An organization's AI risk team is developing a risk appetite statement for AI systems. The enterprise risk appetite is defined at the corporate level. How should the AI risk appetite be established?

Derive the AI risk appetite from the enterprise risk appetite, with specific tolerances for AI-related risks

Use the same risk appetite for all AI systems without differentiation

Set a separate, more aggressive risk appetite for AI to encourage innovation

Let each business unit define its own AI risk appetite independently

A company's AI-based fraud detection system has been in production for two years. The risk team has noticed that the current risk metrics no longer reflect the emerging fraud patterns. What should the risk team do?

Stop monitoring until the fraud patterns stabilize

Increase the alert thresholds to reduce the number of alerts

Keep the existing metrics to maintain consistency with historical data

Review and update the risk metrics to align with the new fraud patterns and business context

An AI risk team must report on a model that has shown a gradual increase in error rates over the past six months. The board is concerned about the trend. What is the most effective way to communicate this to the board?

Show a trend chart with the error rate over time and explain the potential business impact

Avoid mentioning the trend until it is confirmed in the next quarter

Report only the current error rate without historical context

Present a detailed technical analysis of the error rate increase

An insurance company's AI underwriting model has a risk appetite that allows a maximum of 5% of policies to be mispriced. The risk team wants to set up monitoring to alert when this threshold is approached. What should they do?

Do not set an alert threshold; just review the metric monthly

Set the alert threshold at 5% to match the risk appetite exactly

Set an alert threshold at 4% to provide early warning before reaching the 5% limit

Set the alert threshold at 6% to avoid unnecessary alerts

What is the primary benefit of integrating AI risk monitoring with the enterprise risk management (ERM) framework?

Reduces the need for board oversight of AI risks

Ensures consistency and comprehensiveness in risk reporting across the organization

Eliminates the need for separate AI risk assessments

Guarantees that all AI risks are automatically mitigated

ISACAAdvanced in AI Risk

Domain 3Objective 4

AI Risk Metrics, Monitoring, and Reporting AAIR Practice Questions (Page 7)

Part of the AI Risk Program Management domain, which accounts for 42% of the AAIR exam.

37questions here

8free pages

10concepts

42%of the exam

10 Concepts in This Objective

Define AI risk metrics
Align metrics with risk appetite
Establish monitoring processes
Implement monitoring tools and automation
Develop reporting frameworks
Tailor reports to audience
Ensure data quality and integrity
Review and update metrics
Integrate with enterprise risk management
Document and communicate findings

Questions 31–35

31expert · hard
An organization's AI risk team is developing a risk appetite statement for AI systems. The enterprise risk appetite is defined at the corporate level. How should the AI risk appetite be established?
Select an answer first
32application · medium
A company's AI-based fraud detection system has been in production for two years. The risk team has noticed that the current risk metrics no longer reflect the emerging fraud patterns. What should the risk team do?
Select an answer first
33expert · hard
An AI risk team must report on a model that has shown a gradual increase in error rates over the past six months. The board is concerned about the trend. What is the most effective way to communicate this to the board?
Select an answer first
34application · medium
An insurance company's AI underwriting model has a risk appetite that allows a maximum of 5% of policies to be mispriced. The risk team wants to set up monitoring to alert when this threshold is approached. What should they do?
Select an answer first
35foundation · easy
What is the primary benefit of integrating AI risk monitoring with the enterprise risk management (ERM) framework?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AAIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “AAIR” is a trademark of its owner, used for identification only.