I85PREP
⌘ K
CAICSO study materials
CAICSO study resources

CAICSO practice questions

One question at a time. Build your CAICSO understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1AI Governance, Risk, and Compliance Frameworks

Which role in an AI governance structure is responsible for independent oversight of model risk and typically reports to the board rather than to the technology function?

  1. The product owner
  2. The model development team
  3. The second line of defence Correct answer.
  4. The data engineering lead

Explanation

In a three-lines-of-defence model, the second line provides independent risk and compliance oversight and reports outside the delivery function, giving it objectivity over model builders. The first line owns and operates the AI system, while the third line is internal audit.

Question 2AI Governance, Risk, and Compliance Frameworks

An organisation wants a single accountable executive who signs off on high-risk AI deployments. Which governance element does this describe?

  1. A data retention schedule
  2. A bias testing protocol
  3. A model inventory
  4. An AI accountability owner Correct answer.

Explanation

Assigning a named accountable owner ensures a human is answerable for AI decisions and sign-offs, which regulators and frameworks expect for high-risk systems. Inventories, retention schedules and testing protocols are supporting controls rather than accountability assignments.

Question 3AI Governance, Risk, and Compliance Frameworks

Which concept requires that a person be able to understand how an AI system reached a specific decision affecting them?

  1. Latency
  2. Explainability Correct answer.
  3. Interoperability
  4. Scalability

Explanation

Explainability is the property that lets stakeholders understand the factors and logic behind an AI output, which underpins contestability and transparency obligations. Scalability, latency and interoperability are engineering characteristics unrelated to understanding decisions.

Question 4AI Governance, Risk, and Compliance Frameworks

A regulator asks an organisation to classify an AI system that screens job applicants. Under most risk-based frameworks, how would such a system typically be classified?

  1. Prohibited
  2. High risk Correct answer.
  3. Minimal risk
  4. Out of scope

Explanation

Employment and worker-management uses that materially affect people's opportunities are consistently treated as high-risk because they can cause significant harm and are hard to reverse. Minimal-risk categories cover areas like spam filters, and prohibited uses are limited to specific unacceptable practices.

Question 5AI Governance, Risk, and Compliance Frameworks

Which artifact provides a structured record of an AI system's purpose, data sources, owners and known limitations throughout its lifecycle?

  1. A business continuity plan
  2. A model card or system datasheet Correct answer.
  3. A penetration test report
  4. A service level agreement

Explanation

Model cards and system datasheets document intended use, training data, performance and limitations, supporting transparency and audit. The other documents address contractual service levels, security testing or continuity, none of which capture AI system provenance.

Question 6AI Governance, Risk, and Compliance Frameworks

What is the primary purpose of maintaining an AI system inventory?

  1. To reduce cloud hosting costs
  2. To replace the need for human oversight
  3. To benchmark model accuracy against competitors
  4. To track which AI systems exist, their owners and their risk ratings Correct answer.

Explanation

An inventory gives governance teams visibility of all deployed and in-development AI systems so risk tiering, monitoring and reporting can be applied consistently. It does not itself mitigate risk or substitute for oversight.

Question 7AI Governance, Risk, and Compliance Frameworks

Which principle holds that AI systems should be fair and avoid discriminatory outcomes across population groups?

  1. Robustness
  2. Sustainability
  3. Privacy
  4. Fairness Correct answer.

Explanation

Fairness is the governance principle concerned with equitable treatment and the absence of unjustified disparate impact. Robustness concerns resilience to error and attack, privacy concerns personal data, and sustainability concerns environmental impact.

Question 8AI Governance, Risk, and Compliance Frameworks

In AI governance, what does human oversight mean in practice?

  1. Disabling automated logging for privacy
  2. Ensuring a competent person can monitor, intervene in and override system outputs Correct answer.
  3. Restricting AI use to internal staff only
  4. Requiring a human to manually label all training data

Explanation

Human oversight means meaningful human control, including the ability to review, intervene and stop or override AI behaviour where needed. It is about effective control, not manual data labour or restricting access.

Question 9AI Governance, Risk, and Compliance Frameworks

A bank's AI credit-scoring model is retrained monthly. Which governance control most directly addresses the risk that performance drifts after deployment?

