AAIR lesson 13: putting it together
Real AI risk problems do not announce their domain. One situation can touch governance, the life cycle and the risk programme together, and the ISACA AAIR outline lists 23 further skills that are not tied to one domain. A useful study approach is to practise picking the right move at the right moment. A workable method asks three questions: which role is being played, which stage of the risk process the organisation has reached, and what the best next step is from there. This lesson practises that on three scenarios, then gives a decision table for the whole course.
A three-step reading method
- Role. A risk professional recommends and challenges; business owners decide and accept; the board sets appetite. An answer in which the advisor makes the owner’s decision is usually out of role.
- Stage. Nothing identified, identified but not assessed, assessed but untreated, treated but unmonitored, or an event under way. The best step is typically the one after the stage reached.
- Next step. Qualifiers such as FIRST and BEST narrow the options. Prefer the step that creates the information or authority later steps need: inventory before assessment, assessment before controls, containment before root cause in a live incident.
Scenario 1: the unauthorised assistant (Domain 1 led)
In a 400-person insurer, claims staff have started pasting customer correspondence into a public chatbot to speed up summaries. No AI policy exists and nobody has a list of AI use.
Role: risk professional advising management. Stage: nothing is identified or governed, and exposure is happening now. The first action is to establish the facts of use and data exposure, with an interim acceptable-use direction, rather than writing a full framework or buying monitoring tools. The follow-up chain is the course in miniature: inventory (lesson 7), owner and oversight (lesson 2), policy and training (lesson 3), then risk statements and treatment (lessons 8 and 9). A blanket ban without assessment is a common distractor: it treats a symptom and ignores the business need.
Scenario 2: the drifting model (Domain 2 led)
A regional retailer’s demand forecasting model passed validation 18 months ago. Stock-outs are rising. The data science team proposes retraining immediately.
Role: advisor on life cycle risk. Stage: operation, with signs of degradation. Retraining may be right, but the first action is to confirm the degradation: compare current performance with the validated baseline and check what changed in the input data. Change management then applies, since a retrained model is a changed model needing testing and approval (lesson 6), followed by reassessment and a register update. Distractors jump to action without evidence or treat validation as permanent.
Scenario 3: the critical vendor (Domain 3 led)
A 250-person logistics company routes deliveries with a third-party optimisation service that has added generative AI features. The service is now in the critical path for same-day deliveries, and the contract was signed before the AI features existed.
Role: risk professional supporting procurement and operations. Stage: a supply chain risk exists but is unassessed in its current form. The first action is a refreshed assessment of the new AI features: data flows, data-usage terms, change notification, fallbacks (lesson 11). Next come the BIA rating and a tested manual fallback (lesson 12), a contract amendment if gaps appear, and KRIs for ongoing monitoring (lesson 10). Terminating the supplier, or accepting without assessment, skips stages.
Decision table: situation, domain, first action
| Situation | Domain | Sensible first action |
|---|---|---|
| Staff use AI tools, nothing is catalogued | 1 and 2 | Establish what is in use and what data is exposed |
| New regulation may affect a use case | 1 | Determine applicability and gaps against current text and legal advice |
| Complaints suggest a model treats groups unequally | 1 and 3 | Gather evidence on outcomes by group, then assess as a trustworthiness risk |
| Model performance falls with no code change | 2 | Compare with validated baseline and check for drift |
| Risk is rated above tolerance | 3 | Select a treatment, then validate the control |
| Risk is within appetite and documented | 3 | Confirm acceptance is owned, recorded and has a review date |
| Provider announces a model change | 3 | Assess impact and revalidate against a test set |
| Harmful output is occurring now | 3 | Contain by restricting capability, preserve evidence |
The table gives a default; a scenario’s facts and qualifiers can change it. See responsible AI principles for the trust-related rows.
Key points
- Read role, then stage, then best next step.
- The first action usually creates facts or authority: inventory, evidence, owner, assessment.
- Containment comes before root cause when harm is live.
- Several domains can apply to one scenario; the stage decides the answer.
Check yourself
Question 1. A bank's fraud model has been flagging far more genuine customers since a recent data pipeline change. Customers are complaining. What should the risk professional recommend FIRST?
- A. Commission a full independent revalidation of the model
- B. Rewrite the AI policy to cover pipeline changes
- C. Limit the harm, for example by reverting the change or adding human review, and preserve evidence
- D. Prepare a board report on AI risk
Show answer
Answer: C
Harm is occurring, so limiting it comes first while evidence is kept. Revalidation, a policy rewrite and a board report are later steps.
Want more questions like this? Full AAIR practice tests →
Question 2. A business unit proposes using an AI tool to screen job applicants. The organisation's appetite for discrimination risk is low. What should the risk professional do BEFORE advising on controls?
- A. Approve the tool because a vendor demonstration was convincing
- B. Reject the proposal because the appetite is low
- C. Wait for complaints before assessing fairness
- D. Assess the use case’s decisions, data and potential impact against the stated appetite
Show answer
Answer: D
Evaluating a use case against appetite starts with understanding what it decides, on what data and with what impact; controls cannot be proportionate before that. The other options skip assessment.
Want more questions like this? Full AAIR practice tests →
Question 3. A provider tells customers it will retire a hosted model in 90 days. A company's refund-approval process depends on it. Which step is BEST first?
- A. Confirm the process’s criticality and dependencies, then plan migration and fallback
- B. Sign with the first available replacement provider
- C. Wait until the retirement date before acting
- D. Ask the provider to keep the model running free of charge
Show answer
Answer: A
Criticality and dependencies, from the BIA and dependency map, size the migration and fallback. The other options are not grounded in the impact.
Want more questions like this? Full AAIR practice tests →
This lesson draws on all three domains (37%, 21% and 42%) and closes the course; the AAIR cheat sheet condenses the vocabulary for last-minute revision.