To prevent all changes after deployment<\/span><\/li>\n<\/ol>\nCorrect Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI risk management is intended to help organizations identify, evaluate, prioritize, and address risks associated with AI systems. Risks can arise during design, development, procurement, deployment, operation, modification, and retirement. Effective risk management considers factors such as potential harm, likelihood, affected stakeholders, data sensitivity, security, reliability, privacy, and human oversight. Once risks are identified, organizations can implement controls that are appropriate to the system’s circumstances and risk level. Risk management does not mean eliminating every AI system or guaranteeing perfect performance. Instead, it provides a structured approach for making informed decisions and reducing avoidable risks while allowing organizations to use AI responsibly.<\/span><\/p>\nQuestion 222<\/b><\/p>\n
Which approach is most appropriate when prioritizing AI risks?<\/b><\/p>\n\n- Prioritize risks based only on the age of the AI system<\/span><\/li>\n
- Consider factors such as likelihood, severity, and potential impact<\/span><\/li>\n
- Treat every identified risk as equally important<\/span><\/li>\n
- Ignore risks that have not previously caused an incident<\/span><\/li>\n<\/ol>\n
Correct Answer: 2<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI risks should generally be prioritized according to factors such as likelihood, potential severity, scope of impact, affected stakeholders, and the organization’s ability to detect or mitigate the risk. A risk that is unlikely but could cause severe harm may deserve significant attention, while a frequent but very low-impact issue may require a different response. Organizations should avoid relying solely on historical incidents because emerging risks may not have occurred previously. Risk prioritization helps governance teams allocate resources effectively and focus stronger controls on the areas where they can provide the greatest benefit. A structured risk-ranking approach also supports consistent decision-making across different AI systems and use cases.<\/span><\/p>\nQuestion 223<\/b><\/p>\n
What is the purpose of a risk register for AI systems?<\/b><\/p>\n\n- To record identified risks, assessments, owners, and mitigation activities<\/span><\/li>\n
- To store only employee passwords<\/span><\/li>\n
- To replace all AI system documentation<\/span><\/li>\n
- To guarantee that no risks will occur<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
An AI risk register provides a structured record of identified risks and the organization’s response to those risks. Depending on the governance framework, it may contain information about the risk description, likelihood, potential impact, risk owner, mitigation measures, status, review dates, and residual risk. A risk register can help governance teams track whether identified issues have been addressed and whether risk levels change over time. It does not guarantee that new risks will not occur. Instead, it provides visibility and accountability for known risks and supports ongoing review. Keeping the register current can also help management understand the organization’s overall AI risk landscape and identify areas requiring additional attention.<\/span><\/p>\nQuestion 224<\/b><\/p>\n
What does residual risk represent in AI risk management?<\/b><\/p>\n\n- Risk that remains after implemented controls and mitigation measures are considered<\/span><\/li>\n
- Risk that existed before the AI system was designed<\/span><\/li>\n
- Risk that has automatically been eliminated<\/span><\/li>\n
- Risk caused only by software licensing<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Residual risk is the level of risk that remains after an organization has implemented relevant controls and mitigation measures. AI systems may continue to have some level of uncertainty or potential harm even after safeguards are applied. Organizations should therefore evaluate whether the remaining risk is acceptable under their established criteria and whether additional controls are necessary. Residual risk should be documented and assigned to an appropriate owner when required. It is different from the initial or inherent risk that exists before mitigation. Understanding residual risk helps decision-makers avoid assuming that implementing controls completely eliminates a risk. Instead, it supports informed decisions about whether remaining exposure is appropriate for the intended use.<\/span><\/p>\nQuestion 225<\/b><\/p>\n
Why should AI risk owners be clearly identified?<\/b><\/p>\n\n- To establish accountability for monitoring and addressing assigned risks<\/span><\/li>\n
- To ensure only one person can ever use the AI system<\/span><\/li>\n
- To remove the need for risk assessments<\/span><\/li>\n
- To guarantee that assigned risks will never occur<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
A clearly identified risk owner helps ensure that someone has responsibility for monitoring a particular risk and coordinating appropriate mitigation or escalation. The risk owner may not personally perform every mitigation activity, but they should have sufficient authority and knowledge to ensure that the risk receives appropriate attention. Clear ownership prevents risks from becoming organizational responsibilities that no one actively manages. It also supports accountability when risk conditions change or when incidents occur. Identifying an owner does not guarantee that the risk will disappear. Instead, it creates a clear point of responsibility for reviewing the risk, coordinating responses, and determining whether additional action or escalation is necessary.<\/span><\/p>\nQuestion 226<\/b><\/p>\n
Which practice can help ensure that AI risk assessments remain current?<\/b><\/p>\n\n- Establishing defined reassessment triggers and periodic reviews<\/span><\/li>\n