  1. A larger marketing budget
  2. A one-time validation before launch
  3. Continuous monitoring with defined performance thresholds and alerts Correct answer.
  4. Annual third-party audit

Explanation

Ongoing monitoring with pre-agreed thresholds detects drift and degradation so remediation can be triggered promptly. Pre-deployment validation alone cannot capture post-launch changes in data or behaviour.

Question 10AI Governance, Risk, and Compliance Frameworks

Which of the following best describes the role of a model risk management framework in an AI governance programme?

  1. It guarantees that models will not fail
  2. It specifies the programming languages permitted for model development
  3. It defines how model risk is identified, assessed, mitigated and reported across the model lifecycle Correct answer.
  4. It replaces the organisation's data protection policy

Explanation

Model risk management frameworks set out the lifecycle processes for identifying, assessing, mitigating and reporting model risk, aligning governance with regulatory expectations. They do not prescribe tooling, replace privacy policy, or eliminate risk.

Question 11AI Governance, Risk, and Compliance Frameworks

An AI vendor supplies a third-party model used in customer service. Which governance obligation most directly applies to the deploying organisation?

  1. Removing the model from the inventory to avoid liability
  2. Assuming the vendor has fully addressed all risk
  3. Performing due diligence and maintaining oversight of the third-party model Correct answer.
  4. Delegating all accountability to the vendor

Explanation

Deployers remain responsible for due diligence and ongoing oversight of third-party AI, even when the model is supplied externally. Accountability for the use of the system cannot be fully outsourced to the provider.

Question 12AI Governance, Risk, and Compliance Frameworks

Which activity best demonstrates the principle of contestability for an AI decision?

  1. Providing a mechanism for affected individuals to challenge and seek review of a decision Correct answer.
  2. Publishing the model's source code
  3. Increasing the model's training data volume
  4. Reducing the model's inference cost

Explanation

Contestability means affected people can question an AI-assisted decision and obtain human review or redress. Publishing source code may aid transparency but does not by itself give a route to challenge outcomes.

Question 13AI Governance, Risk, and Compliance Frameworks

What is the main governance rationale for conducting a Data Protection Impact Assessment before deploying an AI system that processes personal data?

  1. To increase model accuracy
  2. To identify and mitigate privacy risks to individuals before processing begins Correct answer.
  3. To reduce the number of model parameters
  4. To satisfy marketing reporting requirements

Explanation

A DPIA is a structured assessment that identifies privacy risks and mitigations before high-risk processing starts, supporting accountability. It is a risk assessment, not a performance or marketing exercise.

Question 14AI Governance, Risk, and Compliance Frameworks

An organisation maps its AI governance controls to an external framework to demonstrate conformity. What is this activity called?

  1. Control mapping or gap assessment Correct answer.
  2. Load balancing
  3. Feature engineering
  4. Model distillation

Explanation

Control mapping aligns internal controls to framework requirements, and a gap assessment identifies where controls fall short. The other terms are technical engineering activities unrelated to conformity.

Question 15AI Governance, Risk, and Compliance Frameworks

Which of the following is the strongest example of a preventive control in an AI governance programme?

  1. Monthly performance dashboards
  2. An annual board presentation
  3. Post-incident root cause analysis
  4. A pre-deployment review gate that blocks release until risks are signed off Correct answer.

Explanation

Preventive controls stop problems before they occur, and a release gate that blocks deployment until risk sign-off is a clear example. Incident analysis is detective and corrective, dashboards are monitoring, and board reporting is oversight.

Question 16AI Governance, Risk, and Compliance Frameworks

A team wants to document who approved a high-risk AI system, when, and on what evidence. Which governance record is most appropriate?

  1. An audit log of model predictions
  2. A customer satisfaction survey
  3. A network topology diagram
  4. A decision log or approval record for the governance committee Correct answer.

Explanation

A governance decision log captures approvals, dates, rationale and supporting evidence, creating an auditable trail of accountability. Prediction logs, surveys and topology diagrams do not record approval decisions.

Question 17AI Governance, Risk, and Compliance Frameworks

Which statement best captures the relationship between AI governance and AI ethics?

