Risk Assessment CRAGE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A manufacturing company has implemented a risk treatment plan for AI supply chain risks. The plan includes new vendor assessment procedures and model validation checks. What should the company do to ensure the plan remains effective over time?

   • ARely on the vendor's self-reported compliance certifications.
   • BWait for an incident to occur before reviewing the risk plan.
   • CConduct a one-time audit after implementation to confirm the controls are in place.
   • DEstablish a schedule for periodic reviews and define key risk indicators for ongoing monitoring.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A bank is assessing risks from an AI fraud detection system. The bank has historical data on false positives and false negatives. The risk team wants to quantify the potential financial loss from each type of error. Which method is most appropriate?

   • AQuantitative analysis using historical error rates and average transaction values.
   • BExpert judgment only.
   • CQualitative analysis using a high/medium/low scale.
   • DScenario analysis without historical data.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A multinational corporation uses an AI HR system from a vendor. The system has been found to have potential bias against certain ethnic groups. The corporation operates in multiple jurisdictions with varying regulations. The risk assessment shows high likelihood and high impact in some regions, but low likelihood in others. What should the corporation do?

   • AAvoid the risk by discontinuing the system globally.
   • BAccept the risk in regions with low likelihood.
   • CTransfer the risk by using a different vendor in high-risk regions.
   • DImplement a global mitigation strategy to address the bias risk across all regions.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A pharmaceutical company has a risk treatment plan for its AI drug discovery supply chain. The plan includes quarterly reviews of the vendor's data security practices. After a merger, the vendor changes its data storage location to a country with different data protection laws. The risk owner is concerned that this change may increase the risk of regulatory non-compliance. What should the risk owner do?

   • AWait for the next quarterly review to assess the impact.
   • BAsk the vendor to move the data back to the original location.
   • CImmediately terminate the vendor contract.
   • DConduct an ad-hoc risk assessment to evaluate the new data location risk and update the risk register.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following best describes 'risk appetite'?

   • AThe likelihood that a specific risk will occur
   • BThe total amount of risk that exists in the supply chain
   • CThe maximum amount of money an organization can spend on risk mitigation
   • DThe amount of risk an organization is willing to accept to achieve its objectives
   Reveal Solution Discussion Select an answer first