A financial institution is evaluating treatment for a high-likelihood, high-impact AI fraud-detection model failure. The cost to fully mitigate is $2 million, the potential loss from a failure is $10 million, and the organization has a moderate risk appetite. Stakeholders are divided: the CISO wants full mitigation, the CFO prefers acceptance to save costs. Which treatment selection criterion should be the deciding factor?

The CFO's preference for acceptance to save costs.

The CISO's preference for full mitigation.

The risk appetite statement alone, which is moderate.

The cost-benefit analysis showing mitigation is financially justified.

A company is selecting a treatment for an AI risk. The risk is low likelihood but very high impact. The company has a low risk appetite. The cost to mitigate is very high, and the cost to transfer via insurance is moderate. Which treatment is most aligned with the selection criteria?

Transfer the risk because the cost is moderate and the impact is very high.

Mitigate the risk because the impact is very high.

Avoid the risk by discontinuing the AI system.

Accept the risk because the likelihood is low.

A company implements a control to reduce the risk of an AI model leaking sensitive data. After implementation, the residual risk is assessed as 'unlikely' likelihood and 'moderate' impact. The company's risk tolerance is 'moderate'. What should the company do next?

Transfer the residual risk to a cyber insurer.

Implement additional controls to reduce the impact to 'low'.

Re-assess the risk using a different methodology.

Accept the residual risk because it is within the tolerance level.

ISACAAdvanced in AI Risk

Domain 3Objective 2

AI Risk Treatment Strategies AAIR Practice Questions (Page 3)

Part of the AI Risk Program Management domain, which accounts for 42% of the AAIR exam.

26questions here

6free pages

6concepts

42%of the exam

Questions 11–15

11foundation · easy
An organization decides to discontinue an AI-based recruitment tool because the risk of biased decision-making cannot be reduced to an acceptable level within the project's constraints. Which risk treatment option does this represent?
Select an answer first
12application · medium
A financial institution is evaluating treatment for a high-likelihood, high-impact AI fraud-detection model failure. The cost to fully mitigate is $2 million, the potential loss from a failure is $10 million, and the organization has a moderate risk appetite. Stakeholders are divided: the CISO wants full mitigation, the CFO prefers acceptance to save costs. Which treatment selection criterion should be the deciding factor?
Select an answer first
13expert · hard
A company is selecting a treatment for an AI risk. The risk is low likelihood but very high impact. The company has a low risk appetite. The cost to mitigate is very high, and the cost to transfer via insurance is moderate. Which treatment is most aligned with the selection criteria?
Select an answer first
14application · easy
A company implements a control to reduce the risk of an AI model leaking sensitive data. After implementation, the residual risk is assessed as 'unlikely' likelihood and 'moderate' impact. The company's risk tolerance is 'moderate'. What should the company do next?
Select an answer first
15foundation · easy
A company purchases cyber insurance to cover potential financial losses from a data breach caused by its AI system. Which risk treatment option is being applied?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AAIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “AAIR” is a trademark of its owner, used for identification only.

AI Risk Treatment Strategies AAIR Practice Questions (Page 3)

Questions 11–15

An organization decides to discontinue an AI-based recruitment tool because the risk of biased decision-making cannot be reduced to an acceptable level within the project's constraints. Which risk treatment option does this represent?

A company is selecting a treatment for an AI risk. The risk is low likelihood but very high impact. The company has a low risk appetite. The cost to mitigate is very high, and the cost to transfer via insurance is moderate. Which treatment is most aligned with the selection criteria?

A company implements a control to reduce the risk of an AI model leaking sensitive data. After implementation, the residual risk is assessed as 'unlikely' likelihood and 'moderate' impact. The company's risk tolerance is 'moderate'. What should the company do next?

A company purchases cyber insurance to cover potential financial losses from a data breach caused by its AI system. Which risk treatment option is being applied?

Keep studying — AI Risk Program Management