  1. Ethics applies only to research and governance only to production
  2. Governance is optional and ethics is mandatory
  3. Ethics provides values and principles, while governance operationalises them through policies, controls and accountability Correct answer.
  4. They are unrelated disciplines with no overlap

Explanation

Ethics articulates normative principles such as fairness and non-maleficence, and governance translates them into enforceable policies, controls, roles and reporting. Governance is how ethical intent becomes operational practice.

Question 18AI Governance, Risk, and Compliance Frameworks

During an AI incident, which governance step should occur first according to typical incident response frameworks?

  1. Publicly announcing the root cause
  2. Deleting the affected logs
  3. Rewriting the model from scratch
  4. Containing the incident and activating the response team Correct answer.

Explanation

Incident response begins with containment and mobilising the response team to limit harm, followed by investigation and communication. Announcing root cause before investigation and deleting logs would both undermine the process.

Question 19AI Governance, Risk, and Compliance Frameworks

Which metric set is most relevant to evidencing fairness governance for a deployed classification model?

  1. Number of pull requests merged per sprint
  2. Server uptime and mean time to recovery
  3. Cloud spend per inference
  4. Disparate impact ratios and error rates across protected groups Correct answer.

Explanation

Fairness governance is evidenced by group-level outcome metrics such as disparate impact ratios and differential error rates. Uptime, development velocity and cost metrics speak to operations and engineering, not equity.

Question 20AI Governance, Risk, and Compliance Frameworks

A regulator introduces a new requirement that AI systems in critical infrastructure must be registered before deployment. Which governance response is most appropriate?

  1. Delegate registration entirely to individual engineers
  2. Remove critical infrastructure systems from scope
  3. Ignore the requirement until enforcement begins
  4. Update the AI inventory and release process to capture registration as a mandatory gate Correct answer.

Explanation

Regulatory change should be translated into updated inventory fields and a mandatory pre-deployment gate so compliance is systematic and evidenced. Deferring action or narrowing scope creates regulatory exposure.

Question 21AI Governance, Risk, and Compliance Frameworks

Which of the following best describes the purpose of an AI governance committee?

  1. To provide cross-functional oversight, approve high-risk use cases and set policy Correct answer.
  2. To replace internal audit
  3. To write all production code for AI systems
  4. To manage the organisation's payroll

Explanation

A governance committee brings together legal, risk, technology and business stakeholders to set policy, review high-risk use cases and oversee adherence. It does not perform engineering delivery or substitute for independent audit.

Question 22AI Governance, Risk, and Compliance Frameworks

An AI system used in medical triage produces different recommendations for two demographic groups with identical clinical inputs. Which governance concern is most directly triggered?

  1. Excessive network bandwidth
  2. Insufficient marketing reach
  3. Discriminatory bias requiring investigation and mitigation Correct answer.
  4. Licensing cost overrun

Explanation

Differential outputs for identical inputs across demographic groups indicate potential discriminatory bias, which triggers fairness review, root cause analysis and mitigation. Cost, bandwidth and marketing are unrelated to this disparity.

Question 23AI Governance, Risk, and Compliance Frameworks

An organisation claims its AI system is 'compliant with all applicable frameworks'. Which evidence would most strengthen this claim during an audit?

  1. A statement from the CEO
  2. A promise to comply in future releases
  3. A list of the frameworks the organisation has heard of
  4. A traceability matrix linking each framework requirement to implemented controls and test evidence Correct answer.

Explanation

A traceability matrix maps each requirement to a specific control and supporting evidence, which is what auditors test. Assertions, awareness lists and future commitments lack verifiable evidence of implementation.

Question 24AI Governance, Risk, and Compliance Frameworks

A model's performance degrades after a change in population data, but the model owner argues no action is needed because the original validation passed. What is the most significant governance weakness in this reasoning?

  1. Validation is always unnecessary
  2. It confuses point-in-time validation with ongoing fitness for purpose Correct answer.
  3. Population data is irrelevant to model performance
  4. Model owners should never be consulted

Explanation

Validation confirms fitness at a point in time, but governance requires ongoing monitoring to confirm the model remains fit for purpose as populations and conditions change. Relying on a past validation ignores post-deployment drift.

