Free AI Governance, Risk, and Compliance Practice Questions

Question 1 of 6 · Domain 4: AI Governance, Risk, and Compliance

A financial institution is deploying a credit scoring AI system that processes loan applications. The model was trained on historical data from 2010-2020 and achieves 94% accuracy in testing. During the first month of production, the denial rate for applicants from zip codes with median income below $45,000 is 67%, compared to 23% for zip codes above $100,000 median income, despite similar credit profiles. Regulatory auditors have flagged this for potential fair lending violations. What is the PRIMARY governance failure that occurred?

This scenario demonstrates a clear fairness and bias issue that should have been caught during pre-deployment testing. Disparate impact analysis specifically tests whether AI systems have disproportionate negative effects on protected classes (in this case, correlated with income/geography). Fair lending laws require this testing before deployment. The 67% vs 23% denial rate disparity is a red flag that would have been identified through proper fairness metrics (demographic parity, equalized odds) during governance review.

Question 2 of 6 · Domain 4: AI Governance, Risk, and Compliance

An enterprise AI governance board is reviewing three models for production approval: Model A (customer churn prediction - 89% accuracy), Model B (fraud detection - 96% accuracy, 0.3% false positive rate), and Model C (resume screening - 91% accuracy). The board has a new policy requiring all models to maintain performance metrics within 5% of training performance for 90 days post-deployment before full approval. After 45 days: Model A shows 84% accuracy (-5%), Model B shows 95.2% accuracy (-0.8%) with 2.1% false positive rate, Model C shows 92% accuracy (+1%). Which model presents the MOST CRITICAL governance concern requiring immediate intervention?

Model B's false positive rate jumping from 0.3% to 2.1% (700% increase) while accuracy remains nearly stable is a critical red flag for concept drift. In fraud detection, false positives (legitimate transactions flagged as fraud) directly impact customer experience and revenue. This dramatic shift suggests the model's decision boundary has changed significantly, likely due to evolving fraud patterns the model wasn't trained on. This requires immediate investigation and potential model retraining, as it indicates the model is no longer reliably distinguishing fraud patterns in the current environment despite maintaining overall accuracy.

Question 3 of 6 · Domain 4: AI Governance, Risk, and Compliance

A healthcare AI company is preparing for SOC 2 Type II audit of their diagnostic imaging AI system. The system uses federated learning across 47 hospital partners and processes 125,000 scans monthly. Their current governance framework includes: quarterly model retraining, annual bias audits, encryption at rest and in transit, role-based access control (RBAC), and automated logging of all predictions. The auditor identifies a critical gap: no mechanism to verify which specific training data contributed to individual patient diagnoses. Which compliance requirement is the auditor MOST likely concerned about?

The auditor's concern about tracing individual diagnoses back to training data relates directly to GDPR Article 22, which grants individuals rights regarding automated decision-making, including the right to explanation. In healthcare AI, particularly diagnostic systems, patients have the right to understand how decisions affecting them were made. While federated learning provides privacy benefits, it can complicate data lineage and explainability. The ability to trace which data influenced a diagnosis is crucial for GDPR compliance when the AI makes decisions with legal or significant effects. This is especially critical in healthcare where diagnostic AI directly impacts patient care decisions.

Question 4 of 6 · Domain 4: AI Governance, Risk, and Compliance

A multinational corporation's AI Ethics Board is reviewing an incident where their recruitment AI, deployed across 23 countries, was found to systematically downrank candidates who disclosed disabilities in voluntary self-identification fields. The model was never explicitly trained on disability data. Investigation revealed the model correlated disability disclosure with employment gaps in training data (due to historical workplace accommodation challenges), learning to penalize any gap pattern. The company faces potential lawsuits in 8 jurisdictions. From a risk management perspective, what should be the FIRST priority in the remediation plan?

When an AI system is confirmed to be causing systematic discrimination, particularly against a protected class (people with disabilities) across multiple jurisdictions with active legal exposure, the first priority must be to stop the harm. Continued operation exposes the company to ongoing liability, demonstrates willful negligence if continued after discovery, and causes real harm to candidates. Disabling the system immediately limits legal exposure, demonstrates good faith in litigation, and prevents additional victims. While disruptive to operations, this is the only risk-appropriate response when systematic discrimination is confirmed. The other actions are all necessary but must come after stopping active harm.

Question 5 of 6 · Domain 4: AI Governance, Risk, and Compliance

An AI system deployed in a smart city traffic management network makes real-time decisions affecting 2.3 million daily commuters. The governance team must select a model monitoring approach. Option 1: Sample 0.5% of decisions daily for human review (11,500 decisions). Option 2: Monitor 100% of decisions using automated drift detection algorithms checking for distribution shifts every 6 hours. Option 3: Implement continuous A/B testing with 10% traffic routing to a challenger model while monitoring the primary model. Option 4: Quarterly comprehensive audits of 50,000 randomly sampled historical decisions. Given that traffic patterns can shift dramatically within hours due to events, which monitoring approach BEST balances operational risk with governance effectiveness?

In high-stakes, real-time systems where conditions change rapidly (traffic patterns can shift in hours due to accidents, events, weather), automated drift detection with frequent checks is essential. Option 2's 6-hour monitoring intervals can detect distribution shifts (concept drift, data drift) before they cascade into major issues affecting millions of commuters. Traffic AI requires near-real-time governance because a model optimized for normal patterns may fail catastrophically during rapid shifts. Automated statistical monitoring (KL divergence, PSI, etc.) can process 100% of decisions and alert on anomalies faster than any human review or periodic audit cycle.

Question 6 of 6 · Domain 4: AI Governance, Risk, and Compliance

A pharmaceutical company's AI discovered a novel drug compound predicted to treat Alzheimer's with 78% efficacy in silico. Before clinical trials, the AI Governance Committee must assess risks. The model was trained on 340,000 molecular structures and 89,000 clinical trial outcomes. Analysis reveals the model's prediction relies heavily on a molecular substructure present in only 12 compounds in the training data, 8 of which showed efficacy but 3 caused severe adverse events in Phase II trials. What governance principle is MOST critical to address before proceeding?

With only 12 similar compounds in training data (extremely sparse), uncertainty quantification is paramount. The model may be overconfident about its 78% efficacy prediction when it has very limited evidence for this molecular pattern. Proper uncertainty quantification would reveal wide confidence intervals (e.g., 78% ± 45%) indicating high epistemic uncertainty due to data scarcity. In drug discovery, where downstream decisions involve human trials and patient safety, understanding prediction uncertainty is critical for risk assessment. A model that doesn't acknowledge its uncertainty about predictions based on 12 examples could lead to dangerous false confidence in proceeding to expensive, risky clinical trials.