required governance activities actually occur, such as pre-deployment reviews. Document length, media monitoring, and budget size are inputs or activity proxies that do not demonstrate control operation.

Question 7AI Governance and Program Management

In a three-lines model applied to AI risk, who typically provides independent assurance over AI controls?

  1. The business unit that owns the AI system
  2. The external marketing agency
  3. The internal audit function Correct answer.
  4. The data science team building the model

Explanation

In the three-lines model, internal audit provides independent assurance over the effectiveness of controls. The first line owns and operates controls, and the second line provides oversight and challenge.

Question 8AI Governance and Program Management

What distinguishes an AI policy from an AI standard in a governance framework?

  1. A policy is optional guidance, while a standard is mandatory
  2. A policy applies only to executives, while a standard applies to engineers
  3. A policy states high-level principles and intent, while a standard specifies mandatory requirements Correct answer.
  4. A policy is technical, while a standard is legal

Explanation

Policies set the organization's high-level intent and principles, while standards translate that intent into specific mandatory requirements. Procedures then describe how to meet those standards operationally.

Question 9AI Governance and Program Management

A governance team is deciding how to handle a high-risk AI use case that fails a required fairness threshold shortly before launch. Which action best reflects a mature governance process?

  1. Override the threshold because the business case is strong
  2. Launch on schedule and address fairness in a later release
  3. Escalate to the governance body and pause deployment until remediation is approved Correct answer.
  4. Change the threshold retroactively to match the model's results

Explanation

Mature governance requires escalation and documented remediation when a control threshold is breached, with deployment paused until risk acceptance is formally decided. Retroactively changing thresholds or overriding controls undermines the program's integrity.

Question 10AI Governance and Program Management

Which element is most essential when documenting an AI risk acceptance decision?

  1. The identity of the approver, the rationale, and the residual risk level Correct answer.
  2. The programming language used to build the model
  3. The model's training dataset size only
  4. The marketing plan for the AI feature

Explanation

A defensible risk acceptance records who approved it, why, and the residual risk being accepted so the decision is auditable. Technical details alone do not establish accountability for accepting risk.

Question 11AI Governance and Program Management

An organization wants to align its AI governance program with ISO/IEC 42001. What does this standard primarily provide?

  1. Requirements for establishing an AI management system Correct answer.
  2. A taxonomy of neural network architectures
  3. A programming interface for model deployment
  4. A benchmark for GPU performance

Explanation

ISO/IEC 42001 specifies requirements for an AI management system, covering governance, risk, and continual improvement. It is a management system standard, not a technical or performance specification.

Question 12AI Governance and Program Management

A program manager must decide whether a planned AI system is subject to heightened governance controls. Which factor is most relevant to that determination?

  1. The color scheme of the user interface
  2. The preferred cloud hosting region
  3. The potential for significant harm to individuals' rights or safety Correct answer.
  4. The number of engineers assigned to the project

Explanation

Risk-based governance tiers heightened controls to systems with greater potential for harm to people's rights, safety, or wellbeing. Team size, hosting region, and design choices do not by themselves determine risk tier.

Question 13AI Governance and Program Management

Which approach best integrates AI governance into an existing enterprise risk management framework?

  1. Creating a fully separate AI risk process that never references enterprise risk categories
  2. Excluding AI risks from board reporting to avoid complexity
  3. Handling AI risks only within the data science team
  4. Mapping AI risks to existing enterprise risk taxonomies and reporting through established channels Correct answer.

Explanation

Integrating AI risks into existing enterprise taxonomies and reporting channels improves consistency, comparability, and escalation. A disconnected process creates duplication and gaps in oversight.

Question 14AI Governance and Program Management

During AI governance program planning, what is the most appropriate role of a cross-functional AI review board?

  1. Reviewing and approving higher-risk AI use cases and policy exceptions Correct answer.
  2. Performing only annual financial audits
  3. Writing production code for AI models
  4. Managing the organization's payroll system

Explanation

A cross-functional review board evaluates higher-risk use cases and adjudicates exceptions, providing multidisciplinary challenge. It does not perform engineering or unrelated operational functions.

