AAIR cheat sheet
Last-minute reference for AAIR. The exam is about running a programme: who decides, on what evidence, and what changes as a result.
Exam facts
| Questions | 90 |
| Domains | 3 |
| Largest domain | 42% |
| Exam fee | 459 USD member / 599 USD non-member, plus application fee |
Domain weights
| Domain | Weight |
|---|---|
| AI Risk Program Management | 42% |
| AI Risk Governance and Framework Integration | 37% |
| AI Life Cycle Risk Management | 21% |
Programme plus governance is nearly 80% of the exam.
Risk response options
When exposure exceeds appetite, the legitimate responses are: treat, transfer, avoid, or formally accept at the appropriate authority.
Not legitimate: lowering the assessed rating to fit, removing it from the register, or proceeding while “monitoring informally”.
Recurring right answers
| Situation | Answer |
|---|---|
| Existing ERM framework in place | Integrate, extending taxonomy — do not build a parallel programme |
| Who owns an AI risk | The accountable business owner of the process |
| First assessment point | Concept or design, before significant investment |
| Model retrained on newer data | Re-validation and re-approval proportionate to risk |
| Units bypass the process as too slow | Risk-tier it so low-risk systems clear quickly |
| Measuring programme effectiveness | Inventory coverage + time to remediate high risks |
| After an incident | Root cause feeding back into controls and the register |
| Third-party concentration | Map dependency and define contingency and exit |
| Reassessment trigger | Material change in purpose, data, model version or regulation |
What makes AI risk different
Non-determinism means testing cannot enumerate outcomes, so assurance shifts from exhaustive verification to monitoring and constraint. Emergent behaviour that was never specified has no equivalent in conventional IT risk.
Traps
- A charter, a policy and an awareness email are design, not operation. Evidence is systems modified, delayed or rejected.
- Counts of assessments measure activity, not effectiveness.
- If no decision ever changed because of the reporting, the reporting is documentation.
- Affected users and front-line staff are the most commonly missing stakeholders.
Night-before checklist
- Three domains; programme management is 42%
- Four legitimate risk responses
- Integration over duplication, every time
- Check ID and proctoring rules — see exam day
Take the 20-question practice test.