- Performing the assessment only once and permanently archiving it<\/span><\/li>\n
- Ignoring changes to system functionality<\/span><\/li>\n
- Removing risk information after deployment<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Risk assessments should remain relevant as AI systems and their operating environments evolve. Organizations can support this by establishing reassessment triggers, such as major model changes, changes in intended use, significant incidents, new data sources, changes in affected populations, or newly identified vulnerabilities. Periodic reviews can also provide an opportunity to confirm that previous assumptions and controls remain appropriate. A one-time assessment may become outdated as circumstances change. Removing risk information would make it more difficult to understand previous decisions and identify trends. Maintaining current assessments helps organizations make informed governance decisions and ensures that controls remain aligned with the actual risks associated with the system.<\/span><\/p>\nQuestion 227<\/b><\/p>\n
What is a key benefit of using standardized AI risk assessment criteria?<\/b><\/p>\n\n- It promotes consistency when evaluating different AI systems<\/span><\/li>\n
- It guarantees identical risk outcomes for every system<\/span><\/li>\n
- It eliminates the need for professional judgment<\/span><\/li>\n
- It prevents organizations from updating their criteria<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Standardized risk assessment criteria provide a consistent framework for evaluating AI systems across an organization. They can help ensure that important factors such as potential harm, likelihood, data sensitivity, human oversight, security, and affected stakeholders are considered systematically. Standardization does not mean that every AI system will receive the same risk rating because the characteristics and impacts of systems can differ significantly. Professional judgment may still be required when interpreting evidence or addressing unusual circumstances. Criteria should also be reviewed and updated when organizational requirements or risk conditions change. A consistent framework improves comparability, documentation, and decision-making while still allowing assessments to reflect the unique characteristics of each AI use case.<\/span><\/p>\nQuestion 228<\/b><\/p>\n
Which action is most appropriate when an AI risk exceeds the organization’s established risk tolerance?<\/b><\/p>\n\n- Escalate the issue and consider additional mitigation, restriction, or discontinuation<\/span><\/li>\n
- Ignore the risk because the system is already deployed<\/span><\/li>\n
- Remove the risk from the register<\/span><\/li>\n
- Automatically classify the risk as acceptable<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
When an AI risk exceeds established risk tolerance, the organization should not simply continue normal operation without review. The issue should be escalated to the appropriate decision-makers, who can determine whether additional safeguards, restrictions, changes to the system, or suspension are necessary. In some situations, modifying the intended use may reduce the risk to an acceptable level. In others, the organization may determine that the system should not continue operating under the current conditions. Removing the risk from documentation would not reduce the underlying exposure. A defined risk tolerance framework helps organizations make consistent decisions about when risks require escalation and when residual risk may be accepted.<\/span><\/p>\nQuestion 229<\/b><\/p>\n
Why should AI governance consider the possibility of model or data drift?<\/b><\/p>\n\n- Changes in data or operating conditions can affect system performance over time<\/span><\/li>\n
- Drift guarantees that model accuracy will improve<\/span><\/li>\n
- Drift occurs only before deployment<\/span><\/li>\n
- Drift eliminates the need for monitoring<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Model or data drift can occur when the characteristics of the data or operating environment change from the conditions present during development and evaluation. These changes can reduce model performance or create new risks even when the underlying model has not been modified. For example, user behavior, market conditions, language patterns, or other relevant characteristics may change over time. Monitoring can help identify these changes and determine whether additional evaluation or model updates are required. Organizations should consider drift as part of post-deployment risk management, particularly for systems that depend heavily on changing real-world data. Drift does not necessarily mean performance will always decline, but it creates a reason for continued observation.<\/span><\/p>\nQuestion 230<\/b><\/p>\n
What is the purpose of establishing AI risk acceptance criteria?<\/b><\/p>\n\n- To define the conditions under which residual risk may be considered acceptable<\/span><\/li>\n
- To guarantee that every AI system receives approval<\/span><\/li>\n
- To eliminate the need for mitigation<\/span><\/li>\n
- To allow employees to accept risks without authorization<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Risk acceptance criteria provide a structured basis for determining when remaining AI risk may be considered acceptable. Criteria can take into account factors such as potential severity, likelihood, affected stakeholders, available controls, legal or organizational requirements, and the organization’s defined risk tolerance. Establishing criteria before decisions are made can improve consistency and reduce arbitrary judgments. Risk acceptance should also be assigned to appropriate authority levels because higher-risk decisions may require senior management or specialized governance approval. Acceptance does not mean that the risk has disappeared. It means the organization has consciously evaluated the remaining exposure and determined that it falls within established boundaries under the applicable circumstances.<\/span><\/p>\nQuestion 231<\/b><\/p>\n