Question 15AI Governance and Program Management

Which control best addresses the governance risk of shadow AI use within an organization?

  1. Disabling all internet access for staff
  2. Requiring employees to sign a confidentiality agreement only
  3. Banning all discussion of AI in the workplace
  4. Providing an approved tooling channel with clear intake and visibility into usage Correct answer.

Explanation

Shadow AI is reduced by offering an approved, easy-to-use channel and maintaining visibility into AI usage so risks can be governed. Prohibition without an alternative typically drives usage further underground.

Question 16AI Governance and Program Management

A governance program wants to ensure AI incidents are handled consistently. Which component is most important to establish?

  1. A defined incident reporting, triage, and response process with clear ownership Correct answer.
  2. A list of preferred AI vendors
  3. A catalog of model architectures
  4. A schedule of team-building events

Explanation

Consistent incident handling requires a documented process covering reporting, triage, response, and ownership. Vendor lists, events, and architecture catalogs do not provide incident response capability.

Question 17AI Governance and Program Management

Which statement best describes the relationship between AI governance and AI ethics in a program?

  1. Governance and ethics are unrelated disciplines
  2. Ethics replaces the need for governance controls
  3. Governance operationalizes ethical principles through policies, controls, and accountability Correct answer.
  4. Ethics applies only to external communications

Explanation

Ethics articulates values and principles, while governance translates them into enforceable policies, controls, and accountability mechanisms. Without operationalization, ethical principles remain aspirational.

Question 18AI Governance and Program Management

What is the most appropriate way to assign accountability when an AI system is procured from a third-party vendor?

  1. Assign an internal business owner accountable for the system's use and residual risk Correct answer.
  2. Assume the vendor bears all accountability with no internal owner
  3. Rely on the vendor's marketing materials for assurance
  4. Defer accountability until an incident occurs

Explanation

Even for procured systems, the organization remains accountable for how the system is used and for residual risk, so an internal owner must be designated. Vendor contracts allocate some responsibilities but do not remove internal accountability.

Question 19AI Governance and Program Management

A governance lead is designing reporting for executive leadership. Which content most usefully supports risk-based decision-making?

  1. A catalog of competitor AI products
  2. A summary of AI risk posture, open issues, exceptions, and trends against thresholds Correct answer.
  3. A list of all employees who attended AI training
  4. A raw dump of every model training log

Explanation

Executive reporting should summarize risk posture, unresolved issues, exceptions, and trends against defined thresholds to support decisions. Raw logs or unrelated lists do not inform governance choices.

Question 20AI Governance and Program Management

An organization operates in multiple jurisdictions with differing AI regulations. What governance approach best manages this complexity?

  1. Maintaining a control baseline mapped to jurisdictional obligations with local overlays Correct answer.
  2. Ignoring regulation until enforcement actions occur
  3. Applying rules only to systems built in headquarters
  4. Applying the least stringent jurisdiction's rules everywhere

Explanation

A common control baseline mapped to each jurisdiction's obligations, with local overlays, allows consistent governance while meeting specific legal requirements. Applying the weakest rules everywhere creates compliance gaps.

Question 21AI Governance and Program Management

A governance program's risk assessments are consistently completed but rarely influence deployment decisions. Which root cause should be investigated first?

  1. The organization has too few AI systems
  2. The assessment templates are too short
  3. Assessment outputs are not linked to decision gates or approval authority Correct answer.
  4. The models use too few parameters

Explanation

If assessments do not affect decisions, the likely gap is that outputs are not connected to deployment gates or empowered approvers. Template length, portfolio size, and model scale are unlikely to explain the disconnect.

Question 22AI Governance and Program Management

Which design most effectively prevents governance from becoming a one-time approval event for AI systems?

  1. Approving each system once at launch with no follow-up
  2. Reviewing systems only when a regulator requests it
  3. Requiring continuous monitoring with periodic re-review tied to defined triggers Correct answer.
  4. Delegating all monitoring to the model vendor

Explanation

Continuous monitoring and trigger-based re-review keep governance aligned with changing system behavior and context. One-time approval and reactive review leave post-deployment risk unmanaged.

