AI Risk Assessment, Thresholds, and Treatment AAISM Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the purpose of monitoring and reviewing AI risk treatments over time?

   • ATo assign new risk owners for each risk
   • BTo eliminate the need for future risk assessments
   • CTo document the initial risk assessment results
   • DTo ensure the treatments remain effective and relevant as the AI system and environment change
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company has implemented a risk treatment plan for an AI system that includes retraining the model to reduce bias. The risk manager wants to ensure the treatment remains effective over time. What is the most appropriate ongoing action?

   • AConduct a one-time post-implementation review and then close the risk.
   • BRely on the AI vendor to monitor the model and report any issues.
   • CWait for a complaint or incident to trigger a review.
   • DSchedule periodic reviews of the model's bias metrics and the effectiveness of the retraining.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A financial services firm is deploying a generative AI chatbot for customer support. The AI risk manager is leading the initial risk assessment. The team has limited time and must identify the most critical AI-specific risks first. Which approach best aligns with a systematic AI risk assessment process?

   • AAsk only the legal department to list potential risks, as they are most familiar with regulatory requirements.
   • BConduct a vulnerability scan of the chatbot's underlying infrastructure and treat all findings as AI-specific risks.
   • CBegin with a threat modeling exercise focused on prompt injection and data leakage, then use stakeholder input to expand the risk register.
   • DWait for a security incident to occur before conducting any risk assessment, as real-world data is more reliable.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   After implementing a mitigation control for an AI risk, the residual risk is still above the organization's threshold. The risk manager must decide the next step. What is the most appropriate action?

   • AImplement additional controls or consider alternative treatment options to further reduce the residual risk.
   • BAccept the residual risk because the control was implemented.
   • CRe-evaluate the threshold to make the residual risk acceptable.
   • DStop using the AI system to avoid the risk entirely.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of a quantitative method for analyzing AI risk?

   • ARating the likelihood of an AI bias incident as 'high' based on expert judgment
   • BCategorizing the impact of a data poisoning attack as 'moderate'
   • CUsing a red team to simulate an attack on the AI system
   • DCalculating the annualized loss expectancy (ALE) for a potential AI model failure
   Reveal Solution Discussion Select an answer first