AI Life Cycle Risk Management
Free ISACA Advanced in AI Risk (AAIR) practice — 6 questions on AI Life Cycle Risk Management, with explanations. No sign-up. Full 12-question mixed test →
A financial services company is deploying a credit risk assessment AI model that was trained on historical loan data from 2015-2020. During pre-deployment validation, the AI risk team discovers the model's accuracy has degraded by 15% on recent application data. The model uses ensemble methods combining gradient boosting and neural networks. Which risk management approach BEST addresses this situation before production deployment?
The 15% accuracy degradation indicates data drift - the model's training data distribution no longer matches production data. AI life cycle risk management requires addressing root causes before deployment. Retraining on current data (2020-2025) aligns the model with current economic patterns, credit behaviors, and demographic shifts. Validation against current conditions ensures the model performs adequately on representative data. Drift detection provides ongoing monitoring post-deployment. This follows the life cycle principle of addressing model degradation through retraining rather than deploying a known-degraded model.
An AI team is developing a resume screening system for a large employer. During the model development phase, they discover that the training dataset contains 73% male candidates and 27% female candidates, reflecting historical application patterns. The model shows 8% higher precision for male candidates. Which life cycle risk intervention should be prioritized FIRST?
AI life cycle risk management requires understanding the nature and impact of risks before implementing technical mitigations. An 8% precision disparity must be evaluated in context: Does it translate to differential hiring rates? Does it violate legal standards? What are the business and ethical implications? The bias impact assessment determines whether this is a statistical artifact or a material fairness issue requiring intervention. Life cycle risk management follows assess-then-mitigate sequencing. Premature technical interventions (fairness constraints, resampling) may introduce new risks or be unnecessary if the disparity doesn't cause harm in the deployment context.
A healthcare AI system for radiology diagnosis has been in production for 18 months. The AI risk management team receives a report that radiologists are accepting 94% of AI recommendations without independent review, compared to an expected 70% acceptance rate. Model performance metrics remain stable. From a life cycle risk perspective, what is the PRIMARY concern this situation indicates?
The 94% acceptance rate (vs. expected 70%) with stable model performance indicates automation bias - clinicians are over-relying on AI recommendations rather than exercising independent judgment. This is a critical life cycle risk because: (1) it can lead to deskilling where radiologists lose diagnostic capabilities over time, (2) the AI becomes a single point of failure, and (3) edge cases or model errors may go undetected. Life cycle risk management includes monitoring human-AI interaction patterns and addressing automation complacency. The divergence from expected behavior (70% vs 94%) signals the human-in-the-loop safeguard is eroding.
An e-commerce company's recommendation AI system is being audited. The audit reveals that the model training pipeline has version control for code and model weights, but the training data snapshots are not versioned and the original 2023 training dataset has been overwritten by 2025 data. A customer complaint from 2024 alleges discriminatory recommendations. Which AI life cycle risk management principle has been violated?
AI life cycle risk management requires full reproducibility of model training to enable audits, investigations, and remediation. The scenario describes having code and model weights versioned but not training data - this breaks reproducibility. To investigate the 2024 complaint, you need to recreate the exact model that was deployed in 2024, which requires the 2023 training data (since that's what the 2024 model was trained on). Without data versioning, the investigation cannot determine if the 2024 model actually exhibited discriminatory behavior or if the complaint is unfounded. This violates governance principles requiring complete audit trails across the AI life cycle.
A company is conducting a pre-deployment risk assessment for an AI system that will automate loan approval decisions up to $50,000. The risk assessment identifies three potential issues: (1) 12% error rate on edge cases, (2) lack of meaningful right-to-explanation for denials, (3) missing circuit breakers for cascading failures. The deployment deadline is in 3 weeks. From a life cycle risk management perspective, which issue should BLOCK deployment?
Right-to-explanation for credit denials is not just best practice - it's a legal requirement under regulations like ECOA (Equal Credit Opportunity Act) in the US and similar laws globally. Deploying without this capability violates legal obligations and exposes the company to regulatory penalties and lawsuits. Life cycle risk management distinguishes between performance issues (12% error on edge cases), operational concerns (circuit breakers), and legal compliance requirements. Legal violations are deployment blockers regardless of deadlines. The other issues may be acceptable with compensating controls (human review of edge cases, phased rollout with monitoring), but legal compliance is non-negotiable.
An AI development team is implementing a multi-stage risk assessment for a content moderation model that will be used across 47 different languages and cultural contexts. During the development life cycle, which risk evaluation approach BEST ensures the model performs safely across all deployment contexts?
Content moderation is highly context-dependent - what's acceptable in one culture may be harmful in another, and language nuances affect both model performance and harm potential. Life cycle risk management for multi-context deployments requires context-specific validation. Each of the 47 languages represents a distinct deployment context with unique cultural norms, linguistic patterns, and potential harms. A model that safely moderates English content may fail catastrophically in Arabic, Mandarin, or Swahili due to different scripts, cultural references, idioms, and contextual meanings. Separate risk assessments with native speakers ensure the model meets safety and performance thresholds in each actual deployment context, preventing harm in under-tested markets.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$109.99 $34.99 with code FREETEST33 — valid through August 23.
Get my $34.99 deal →