Question 23AI Governance and Program Management

A board asks how to balance AI innovation speed with governance rigor. Which response best reflects sound program management?

  1. Require identical full review for every AI use regardless of risk
  2. Apply proportionate controls so lower-risk uses move quickly while higher-risk uses receive deeper review Correct answer.
  3. Pause all AI initiatives until regulations are finalized
  4. Eliminate governance review to maximize speed

Explanation

Proportionate, risk-based controls let low-risk work proceed efficiently while concentrating scrutiny where harm potential is greatest. Uniform maximal review or blanket pauses impose unnecessary cost and delay.

Question 24AI Governance and Program Management

An AI governance function reports to the same executive who owns the AI product lines. Why is this structure a potential concern?

  1. It reduces the number of governance staff
  2. It creates a conflict of interest that can weaken independent challenge Correct answer.
  3. It prevents the organization from using AI
  4. It eliminates the need for risk assessments

Explanation

When oversight reports to the same leader accountable for delivery, independence and the ability to challenge are weakened. Governance independence supports objective risk decisions and escalation.

Question 25AI Governance and Program Management

Which evidence best demonstrates that an AI governance program drives continual improvement?

  1. Documented corrective actions from prior findings with verified closure and trend improvement Correct answer.
  2. An annual survey of employee AI enthusiasm
  3. A growing list of unaddressed audit findings
  4. A static policy unchanged since inception

Explanation

Continual improvement is evidenced by corrective actions taken in response to findings, verification that they closed, and improving trends. Static policies or accumulating unresolved findings indicate stagnation.

Question 26AI Governance and Program Management

Which artifact typically sits at the top of an AI governance document hierarchy and states the organization's overall intent and commitment to responsible AI?

  1. The AI standard
  2. The AI procedure
  3. The AI risk register
  4. The AI policy Correct answer.

Explanation

An AI policy is the highest-level governance document; it articulates principles, scope, and executive commitment, and authorizes lower-level standards and procedures. Standards and procedures derive from and must align with the policy, while a risk register is an operational record, not a governing statement of intent.

Question 27AI Governance and Program Management

In an AI governance program, what is the primary purpose of maintaining an AI system inventory?

  1. To rank AI systems by their commercial revenue potential for portfolio planning
  2. To list the individual employees who are authorized to use generative AI tools
  3. To provide a complete record of AI systems and their attributes so governance controls can be scoped and applied Correct answer.
  4. To document the source code repositories used by data science teams

Explanation

An AI system inventory is the foundational register that records each AI system, its owner, purpose, risk classification, and lifecycle status, enabling the program to apply proportionate controls and monitor coverage. Without it, governance cannot reliably know which systems exist or which controls apply.

Question 28AI Governance and Program Management

Which role is most appropriate to own the day-to-day operation of an AI governance program, including maintaining policies, coordinating reviews, and tracking remediation?

  1. The AI governance lead or program manager Correct answer.
  2. The chief executive officer
  3. The internal audit function
  4. The data science team lead

Explanation

A dedicated AI governance lead or program manager is responsible for operating the program: maintaining artifacts, orchestrating reviews, and tracking issues to closure. Executives sponsor and approve, internal audit provides independent assurance, and data science leads own model development rather than program operations.

Question 29AI Governance and Program Management

Which statement best describes the concept of 'three lines of defense' as applied to AI governance?

  1. Three executive committees must unanimously approve every AI use case
  2. AI risks are classified into three severity tiers that determine reporting frequency
  3. Operational teams own and manage AI risk, a risk and compliance function oversees controls, and internal audit provides independent assurance Correct answer.
  4. Three separate vendors must independently certify every AI model before deployment

Explanation

The three-lines model separates risk ownership, oversight, and independent assurance so that no single group both manages and assures the same risk. Operational teams form the first line, risk and compliance the second, and internal audit the third.

Question 30AI Governance and Program Management

What is the most appropriate first step when establishing a new AI governance program in an organization that already has mature privacy and security functions?

  1. Immediately purchase an AI governance software platform to automate all workflows
  2. Require every employee to complete advanced AI ethics training within the first month
  3. Draft a public responsible AI statement before assessing internal practices
  4. Conduct a current-state assessment to map existing AI use, controls, and gaps against the target governance framework Correct answer.

