AAISM study plan

Map the AI governance domain's exam weight against the other two domains and build a weighted study calendar for all eight weeks

Define AI governance program scope by drafting a one-page charter covering purpose, stakeholders, decision rights, and escalation paths

Identify the policy instruments a governance program relies on (acceptable use, model inventory, approval gates) and explain what each controls

Distinguish governance roles (executive sponsor, AI risk committee, model owner, independent reviewer) and assign accountability for each

Build a model inventory schema that captures purpose, data sources, autonomy level, and risk tier for each AI system

Design a stage-gate approval workflow from ideation through retirement, naming the evidence required at each gate

Write measurable governance KPIs (policy exception rate, inventory coverage, review cycle time) and state how each is collected

Explain how third-party and vendor AI components enter the inventory and approval process

Connect governance artifacts to risk management by mapping each policy control to a risk it mitigates

Draft a risk appetite statement for AI that distinguishes prohibited, high-risk, and acceptable use cases

Build a risk register with likelihood, impact, owner, and treatment columns and populate it with at least ten AI-specific risks

Explain how governance reporting escalates material AI risks to executive and board levels

Apply a risk assessment methodology to two contrasting AI use cases and compare resulting risk tiers

Distinguish inherent risk from residual risk and compute residual risk after named controls for each use case

Select treatment options (avoid, mitigate, transfer, accept) for each register entry and justify the choice

Identify risk monitoring triggers that would force reassessment of an approved AI system

Map AI-specific threats (data poisoning, prompt injection, model extraction, drift) to the controls that reduce them

Define testing and validation expectations before deployment, including bias testing, performance thresholds, and acceptance criteria

Design a continuous monitoring plan covering input drift, output quality, and incident detection with named metrics

Specify an AI incident response runbook from detection through containment, notification, and post-incident review

Explain how model architecture choices (classical ML versus deep learning versus generative models) change the control set required

Describe the data lifecycle controls for training and inference data: provenance, quality, labeling, retention, and privacy

Compare control approaches for model supply chain risk, including third-party models, fine-tuning, and open-weight deployment

Distinguish explainability and human oversight requirements by risk tier and describe how each is implemented

Trace one end-to-end scenario from governance approval through technical control implementation to risk monitoring

Audit your own control matrix for gaps where a governance requirement lacks a technical control or vice versa

Explain how audit, assurance, and independent review provide evidence that controls operate effectively

Prepare for scenario questions by writing out decision logic for three ambiguous governance-versus-technology tradeoffs

Rehearse timed mixed-domain scenario questions and score accuracy by domain to locate remaining weak areas

Rewrite your weakest week's notes into a condensed reference sheet of facts, frameworks, and decision rules

Explain aloud how the three domains interlock, using one worked example that spans all of them

Finalize a day-before exam checklist covering logistics, timing strategy, and topics to review last