AI Risk Treatment Strategies AAIR Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   The purpose of assessing residual risk after implementing a risk treatment is to:

   • AIdentify all possible risks from scratch
   • BEliminate all risk completely
   • CTransfer the risk to a third party
   • DDetermine if the remaining risk aligns with the organization's risk tolerance
   Reveal Solution Discussion Select an answer first
2. 22application · easy

   A company is implementing a risk treatment for an AI model that recommends investment portfolios. The treatment is a new human-oversight control. What is the most critical element of the implementation plan?

   • APurchasing new hardware for the review team.
   • BDefining the specific responsibilities of the human reviewer.
   • CCommunicating the control to external auditors only.
   • DEnsuring the AI model is retrained before the control is implemented.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An insurance firm is implementing a risk treatment for an AI underwriting model. The treatment involves a new model-validation control. The project is behind schedule, and the team wants to skip the documentation step to meet the deadline. What is the best course of action?

   • AImplement the control, document the key decisions, and note the incomplete documentation as a residual risk.
   • BImplement the control and document it retrospectively after the deadline.
   • CSkip documentation to meet the deadline, as the control is more important.
   • DDelay the implementation to complete full documentation.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A tech company has an AI recommendation system with a high likelihood of a moderate-impact privacy breach. The cost to fully mitigate is $500,000. The company's risk appetite is 'moderate', and the potential regulatory fine is $200,000. Stakeholders are split between mitigation and acceptance. Which decision is most aligned with the risk treatment selection criteria?

   • AAccept the risk because the fine is lower than the mitigation cost.
   • BTransfer the risk by purchasing insurance to cover the fine.
   • CAvoid the risk by shutting down the recommendation system.
   • DMitigate the risk because the likelihood is high, even though the cost exceeds the fine.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A healthcare organization uses an AI system to triage radiology scans. The system occasionally misclassifies a critical finding, and the vendor cannot provide model explainability logs. The organization's risk appetite is low, and the cost of a full replacement is prohibitive. The AI system is essential to meet patient throughput targets. Which risk treatment option is the most appropriate primary strategy?

   • AAvoid the risk by immediately decommissioning the AI system.
   • BAccept the risk because the system is essential and replacement is too costly.
   • CMitigate the risk by implementing a mandatory human review for all AI-flagged critical findings.
   • DTransfer the risk by purchasing cyber liability insurance.
   Reveal Solution Discussion Select an answer first