Explanation

A current-state or gap assessment establishes what AI exists, which controls already apply through privacy and security, and where the program must focus. Building on existing functions avoids duplication and ensures the program design is risk-based rather than tool- or publicity-driven.

Question 31AI Governance and Program Management

Which document defines the scope, objectives, governance structure, and high-level timeline of an AI governance program?

  1. The AI model card
  2. The AI vendor contract
  3. The AI incident response playbook
  4. The AI governance program charter Correct answer.

Explanation

A program charter formally authorizes the program and records its scope, objectives, structure, roles, and milestones. Model cards describe individual models, incident playbooks guide response, and vendor contracts set commercial terms.

Question 32AI Governance and Program Management

Which of the following best describes the purpose of an AI risk taxonomy within a governance program?

  1. To specify the programming languages approved for machine learning development
  2. To provide a consistent set of risk categories so that AI risks can be identified, assessed, and compared across the organization Correct answer.
  3. To list the names of employees who are permitted to develop AI models
  4. To record the financial budget allocated to each AI project

Explanation

A risk taxonomy defines common categories and terminology so that risks from different AI systems can be consistently identified, rated, and aggregated. It supports comparability and reporting, rather than access control, technology standards, or budgeting.

Question 33AI Governance and Program Management

A governance program wants to ensure that AI risks are reviewed at a consistent cadence and that owners are held to remediation dates. Which mechanism is most directly suited to this need?

  1. A quarterly all-hands presentation on AI ethics principles
  2. A static list of approved AI tools published on the intranet
  3. An annual employee satisfaction survey that includes AI questions
  4. A risk register with assigned owners, due dates, and periodic review status Correct answer.

Explanation

A risk register with ownership, due dates, and review status creates traceable accountability and a recurring review rhythm. Awareness activities and static lists do not track remediation or assign responsibility.

Question 34AI Governance and Program Management

An AI governance program is being designed for a decentralized organization where business units procure AI tools independently. Which control is most important to include in the program design?

  1. A centralized intake and approval process for new AI tools and use cases Correct answer.
  2. A ban on all third-party AI procurement
  3. Delegation of all AI risk decisions to individual procurement officers
  4. A requirement that each business unit publish its own AI policy without coordination

Explanation

In a decentralized organization, a centralized intake and approval process provides visibility and consistent risk evaluation while allowing business units to operate. Fragmented policies or blanket bans create inconsistency or push AI use underground, and delegating risk decisions to procurement officers removes necessary oversight.

Question 35AI Governance and Program Management

Which set of metrics best demonstrates that an AI governance program is maturing over time?

  1. The number of AI governance meetings held and the total headcount of the governance team
  2. The volume of AI-related news articles shared internally each quarter
  3. The total number of AI models trained by the organization
  4. Trends in risk assessment coverage, time to remediate findings, and the proportion of AI systems with assigned accountable owners Correct answer.

Explanation

Maturity is evidenced by improving coverage, faster remediation, and clear ownership across the AI estate, which reflect embedded governance rather than activity volume. Meeting counts, news sharing, and model counts measure effort or output, not governance effectiveness.

Question 36AI Governance and Program Management

A business unit wants to deploy a customer-facing chatbot that uses a third-party large language model. Which governance requirement is most appropriate before approval?

  1. A guarantee that the vendor will never change the underlying model
  2. A documented risk assessment covering vendor due diligence, data handling, and human oversight of outputs Correct answer.
  3. A requirement that the chatbot be built entirely in-house
  4. A commitment to remove all human review to improve response speed

Explanation

Third-party model use introduces vendor, data protection, and output-quality risks that must be assessed and mitigated with appropriate oversight. Requiring immutability, removing human review, or mandating in-house build are either infeasible or counterproductive to risk management.

Question 37AI Governance and Program Management

Which approach best ensures that AI governance requirements are applied consistently across an organization's development lifecycle?

