Advanced in AI Audit (AAIA) Free Sample Questions

The most critical risk is the potential for unauthorized and malicious changes to the trading algorithm's logic. Given the direct financial implications of an algorithmic trading model, an undetected modification could trigger erroneous trades, leading to immediate and substantial financial losses. This represents a direct and high-impact operational risk.

Even when protected attributes like race or gender are removed, other features (proxies) can be highly correlated with them. For example, ZIP codes, income levels, or certain types of employment can inadvertently act as proxies for demographic groups, allowing the model to learn and perpetuate historical biases present in the data.

The data processing agreement (DPA) and terms of service are legally binding documents that outline how the vendor will handle the organization's data, including data ownership, usage rights, security controls, and compliance with privacy regulations like GDPR. This is a primary source of evidence for assessing privacy risk.

A crucial internal control to mitigate third-party privacy risk is to minimize the data shared. Verifying that the organization has a process to scrub PII before sending data to the vendor's service directly reduces the risk of a data breach or misuse of customer PII by the third party.

AI systems introduce unique failure modes not found in traditional IT systems. These include model drift, performance degradation, generation of harmful or biased outputs, and adversarial attacks. An effective incident response plan must include specific playbooks for identifying, containing (e.g., taking the model offline, reverting to a previous version), and remediating these AI-specific incidents.

According to standard audit practices, the first step in planning any audit is to understand the context: what the system is supposed to achieve (business objectives) and what could go wrong (high-level risks). For a generative AI chatbot, risks include reputational damage from inappropriate responses, data leakage, and inaccurate information. This understanding drives the entire audit scope and approach.

This statement is false. While statistical sampling allows for quantifiable measurement of sampling risk, it does not eliminate all bias. Furthermore, in AI auditing, judgmental (or risk-based) sampling is often necessary to target high-risk areas, such as testing the model's behavior on known edge cases or transactions involving sensitive data, which might be missed by a purely random statistical sample.

If the model predicts a failure but cannot explain why (e.g., which sensor reading or combination of factors led to the prediction), it is extremely difficult for maintenance engineers to perform targeted diagnostics and root cause analysis. They know the machine is likely to fail, but they don't know which component is the problem. This lack of insight hinders proactive repair and learning from potential failures.

A key risk indicator must be a measurable metric that provides an early warning of increasing risk. Measuring the statistical variance in pricing across defined demographic segments (e.g., based on geography, inferred income, etc.) directly targets the risk of price discrimination. A rising variance would trigger an investigation, making it the most effective KRI for this specific risk.

The 'high-risk' classification under the EU AI Act mandates a comprehensive set of obligations. The audit scope must therefore be significantly expanded to include conformity assessments against these legal requirements, which cover the entire lifecycle of the AI system, including the quality of training data, technical documentation, transparency for users, human oversight mechanisms, and a robust risk management system.

The Model Registry is the central component for ensuring integrity and reproducibility. It should version and store not just the trained model artifact, but also the code used for training, the version of the data it was trained on, its evaluation metrics, and its dependencies. This allows an auditor or data scientist to precisely recreate the model and its training environment, which is the essence of reproducibility.