Question 25AI Governance, Risk, and Compliance Frameworks

A multinational deploys one AI system across jurisdictions with differing AI regulations. Which governance approach best manages the resulting compliance risk?

  1. Apply the least stringent jurisdiction's rules everywhere
  2. Apply rules only where enforcement is likely
  3. Delegate jurisdiction selection to end users
  4. Identify the strictest applicable requirements and harmonise controls to meet them Correct answer.

Explanation

Harmonising to the strictest applicable requirements creates a baseline that satisfies all jurisdictions and reduces fragmentation risk. Applying the weakest rules leaves the organisation non-compliant in stricter markets.

Question 26AI Governance, Risk, and Compliance Frameworks

An organisation adopts the OECD AI Principles as the ethical foundation of its AI governance programme. Which characteristic distinguishes these principles from a binding regulatory regime?

  1. They prescribe specific technical architectures that vendors must implement
  2. They apply only to public-sector AI systems and exclude commercial deployments
  3. They are voluntary recommendations that organisations commit to through policy rather than through legal enforcement Correct answer.
  4. They are enforceable only after a national court ratifies them

Explanation

The OECD AI Principles are non-binding recommendations that governments and organisations adopt voluntarily and translate into their own policies and laws. They set values such as human-centred values, transparency, and accountability, but they do not themselves impose enforceable legal duties. Binding obligations arise only when a jurisdiction enacts them into regulation.

Question 27AI Governance, Risk, and Compliance Frameworks

A governance team is classifying an AI system under a risk-based regulatory framework. Which factor most directly determines whether the system is placed in a higher risk tier?

  1. The number of engineers who contributed to the model's development
  2. The programming language used to implement the model
  3. The severity and likelihood of harm to health, safety, or fundamental rights if the system fails Correct answer.
  4. The cloud provider that hosts the inference endpoint

Explanation

Risk-based AI frameworks tier systems according to the potential severity and likelihood of harm to people, including health, safety, and fundamental rights. Technical implementation details such as language or hosting provider are not the basis for tiering. The classification drives the intensity of obligations such as conformity assessment and documentation.

Question 28AI Governance, Risk, and Compliance Frameworks

Which artefact most appropriately evidences that a high-risk AI system's technical documentation meets a conformity-oriented governance requirement?

  1. A slide deck summarising the project's quarterly budget
  2. A marketing brochure describing the system's benefits
  3. An internal chat log where engineers discussed the model informally
  4. A structured technical file covering intended purpose, training data, performance metrics, and known limitations Correct answer.

Explanation

Conformity-oriented regimes expect a structured technical file that documents intended purpose, data, performance, limitations, and risk controls. This artefact can be assessed by reviewers and regulators against defined requirements. Informal or promotional materials do not provide the traceable evidence needed.

Question 29AI Governance, Risk, and Compliance Frameworks

An organisation wants its AI governance programme to reflect the NIST AI Risk Management Framework. Which set of core functions does that framework organise its outcomes around?

  1. Govern, Map, Measure, Manage Correct answer.
  2. Design, Train, Deploy, Monitor
  3. Identify, Protect, Detect, Respond
  4. Plan, Build, Run, Retire

Explanation

The NIST AI RMF structures its outcomes around four core functions: Govern, Map, Measure, and Manage. Govern establishes accountability and culture, Map frames context and risk, Measure analyses and tracks risk, and Manage prioritises and treats it. The other option sets belong to project lifecycles, the CSF, and MLOps practice respectively.

Question 30AI Governance, Risk, and Compliance Frameworks

A hospital deploys an AI triage tool and must decide how much documentation and independent review to require. Under a proportionate governance approach, what should drive the intensity of these obligations?

  1. Whether the model was trained on-premises or in the cloud
  2. The number of API calls the system makes per day
  3. The size of the vendor's sales team in the region
  4. The risk level of the use case, considering patient harm potential and autonomy of the decision Correct answer.

Explanation

Proportionate governance scales obligations to the risk of the specific use case, including potential harm and the degree of autonomy in decisions affecting people. A high-stakes clinical triage context warrants stronger documentation and review than a low-risk application. Operational metrics and deployment location are not the primary drivers.

Question 31AI Governance, Risk, and Compliance Frameworks

A governance analyst is asked to explain the difference between an AI policy and an AI standard within an organisation's framework hierarchy. Which description is accurate?