  1. Relying on developers to self-certify compliance without documentation
  2. Conducting a single governance review at the end of each project before launch
  3. Embedding governance checkpoints and required evidence into each stage of the existing development lifecycle Correct answer.
  4. Publishing the AI policy on the intranet and assuming teams will comply

Explanation

Embedding checkpoints and evidence requirements into the lifecycle makes governance a continuous, enforceable part of delivery. A single end-stage review catches issues too late, self-certification without evidence is unverifiable, and policy publication alone does not ensure application.

Question 38AI Governance and Program Management

A governance committee is reviewing an AI system that will make recommendations affecting loan eligibility. Which factor most strongly indicates that the system should be classified as high-risk under most AI governance frameworks?

  1. The system uses a deep neural network rather than a simpler model
  2. The system processes a large volume of transactions per day
  3. The system was developed by an external vendor rather than in-house
  4. The system's outputs materially affect individuals' access to a financial service Correct answer.

Explanation

Risk classification is driven primarily by the potential impact on individuals and their rights or access to essential services, not by model architecture, sourcing, or transaction volume. A system affecting credit access can cause significant harm, warranting heightened controls.

Question 39AI Governance and Program Management

Which structure best supports escalation of urgent AI safety concerns from operational teams to executive leadership?

  1. A general email alias monitored on a best-efforts basis
  2. A defined escalation path with severity criteria, named contacts, and response time targets Correct answer.
  3. A requirement that concerns be raised only through line management without time targets
  4. An anonymous suggestion box reviewed annually

Explanation

Effective escalation requires clear criteria, named responsible contacts, and time-bound response expectations so urgent issues reach decision-makers quickly. Anonymous annual review, untimed line management, and best-efforts monitoring lack the structure and urgency needed.

Question 40AI Governance and Program Management

When an organization adopts an external AI governance framework, what is the most appropriate way to tailor it to the organization's context?

  1. Select only the requirements that are easiest to implement
  2. Replace the framework entirely with internally invented controls
  3. Adopt every requirement verbatim without modification to preserve fidelity
  4. Map the framework's requirements to existing processes and perform a gap assessment to prioritize adaptations Correct answer.

Explanation

Frameworks are designed to be adapted; mapping requirements to current practice and assessing gaps allows proportionate, risk-based implementation. Verbatim adoption may create impractical burdens, cherry-picking undermines coverage, and discarding the framework forfeits its recognized structure.

Question 41AI Governance and Program Management

Which practice best ensures that AI governance decisions are documented and defensible during a later audit?

  1. Documenting decisions only when the outcome is a rejection
  2. Storing only the final approval email in a shared mailbox
  3. Recording the decision rationale, evidence considered, approvers, and any conditions or exceptions Correct answer.
  4. Relying on the recollection of committee members if questions arise

Explanation

Audit-defensible decisions require a contemporaneous record of rationale, evidence, approvers, and conditions, showing that due process was followed. Isolated emails, memory, and selective documentation cannot demonstrate how and why decisions were reached.

Question 42AI Governance and Program Management

A governance program finds that business teams frequently bypass the AI review process to meet deadlines. Which root cause is most likely and should be investigated first?

  1. Business teams do not understand AI technology well enough
  2. The AI policy is written in too much technical detail
  3. The organization has too few data scientists
  4. The review process creates delays that are incompatible with delivery timelines and lacks fast-track options Correct answer.

Explanation

Bypass behavior usually signals that the control process imposes costs that teams cannot absorb within delivery timelines; investigating process friction and offering proportionate fast-track routes addresses the incentive to evade. Technology understanding, staffing, and policy detail are less direct explanations for deliberate circumvention.

Question 43AI Governance and Program Management

Which reporting content would best enable an executive committee to make risk-based decisions about the AI portfolio?

  1. A count of AI governance meetings held and attendees
  2. A summary of material AI risks, their ratings, mitigation status, and decisions requiring executive attention Correct answer.
  3. A detailed technical description of each model's architecture
  4. A complete list of every AI model trained in the past quarter

Explanation

Executives need prioritized risk information and clear decision points to exercise oversight. Model inventories, architecture descriptions, and meeting statistics are operational details that do not support risk-based decision-making at the executive level.

Question 44AI Governance and Program Management

Which approach best ensures that AI governance requirements remain current as regulations and technology evolve?

