A company uses a third-party AI model for real-time fraud detection. The vendor has a history of minor security incidents, but the company has contractual audit rights. The company's risk team wants to implement continuous monitoring, but the operations team is concerned about the overhead. What is the best approach to balance these concerns?

Conduct a full manual audit of the vendor every month

Implement automated monitoring of key performance and security indicators with alerts for anomalies

Rely on the vendor's self-reported security metrics

Terminate the contract and find a new vendor

A multinational company uses a third-party AI vendor that processes personal data across multiple jurisdictions, including the EU and countries with less stringent data protection laws. The company must ensure compliance with GDPR and other regulations. What is the most comprehensive approach?

Obtain consent from every data subject for all processing activities

Require the vendor to store all data in the EU

Rely on the vendor's certification under an international framework

Conduct a cross-border data flow analysis and implement appropriate safeguards, such as SCCs and binding corporate rules

ISACAAdvanced in AI Risk

Domain 3Objective 5

AI Supply Chain Risk Management (e.g., Third Party Resources) AAIR Practice Questions (Page 1)

Part of the AI Risk Program Management domain, which accounts for 42% of the AAIR exam.

36questions here

8free pages

10concepts

42%of the exam

10 Concepts in This Objective

Identify AI supply chain components
Assess third-party AI risks
Apply supply chain risk frameworks
Perform due diligence on AI vendors
Establish contractual risk controls
Monitor and manage ongoing third-party risks
Address data provenance and lineage
Mitigate model and algorithm risks from third parties
Ensure compliance with regulations
Develop incident response for supply chain failures

Questions 1–5

1expert · hard
A company uses a third-party AI model for real-time fraud detection. The vendor has a history of minor security incidents, but the company has contractual audit rights. The company's risk team wants to implement continuous monitoring, but the operations team is concerned about the overhead. What is the best approach to balance these concerns?
Select an answer first
2foundation · easy
Which of the following is a key component of an AI supply chain?
Select an answer first
3expert · hard
A multinational company uses a third-party AI vendor that processes personal data across multiple jurisdictions, including the EU and countries with less stringent data protection laws. The company must ensure compliance with GDPR and other regulations. What is the most comprehensive approach?
Select an answer first
4foundation · easy
Which activity is part of ongoing monitoring of third-party AI risks?
Select an answer first
5foundation · easy
Which framework is specifically designed to help organizations manage AI risks, including those in the AI supply chain?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AAIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “AAIR” is a trademark of its owner, used for identification only.

AI Supply Chain Risk Management (e.g., Third Party Resources) AAIR Practice Questions (Page 1)

Questions 1–5

Which of the following is a key component of an AI supply chain?

A multinational company uses a third-party AI vendor that processes personal data across multiple jurisdictions, including the EU and countries with less stringent data protection laws. The company must ensure compliance with GDPR and other regulations. What is the most comprehensive approach?

Which activity is part of ongoing monitoring of third-party AI risks?

Which framework is specifically designed to help organizations manage AI risks, including those in the AI supply chain?

Keep studying — AI Risk Program Management