  1. A policy states mandatory high-level commitments and direction, while a standard specifies detailed mandatory requirements that support the policy Correct answer.
  2. A policy applies only to executives, while a standard applies only to engineers
  3. A policy and a standard are interchangeable terms with identical content
  4. A policy is optional guidance, while a standard is a suggestion for good practice

Explanation

In a typical framework hierarchy, policies set mandatory direction and commitments approved at senior level, while standards translate those commitments into specific, testable requirements. Procedures then describe how to meet the standards. This layering ensures consistency between intent and operational practice.

Question 32AI Governance, Risk, and Compliance Frameworks

An AI governance lead must assign accountability for a model used in loan decisions. Which arrangement best reflects the principle of clear allocation of responsibility?

  1. Accountability is shared informally across the data science team with no named owner
  2. Responsibility rests with the cloud provider because it hosts the model
  3. Accountability is deferred until an incident occurs and then assigned ad hoc
  4. A named business owner is accountable for the system's outcomes, supported by defined roles for risk, data, and engineering Correct answer.

Explanation

Clear accountability requires a named owner who is answerable for the system's outcomes throughout its lifecycle, supported by explicit role definitions for related functions. Diffuse or informal ownership leaves gaps when decisions must be made. Hosting providers do not absorb the deploying organisation's accountability.

Question 33AI Governance, Risk, and Compliance Frameworks

A regulator asks how an organisation ensures that a generative AI assistant used by staff does not leak confidential information. Which governance control is most directly targeted at this risk?

  1. Publishing an AI ethics statement on the corporate website
  2. Enforcing an acceptable-use policy with data-handling restrictions and technical controls such as prompt filtering and logging Correct answer.
  3. Increasing the model's parameter count to improve answer quality
  4. Scheduling quarterly all-hands meetings about innovation

Explanation

Confidentiality risk from generative assistants is addressed through acceptable-use rules combined with technical safeguards such as data-loss prevention, prompt filtering, and logging. These controls restrict what data may be entered and provide auditability. General statements or model scaling do not constrain data exposure.

Question 34AI Governance, Risk, and Compliance Frameworks

An organisation operates an AI system in a jurisdiction that requires transparency to affected individuals. Which practice most directly satisfies a duty to inform people that they are interacting with an AI system?

  1. Including the model architecture in the source code repository
  2. Providing a clear notice to users at the point of interaction that they are engaging with an AI system Correct answer.
  3. Mentioning the AI system in the annual financial report
  4. Disclosing the use of AI in an internal engineering wiki

Explanation

Transparency duties toward affected individuals are met by informing them at the point where the AI system affects them, for example a clear notice in the interface. Internal documentation and corporate reporting do not reach the affected person at the relevant moment. The notice must be understandable to the audience.

Question 35AI Governance, Risk, and Compliance Frameworks

A team is building a register of AI risks for its governance committee. Which entry best represents a residual risk rather than an inherent risk?

  1. The risk that remains after bias testing, human review, and threshold tuning have been implemented Correct answer.
  2. The risk that the project will exceed its development budget
  3. The risk that a facial recognition system misidentifies people before any mitigation is applied
  4. The risk that a competitor will release a similar product first

Explanation

Inherent risk is the exposure before controls, while residual risk is what remains after mitigations are applied and measured. Governance committees typically accept or escalate residual risk because it reflects the actual exposure being carried. Budget and competitive risks are business risks, not AI system risks in this sense.

Question 36AI Governance, Risk, and Compliance Frameworks

An organisation must demonstrate that it monitors a deployed recommendation model for harmful drift. Which governance arrangement best supports ongoing monitoring obligations?

  1. Defined monitoring metrics, alert thresholds, review cadence, and a named owner who acts on alerts Correct answer.
  2. An annual user satisfaction survey with no link to model behaviour
  3. A one-time validation performed before launch with no further checks
  4. A policy statement that the model is expected to remain accurate

Explanation

Ongoing monitoring requires operational specifics: which metrics are tracked, what thresholds trigger alerts, how often results are reviewed, and who is accountable for acting. This creates a feedback loop from detection to remediation. Pre-launch validation alone cannot detect post-deployment drift.

