Free Advanced in AI Governance (AAIG) practice test: 30 questions with answers

A risk assessment begins by identifying scenarios, threats, vulnerabilities and assets, which drives everything after. Choosing colours, vendors or hardware first puts the cart before the horse.

Avoidance removes the activity that creates the risk. Acceptance keeps it, transfer shifts its financial effect and mitigation adds controls while the activity continues.

A control evaluation tests whether each control is designed and working against its risk. Price, control counts and removing friction do not show that a control works.

Key risk indicators tied to appetite show executives where risk stands relative to what the organisation will accept. Model counts, meeting counts and page counts do not show risk status.

Due diligence, contractual rights, monitoring and exit provisions manage third-party AI risk. Marketing claims, register exclusion and price-only selection each leave the risk unmanaged.

A complete plan covers detection, escalation, containment such as pausing, communication, recovery and lessons learned. Press statements alone, promises of no incidents and vendor contact lists are incomplete or unrealistic.

A BIA assesses how disruption affects business processes and sets recovery priorities and tolerances. Sales forecasts, meeting hours and language choice are not BIA purposes.

Access controls and integrity checks such as hashing or versioning detect and prevent unauthorised change to training data. Open editing, uncontrolled copies and removed logs each invite it.

A register entry needs a description, owner, rating, treatment and review date to be actionable. Photographs, user lists and licence prices do not describe or manage the risk.

Ongoing testing against thresholds, with tracked remediation, shows whether controls keep working. A single launch test, user reporting and counting controls each miss the question of whether they operate.

Accountability for AI risk decisions sits with a named owner who can accept, mitigate or escalate. Shared use, vendor responsibility and team-only decisions leave no clear accountable party.

An AI policy sets principles, roles, acceptable uses and controls across the organisation. Algorithm code, price lists and opinion files are not policy content.

Decisions about individuals engage transparency, fairness and rights such as explanation and contest. Interface colours, server counts and programming languages are not regulatory matters of this kind.

Trustworthiness covers validity, reliability, safety, transparency, fairness and accountability, shown across the lifecycle. Vendor reputation, popularity and response speed are weaker or unrelated signals.

An effective owner needs authority, information and resources to act on risk. Title alone, responsibility without authority and launch-only involvement each leave the risk unmanaged.

Using the enterprise register, scale, owners and cadence integrates AI risk into the wider framework. Separate processes, exclusion from reporting and marketing ownership each leave AI risk out of view.

Oversight means regular review by a governance body with escalation of material risk. Vendor-only annual reviews, frozen policies and output-only checks each leave important parts of the system unexamined.

Fairness testing and proportionate explainability are core trustworthiness requirements. Dashboard colours, download counts and skipping review do not address trustworthiness.

Accuracy does not guarantee fairness, and ethical considerations belong in the risk assessment and must be revisited as use changes. Security testing is not an ethics review, ethics needs cross-functional input, and internal use can still harm people.

Scheduled review and staff training with compliance checks keep a policy effective. Letting it lapse, hiding it and using vendor jargon each undermine its use.

Documented requirements, data checks and testing for accuracy, bias and robustness reduce harmful outputs before release. Skipping testing, unreviewed defaults and undocumented release each increase the risk.

Validation confirms the model meets its requirements on data it has not seen in training. Recognition, version age and training speed do not show that it is fit for purpose.

Secure archiving or deletion under retention rules, with notice to dependants, closes the system's risk properly. Keeping it running unseen, deleting logs and publishing data each create new risk.

An inventory of models and datasets with owners, lineage and classification supports control of AI assets. Personal copies, unknown-origin data and hidden classifications each undermine that control.

Material changes to the model, data, use case or affected population alter the risk, so reassessment is needed. Template colours, new staff and routine password changes do not change the system's risk profile.

Monitoring against thresholds with defined actions, and validated retraining, reduce degradation. Assuming stability, removing monitoring and accepting drops each let the model fail unseen.

Assessing and documenting representativeness, and mitigating gaps, reduces bias. Convenience sampling, removing records with gaps and assuming size equals fairness each entrench bias.

A model card covers intended use, data, evaluation, limitations and conditions for safe use, which governance needs. Music, prices alone and personal addresses do not support governance.

Robustness is shown by how outputs hold up under unusual, noisy or adversarial inputs. Build-set testing, speed checks and feature counts do not show that.

Change management with testing, approval and rollback controls production changes. Laptop changes, uninformed changes and disabled version control each remove the controls.