Risk Assessment CRAGE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a key component of a risk assessment process in AI supply chain management?

   • ARisk avoidance, risk transfer, and risk acceptance
   • BRisk monitoring, risk review, and risk communication
   • CRisk identification, risk analysis, and risk evaluation
   • DRisk appetite, risk tolerance, and risk capacity
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A financial services firm uses an AI-based credit scoring model supplied by a third-party vendor. During a risk assessment, the firm identifies that the vendor's model was trained on data that may include biased attributes, creating a potential reputational and regulatory risk. The firm's risk appetite is low, and the model is critical to its lending operations. What should the firm do first?

   • AAccept the risk because the model is critical and the vendor is established.
   • BAvoid the risk by immediately terminating the vendor contract.
   • CMitigate the risk by requiring the vendor to provide bias testing results and contractual assurances.
   • DTransfer the risk by purchasing cyber insurance.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary goal of communicating risk assessment findings to stakeholders?

   • ATo assign responsibility for risk management failures
   • BTo convince stakeholders that all risks are under control
   • CTo enable informed decision-making by providing relevant and timely risk information
   • DTo satisfy regulatory requirements only
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An e-commerce company uses an AI chatbot from a third-party vendor to handle customer service. During a risk assessment, the company identifies that the chatbot may generate offensive responses due to insufficient content filtering. What type of risk is this primarily?

   • ATechnical risk
   • BLegal risk
   • COperational risk
   • DReputational risk
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A financial services company is assessing a third-party AI credit-scoring model. The risk team has scored the likelihood of a data breach as 'rare' but the impact as 'catastrophic' because of regulatory fines and reputational damage. The company's risk appetite statement says it will not accept any risk that could result in a material regulatory penalty. According to the risk evaluation step, what should the team do next?

   • ADocument the risk as low because likelihood is rare.
   • BPrioritize the risk as high and move to risk treatment.
   • CRe-analyze the likelihood using a quantitative method.
   • DAccept the risk because the likelihood is rare.
   Reveal Solution Discussion Select an answer first