NIST AI RMF Alignment CRAGE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A healthcare organization is adopting the NIST AI RMF to govern a new diagnostic AI system. The board has mandated that AI risk decisions align with existing enterprise risk management (ERM) processes. The AI governance lead is defining the Govern function activities. Which action best fulfills the NIST AI RMF Govern function while aligning with the ERM mandate?

   • ACreate a standalone AI risk register that is managed exclusively by the data science team and reported only to the CTO.
   • BDelegate all AI risk decisions to the legal department to ensure regulatory compliance, bypassing the ERM committee.
   • CEstablish an AI risk management policy that defines roles, accountability, and escalation paths, and integrate it with the organization's existing ERM risk taxonomy and reporting cadence.
   • DDevelop a comprehensive AI ethics code and require all employees to sign it annually, with no formal risk escalation process.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A healthcare organization is implementing the NIST AI RMF for its patient-triage AI system. The compliance officer wants to ensure that governance activities are embedded into existing decision-making structures. Which action best reflects the Govern function's emphasis on accountability and organizational integration?

   • ACreate a standalone AI ethics board that operates independently of the organization's existing governance bodies.
   • BDocument all AI risk decisions in a separate log that is not shared with other risk management functions.
   • CDelegate all AI risk decisions to the technical team that developed the system, since they understand the model best.
   • DAssign a senior executive as the AI risk owner and require that risk decisions be escalated through the existing risk committee.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A multinational corporation is integrating the NIST AI RMF into its existing enterprise risk management (ERM) framework. The CISO wants to ensure that AI risks are treated consistently with other enterprise risks. Which action best supports this integration?

   • ACreate a separate AI risk management process that operates independently from the ERM framework.
   • BUse the NIST AI RMF only for high-risk AI systems and leave other AI systems unmanaged.
   • CMap AI risk categories to the ERM risk taxonomy and use the same risk scoring and reporting mechanisms for AI risks as for other risks.
   • DReplace the ERM framework with the NIST AI RMF to avoid duplication.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   An organization is using the NIST AI RMF to measure risks of an AI system that predicts patient readmission. The team has limited historical data and faces uncertainty in the risk estimates. Which approach best aligns with the Measure function's guidance?

   • ADefer risk measurement until more data is collected, even if that delays deployment.
   • BRely exclusively on the limited quantitative data to produce precise risk estimates, ignoring uncertainty.
   • CUse only qualitative expert opinions, as quantitative data is too limited to be useful.
   • DUse a combination of quantitative methods (e.g., statistical analysis of available data) and qualitative methods (e.g., expert judgment) to triangulate risk estimates, and document the uncertainty.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A telecom company has implemented the NIST AI RMF for its customer-service AI. After six months, the risk team wants to evaluate the effectiveness of the framework. Which action best supports the continuous improvement aspect of the RMF?

   • ACompare the AI system's performance to competitors' systems to benchmark effectiveness.
   • BConduct a review of the AI system's risk metrics, compare them to the target profile, and update the risk response plan based on findings.
   • CRe-run the initial risk assessment without changes to verify that the framework is stable.
   • DCollect user feedback but do not act on it until the next major release.
   Reveal Solution Discussion Select an answer first