  1. A scheduled review cycle with assigned owners that incorporates regulatory monitoring and lessons learned Correct answer.
  2. A policy that is reviewed only when a serious incident occurs
  3. Delegation of all updates to the procurement team
  4. A one-time legal review at program inception

Explanation

Governance content must be maintained through planned reviews that incorporate regulatory change and operational learning. Incident-only review is reactive, a one-time legal review becomes stale, and procurement lacks the mandate to own governance updates.

Question 45AI Governance and Program Management

A governance program wants to reduce the burden of reviewing low-risk AI use cases while preserving oversight of high-risk ones. Which design best achieves this?

  1. A single review depth applied uniformly to every AI use case
  2. Review by the full board for every AI use case regardless of risk
  3. Exemption of all internal-facing AI systems from review
  4. A tiered review model where risk classification determines the depth of assessment and approval level Correct answer.

Explanation

Tiered review aligns scrutiny with risk, reducing effort for low-risk cases while concentrating oversight where harm is greatest. Uniform review wastes resources, blanket exemptions for internal systems ignore potential harm, and full-board review of everything is unsustainable.

Question 46AI Governance and Program Management

Which factor most undermines the independence of an AI governance review board?

  1. It documents its decisions and publishes summaries to stakeholders
  2. It includes members from legal, risk, and engineering functions
  3. Its chair also holds profit-and-loss accountability for the AI products being reviewed Correct answer.
  4. It meets on a fixed monthly schedule

Explanation

Independence requires that decision-makers are not accountable for the commercial outcomes of the systems they oversee, since that creates a conflict of interest. Cross-functional membership, documentation, and regular cadence support, rather than undermine, board effectiveness.

Question 47AI Governance and Program Management

An organization's AI governance program has strong policies but no mechanism to verify that controls operate as designed. Which governance gap is most significant?

  1. Absence of independent testing and monitoring to provide assurance over control effectiveness Correct answer.
  2. Insufficient number of policy documents
  3. Lack of a published AI ethics statement
  4. Too few governance committee meetings per year

Explanation

Policies define expectations, but assurance requires independent testing and monitoring to confirm controls work in practice. More documents, public statements, or meeting frequency do not substitute for verification of control operation.

Question 48AI Governance and Program Management

A multinational organization must comply with conflicting AI transparency requirements across jurisdictions. Which governance approach is most defensible?

  1. Let each local team decide which requirements to follow without central records
  2. Suspend AI deployments until global regulations are fully harmonized
  3. Apply the least stringent requirement everywhere to minimize cost
  4. Adopt a baseline standard that satisfies the strictest applicable requirement and document jurisdiction-specific deviations Correct answer.

Explanation

A strictest-common-denominator baseline with documented local deviations provides consistent protection while managing jurisdictional differences. Applying the weakest rule creates compliance exposure, uncoordinated local choices produce gaps, and suspending deployment is commercially untenable.

Question 49AI Governance and Program Management

Which evidence most convincingly shows that an AI governance program is influencing actual delivery decisions rather than operating as a paper exercise?

  1. Documented instances where governance review changed, conditioned, or halted an AI deployment Correct answer.
  2. A high attendance rate at AI ethics awareness sessions
  3. A published organizational chart showing the governance function
  4. A complete set of approved policies stored in the document management system

Explanation

Influence is demonstrated when governance findings materially alter delivery outcomes, such as conditions, redesigns, or halts. Policies, training attendance, and org charts show that the program exists, not that it affects decisions.

Question 50AI Governance and Program Management

A governance lead is asked to justify the cost of the AI governance program. Which framing is most likely to secure sustained executive support?

  1. Arguing that governance costs should be minimized because they do not affect business outcomes
  2. Promising that governance will eliminate all AI-related incidents
  3. Emphasizing that governance is a moral obligation without quantifying organizational benefits
  4. Linking governance investment to reduced regulatory exposure, avoided incident costs, and faster trusted deployment Correct answer.

Explanation

Executives fund programs that demonstrably protect value and enable business objectives; framing governance in terms of risk reduction and deployment speed aligns it with organizational priorities. Moral appeals alone, cost minimization, and unrealistic promises weaken the case.