Risk Assessment CRAGE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium · select all that apply

   A company has implemented a risk monitoring process for its AI supply chain. The process includes monthly reviews of vendor performance and quarterly risk assessments. Select all that apply. Which of the following are key components of an effective risk monitoring and review process?

   • ADefining key risk indicators (KRIs) for early warning.
   • BUpdating the risk register with new findings.
   • CScheduling periodic reviews of the risk assessment.
   • DCommunicating risk changes to stakeholders.
   • EConducting a one-time audit after implementation.
   Check answers Discussion Select an answer first
2. 2application · medium · select all that apply

   A company is assessing risks from an AI-powered customer analytics vendor. The vendor uses data from multiple sources, including social media. The company is concerned about potential legal and reputational risks. Select all that apply. Which of the following are potential risks that should be identified?

   • AFinancial risk from currency exchange fluctuations.
   • BViolation of data protection regulations due to improper data handling.
   • CTechnical risk from model overfitting.
   • DOperational risk from vendor system downtime.
   • EDamage to brand reputation if the analytics produce biased insights.
   Check answers Discussion Select an answer first
4. 3application · medium

   A retail company uses an AI demand-forecasting model provided by a vendor. The risk assessment identified a high-likelihood, medium-impact risk that the model's predictions become inaccurate during holiday sales spikes. The company has a low risk appetite for forecast errors because they cause stockouts and lost revenue. Which risk treatment option is most appropriate?

   • ATransfer the risk by purchasing an insurance policy.
   • BMitigate the risk by requiring the vendor to provide fallback forecasting during peak periods.
   • CAccept the risk because it is only medium impact.
   • DAvoid the risk by discontinuing the use of AI forecasting entirely.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization has implemented risk treatment for an AI supply chain risk by requiring the vendor to provide monthly model performance reports. Six months later, the risk owner wants to know if the treatment is still effective. What should the organization do first?

   • AReview the monthly reports and compare current risk level to the agreed risk criteria.
   • BImmediately terminate the vendor contract.
   • CConduct a new full risk assessment from scratch.
   • DAsk the vendor to sign a new risk acceptance form.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A global bank is assessing risks in its AI-based anti-money laundering (AML) system, which is provided by a third-party vendor. The system uses a machine learning model that is updated monthly. The bank has identified a risk that the model may become less effective over time due to changes in money laundering patterns. The bank's risk appetite is low for AML compliance failures. What is the most appropriate risk treatment?

   • AMitigate the risk by requiring the vendor to provide regular model performance reports and a retraining schedule.
   • BAvoid the risk by discontinuing the use of the AI AML system.
   • CTransfer the risk by purchasing insurance for AML fines.
   • DAccept the risk because the model is updated monthly.
   Reveal Solution Discussion Select an answer first