Which document is most useful for describing how an AI system is intended to operate and its known characteristics?<\/b><\/p>\n\n- Appropriate system documentation containing purpose, functionality, limitations, and relevant controls<\/span><\/li>\n
- An unrelated employee directory<\/span><\/li>\n
- A list of office equipment<\/span><\/li>\n
- An invoice containing only payment information<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Appropriate system documentation can provide a structured description of an AI system’s purpose, functionality, intended use, limitations, data characteristics, performance information, and relevant governance controls. The specific documentation required depends on the system and its risk level. Good documentation helps developers, users, governance teams, auditors, and decision-makers understand how the system is expected to operate. It can also support risk assessments, testing, monitoring, incident investigations, and change management. Documentation should be kept current when material changes occur. An unrelated administrative document cannot provide the information needed to understand AI system behavior or governance requirements. Effective documentation is therefore an important part of transparency and accountability.<\/span><\/p>\nQuestion 232<\/b><\/p>\n
Why should organizations document significant AI system dependencies?<\/b><\/p>\n\n- To understand how changes or failures in connected components may affect the AI system<\/span><\/li>\n
- To ensure all dependencies are permanently removed<\/span><\/li>\n
- To prevent any system from being updated<\/span><\/li>\n
- To avoid monitoring third-party services<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
AI systems often depend on other components, such as data pipelines, external APIs, cloud services, identity systems, databases, models, vendors, or monitoring tools. Documenting these dependencies helps organizations understand how failures or changes in one component may affect the AI system. Dependency information can support impact analysis, incident response, change management, security reviews, and business continuity planning. It can also help teams identify which external providers require due diligence or contractual controls. Dependencies do not need to be removed simply because they exist. Instead, organizations should understand their importance and manage associated risks appropriately. Clear dependency documentation can make troubleshooting and governance significantly more effective.<\/span><\/p>\nQuestion 233<\/b><\/p>\n
Which practice best supports accountability when an AI system is purchased from an external provider?<\/b><\/p>\n\n- Clearly defining responsibilities between the organization and the provider<\/span><\/li>\n
- Assuming the provider is responsible for every organizational obligation<\/span><\/li>\n
- Avoiding contracts or written requirements<\/span><\/li>\n
- Allowing the provider to determine all internal governance policies<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
When an organization uses a third-party AI system, responsibilities should be clearly defined between the organization and the provider. Contracts and related documentation can address areas such as security, privacy, data use, incident notification, performance expectations, support, audit rights, and change notification. The organization should understand which responsibilities remain internal even when technology is supplied externally. Assuming that the provider is responsible for every obligation can create governance gaps. Clear allocation of responsibilities helps both parties understand what they are expected to do and provides a basis for escalation when requirements are not met. Third-party procurement should therefore be integrated into the organization’s broader AI governance program.<\/span><\/p>\nQuestion 234<\/b><\/p>\n
What should an organization do when a third-party AI provider makes a significant model change?<\/b><\/p>\n\n- Determine whether the change affects performance, risk, intended use, or existing controls<\/span><\/li>\n
- Automatically assume that the change is harmless<\/span><\/li>\n
- Delete all vendor documentation<\/span><\/li>\n
- Continue using the system without reviewing the change<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Significant changes made by a third-party AI provider can affect the behavior, performance, security, data processing, or risk profile of an AI system. Organizations should therefore have processes for identifying important provider changes and determining whether additional evaluation is necessary. Depending on the circumstances, the organization may need updated documentation, performance testing, risk reassessment, user communication, or revised controls. Contracts can help by requiring providers to notify customers about material changes. Automatically assuming that every provider change is harmless can create governance gaps. Effective third-party management recognizes that externally supplied systems still need appropriate oversight when changes could affect the organization’s use of the technology.<\/span><\/p>\nQuestion 235<\/b><\/p>\n
Which principle is most relevant when collecting personal information for an AI system?<\/b><\/p>\n\n- Collect information that is appropriate and necessary for the defined purpose<\/span><\/li>\n
- Collect as much information as possible regardless of purpose<\/span><\/li>\n
- Avoid documenting why information is collected<\/span><\/li>\n
