AI Controls Management (e.g., Evaluation, Selection, Validation) AAIR Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of documenting AI control decisions?

   • ATo satisfy regulatory requirements only
   • BTo replace the need for ongoing monitoring
   • CTo increase the complexity of the AI system
   • DTo ensure transparency and accountability
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A financial services firm is evaluating two AI controls for its credit-scoring model: a real-time bias monitor that flags disparate impact and a post-hoc audit that reviews model decisions monthly. The firm's risk appetite statement emphasizes early detection of fairness issues, but the compliance team is concerned about operational overhead. Which evaluation criterion should the firm prioritize when selecting between these controls?

   • AEfficiency in terms of minimal staff time required to operate the control
   • BCompatibility with existing compliance reporting formats
   • CEffectiveness in detecting bias incidents within the risk-appetite tolerance window
   • DCost of implementation relative to the model development budget
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A telecom company has decided to implement a control that limits the use of customer data for AI model training. The decision was made by the AI risk committee. What is the most important documentation and communication action to ensure accountability?

   • ASend a company-wide email announcing the new control
   • BAdd the control to the risk register without further explanation
   • CRecord the decision rationale, the risk assessment basis, and the control's scope, and communicate it to data stewards and model developers
   • DVerbally inform the data science team during a stand-up meeting
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   An organization wants to validate an AI control by having an external party assess its design and operation. Which validation method is being used?

   • ASimulation
   • BTesting
   • CIndependent review
   • DRegression testing
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A healthcare startup is deploying an AI triage assistant. The risk assessment identified a high likelihood of misdiagnosis for rare conditions and a low likelihood of privacy breaches. The organization has limited engineering resources and a moderate risk appetite. Which control selection approach best aligns with the risk assessment results?

   • ADefer all controls until the model is in production and real-world performance data is available
   • BImplement a mandatory human review for all rare-condition predictions and a basic access log for privacy monitoring
   • CDeploy an automated explainability tool for every prediction and a full encryption suite for all data at rest
   • DImplement a monthly manual audit of all triage decisions and rely on existing platform security for privacy
   Reveal Solution Discussion Select an answer first