Question 37AI Governance, Risk, and Compliance Frameworks

A company plans to deploy an AI system that profiles employees to predict productivity. A governance reviewer flags the need for a fundamental rights impact assessment. Which consideration most justifies that assessment?

  1. The system runs on graphics processing units
  2. The system uses a large number of features in its model
  3. The system was developed using open-source libraries
  4. The system affects workers' rights and may create power imbalances in the employment relationship Correct answer.

Explanation

Fundamental rights impact assessments focus on effects on people's rights and freedoms, including dignity, non-discrimination, and fair working conditions. Workplace profiling can create power asymmetries and affect employment rights, which is precisely the concern such an assessment addresses. Technical attributes like feature count or hardware are not the trigger.

Question 38AI Governance, Risk, and Compliance Frameworks

A multinational is deciding how to reconcile a global AI governance policy with local laws that impose stricter requirements in one country. Which approach is most defensible?

  1. Delegate all governance decisions to local marketing teams
  2. Adopt whichever local law is least demanding and apply it globally
  3. Apply the global baseline everywhere and ignore local stricter rules to keep consistency
  4. Set the global policy as a minimum baseline and require each jurisdiction to meet or exceed it where local law is stricter Correct answer.

Explanation

A defensible approach treats the global policy as a floor and requires local operations to comply with stricter applicable law, often described as a highest-requirement or baseline-plus model. This maintains consistency while respecting legal obligations in each jurisdiction. Ignoring stricter local law or applying the weakest standard creates legal and ethical exposure.

Question 39AI Governance, Risk, and Compliance Frameworks

An auditor asks how an organisation ensures that the humans reviewing an AI system's outputs can genuinely override them. Which evidence most directly demonstrates effective human oversight rather than nominal oversight?

  1. A screenshot of the system's dashboard
  2. A policy stating that humans are in the loop
  3. Logs showing reviewers have authority, information, time, and a documented override rate with outcomes Correct answer.
  4. A statement that the model is highly accurate

Explanation

Effective oversight requires that reviewers can understand the output, have the authority and time to intervene, and that overrides are recorded and examined. Evidence of override rates and their outcomes shows the control is exercised in practice. A policy statement or dashboard screenshot alone demonstrates intent, not functioning oversight.

Question 40AI Governance, Risk, and Compliance Frameworks

A governance committee is reviewing a vendor's claim that its AI system is 'ethically certified'. What is the most rigorous response consistent with good governance practice?

  1. Request the certification's scope, criteria, assessor independence, and how it maps to the organisation's own risk requirements Correct answer.
  2. Rely on the vendor's marketing materials as supporting evidence
  3. Accept the certification because it was issued by an external body
  4. Reject all third-party certifications as inherently unreliable

Explanation

Third-party certifications vary widely in scope and rigour, so governance should examine what was assessed, against which criteria, by whom, and how it maps to the organisation's own obligations. This due diligence preserves the deployer's accountability. Blind acceptance or blanket rejection both avoid the necessary analysis.

Question 41AI Risk Identification and Assessment

In an AI risk assessment, which term describes the chance that a specific harm occurs combined with the severity of that harm?

  1. Risk Correct answer.
  2. Variance
  3. Bias
  4. Latency

Explanation

Risk in AI governance is conventionally modeled as a function of likelihood and impact, so a low-probability but catastrophic failure can still be high risk. Bias, variance, and latency are model properties that may influence risk but do not themselves express the combined likelihood-and-severity construct.

Question 42AI Risk Identification and Assessment

A team is building a risk register for a deployed customer-facing chatbot. Which entry best represents an inherent risk rather than a control?

  1. Prompts are logged for later audit
  2. The model is retrained quarterly on curated data
  3. Outputs are filtered by a toxicity classifier
  4. The model may generate fabricated policy statements that customers rely on Correct answer.

Explanation

Inherent risk is the exposure that exists before mitigation, such as a model producing fabricated content that users act upon. Retraining cadence, output filtering, and logging are controls that reduce or detect risk rather than being risks themselves.

Question 43AI Risk Identification and Assessment

Which activity is the primary purpose of an AI system inventory during risk identification?