- Retain every piece of information indefinitely<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Organizations should consider whether personal information collected for an AI system is appropriate and necessary for the defined purpose. Collecting excessive information can increase privacy, security, and governance risks without providing a legitimate benefit. Purpose definition helps organizations determine what information is relevant and what uses are appropriate. Data minimization can also reduce the potential impact of a security incident because fewer unnecessary records are maintained. The exact requirements depend on the applicable legal and organizational framework, but responsible AI governance should consider whether data collection is justified and proportionate. Organizations should also establish appropriate controls for access, retention, use, and disposal of personal information.<\/span><\/p>\nQuestion 236<\/b><\/p>\n
What is a key purpose of conducting security testing on an AI system?<\/b><\/p>\n\n- To identify vulnerabilities and weaknesses that could be exploited or cause harm<\/span><\/li>\n
- To guarantee that attackers can never compromise the system<\/span><\/li>\n
- To replace all other forms of AI testing<\/span><\/li>\n
- To eliminate the need for access controls<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Security testing helps organizations identify vulnerabilities and weaknesses that could affect the confidentiality, integrity, or availability of an AI system and its associated data. Depending on the system, security evaluation may consider unauthorized access, insecure interfaces, data exposure, malicious inputs, model-related attacks, and weaknesses in supporting infrastructure. Testing provides evidence that can guide remediation and help determine whether security controls are adequate. It cannot guarantee that an attacker will never compromise a system because security risks continuously evolve. Security testing should therefore be combined with access controls, monitoring, secure development practices, vulnerability management, and incident response. The depth of testing should be proportionate to the system’s risk.<\/span><\/p>\nQuestion 237<\/b><\/p>\n
Which activity can help determine whether an AI system is robust?<\/b><\/p>\n\n- Testing its behavior under relevant variations and unexpected but plausible conditions<\/span><\/li>\n
- Testing only one ideal input<\/span><\/li>\n
- Avoiding all edge cases<\/span><\/li>\n
- Assuming successful development proves robustness<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Robustness testing evaluates whether an AI system continues to behave appropriately when conditions vary from the expected or ideal scenario. Testing may include changes in input characteristics, incomplete information, unusual but plausible cases, environmental variations, or other conditions relevant to the system’s intended operation. The exact tests depend on the AI application’s purpose and risk. A system that works only with ideal inputs may fail when deployed in real-world conditions. Robustness testing can reveal weaknesses that ordinary accuracy testing might not detect. Results should be documented and reviewed against appropriate acceptance criteria. If significant weaknesses are discovered, mitigation or restrictions may be required before or after deployment.<\/span><\/p>\nQuestion 238<\/b><\/p>\n
Why should organizations define AI system retirement criteria?<\/b><\/p>\n\n- To establish conditions that indicate when a system should be replaced, withdrawn, or safely decommissioned<\/span><\/li>\n
- To prevent organizations from ever retiring AI systems<\/span><\/li>\n
- To guarantee that every system will operate indefinitely<\/span><\/li>\n
- To eliminate the need for lifecycle planning<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
Retirement criteria provide a structured basis for determining when an AI system should no longer remain in operation. Criteria may include unacceptable performance, obsolete technology, excessive maintenance costs, significant security vulnerabilities, changes in business requirements, replacement by a more appropriate system, or risks that can no longer be adequately mitigated. Defining these conditions in advance helps organizations avoid keeping systems in operation simply because they already exist. Retirement should also include appropriate planning for data, access, dependencies, records, and users. A system’s lifecycle should have a clear end point when continued operation is no longer justified or when the risks exceed the organization’s ability to manage them responsibly.<\/span><\/p>\nQuestion 239<\/b><\/p>\n
Which activity best supports learning from AI incidents?<\/b><\/p>\n\n- Conducting a documented post-incident review to identify root causes and improvements<\/span><\/li>\n
- Deleting incident records immediately<\/span><\/li>\n
- Avoiding investigation to protect the organization<\/span><\/li>\n
- Assuming every incident is caused by users<\/span><\/li>\n<\/ol>\n
Correct Answer: 1<\/b><\/p>\n
Explanation<\/b><\/p>\n
A post-incident review can help an organization understand what happened, why the incident occurred, how effective existing controls were, and what improvements should be made. The review may examine technical factors, human processes, data issues, governance decisions, monitoring alerts, and communication. Lessons learned can lead to updates in policies, training, testing, system controls, or incident procedures. The goal should be constructive improvement rather than simply assigning blame. Maintaining appropriate incident records also supports accountability and trend analysis. Organizations can use recurring incident patterns to identify systemic weaknesses that may affect multiple AI systems. This makes incident management an important source of information for continuous improvement in AI governance.<\/span><\/p>\nQuestion 240<\/b><\/p>\n
What is the strongest reason for integrating AI governance into the organization’s broader risk management program?<\/b><\/p>\n\n