  1. Establishing a complete record of AI systems so each can be assessed and owned Correct answer.
  2. Replacing the need for human oversight
  3. Reducing cloud compute costs across teams
  4. Benchmarking model accuracy against competitors

Explanation

An inventory creates visibility so that every AI system is known, classified, and assigned an accountable owner before assessment begins. Without inventory coverage, systems escape assessment entirely, which is itself a governance risk.

Question 44AI Risk Identification and Assessment

A risk assessment team maps how training data is collected, labeled, and stored. Which risk category does this activity most directly address?

  1. Licensing cost risk
  2. Data provenance and quality risk Correct answer.
  3. User interface accessibility risk
  4. Model serving latency risk

Explanation

Tracing collection, labeling, and storage is data lineage work, which surfaces provenance, consent, and quality risks. These risks propagate into model behavior, so they are assessed at the data layer before modeling.

Question 45AI Risk Identification and Assessment

Which statement best characterizes a false negative in an AI screening tool used to flag fraudulent transactions?

  1. A fraudulent transaction that the model did not flag Correct answer.
  2. A legitimate transaction that the model flagged
  3. A model that fails to load at inference time
  4. A transaction processed twice by the payment system

Explanation

A false negative is a missed positive case, meaning the harmful event occurred but the model did not raise it. In fraud screening this translates directly into undetected loss, which is a key severity driver in the risk assessment.

Question 46AI Risk Identification and Assessment

What distinguishes a hazard from a risk in AI risk analysis?

  1. A hazard is a potential source of harm, while a risk combines that potential with likelihood and severity Correct answer.
  2. A hazard is a control failure, while a risk is a design choice
  3. A hazard is measurable, while a risk is always qualitative
  4. A hazard applies only to physical systems, while a risk applies only to software

Explanation

Hazards are the underlying conditions or sources that could cause harm, such as an unvalidated model in a clinical setting. Risk adds the dimensions of how likely the harm is and how severe it would be, enabling prioritization.

Question 47AI Risk Identification and Assessment

During risk identification, a team documents how users might misuse a generative model to produce disinformation. Which risk lens does this represent?

  1. Model drift risk
  2. Misuse and adversarial risk Correct answer.
  3. Infrastructure capacity risk
  4. Data retention risk

Explanation

Anticipating deliberate misuse by users or attackers is adversarial risk analysis, a required lens for dual-use generative systems. It differs from accidental failure modes because the actor is intentionally seeking harmful outcomes.

Question 48AI Risk Identification and Assessment

Which element is essential for a risk to be considered acceptable under a documented risk tolerance framework?

  1. An informal verbal agreement among the engineering team
  2. Removal of the system from the AI inventory
  3. A recorded decision that the residual risk falls within predefined tolerance thresholds Correct answer.
  4. A guarantee that no incidents will occur

Explanation

Acceptability is a governance judgment that compares residual risk, after controls, against thresholds set in advance and records the decision with accountability. Informal agreement lacks traceability, and no system can guarantee zero incidents.

Question 49AI Risk Identification and Assessment

A hiring model shows lower selection rates for one demographic group. Which assessment step should come first before attributing the gap to the model itself?

  1. Examine the historical training labels and the base rates in the underlying population Correct answer.
  2. Deploy a post-processing adjustment without analysis
  3. Immediately retrain the model on synthetic data
  4. Remove the demographic field from the dataset

Explanation

Observed disparities can originate in historical labels, sampling, or genuine base-rate differences, so diagnosis must precede remediation. Acting without diagnosis risks masking the cause or introducing new harms.

Question 50AI Risk Identification and Assessment

An AI system that recommends loan limits is assessed as having high severity but low likelihood of harmful error. How should this typically be prioritized relative to a high-likelihood, low-severity issue?

  1. It may warrant comparable priority because severity drives expected loss and potential irreversibility Correct answer.
  2. It should always be deprioritized because likelihood dominates severity
  3. It should be reclassified as a control rather than a risk
  4. It should be ignored until it occurs in production

Explanation

Risk prioritization weighs both dimensions; severe but rare harms in finance can be catastrophic and irreversible for individuals, so they are not automatically lower priority. A pure likelihood ranking would systematically underweight tail events.