AAIR AI risk program management

AI Risk Program Management is worth 42% of AAIR — around 38 of the 90 questions and the largest domain. Structurally it is the risk management cycle you already know. The marks are in what changes at each step when the asset is a model.

Six areas.

Risk scenario identification and assessment

You need the AI threat catalogue and, critically, which lifecycle stage each threat targets — because the control and the evidence differ by stage:

Threat	Stage targeted	Effect
Data poisoning	Training data	Model learns attacker-chosen behaviour
Backdoor	Training	Hidden trigger the attacker controls
Model extraction	Deployed model	Functional copy stolen via queries
Model inversion	Deployed model	Training data inferred from behaviour
Evasion	Inference	Crafted input misclassified
Prompt injection	Inference	Untrusted input treated as instruction
Drift	Over time	Performance degrades with no change

Beyond attacks, AI risk scenarios include non-adversarial harms: inaccuracy, bias, hallucination, over-reliance, and dependence on a single provider.

Risk treatment strategies

The familiar four — mitigate, transfer, accept, avoid — with two ISACA reflexes worth internalising:

Acceptance is legitimate. A documented, owned, in-appetite accepted risk is frequently the best answer. Candidates who reduce every risk lose marks.

Transfer is limited. You can insure a financial loss; you cannot transfer accountability for a harmful automated decision. Questions sometimes offer transfer where it does not apply.

Controls management: evaluation, selection, validation

Three distinct activities, and the exam distinguishes them:

Evaluation — does this control actually address the identified risk?
Selection — is it proportionate to the risk and the appetite?
Validation — is there evidence it operates as intended?

That third one is where AI controls are weakest in practice. A content filter that nobody has tested is an intention. Validation evidence is what converts it into a control.

Risk metrics, monitoring and reporting

The area that differs most from conventional IT risk.

Thresholds must be measurements. “The model is accurate” is not a threshold. “Accuracy above 94% on the benchmark set, fairness disparity below x across groups, groundedness above y” are thresholds you can monitor and breach.

Monitoring is mandatory, not optional, because drift changes the risk profile with no trigger. An AI risk programme without continuous or periodic measurement has a structural gap regardless of how good its controls are.

Reporting means conveying probabilistic risk to people who want certainty. Report rates against thresholds and trends over time, not anecdotes.

Supply chain risk management

Your AI supply chain includes pretrained models, third-party datasets, model APIs, embedding services and fine-tuning providers — mostly things you cannot inspect.

Due diligence worth knowing:

Provenance — where did the model and its data come from?
Integrity — can you verify the artefact is untampered?
Licensing and data rights — was training data lawfully obtained, and what does that mean for your outputs?
Transparency — will the provider disclose limitations and evaluation results?
Change notification — the critical one. A provider updating a hosted model changes your production behaviour and invalidates your validation evidence.
Continuity — what if the provider withdraws the model or fails?

Incident response, BIA, continuity and disaster recovery

An AI incident is often not an outage. Categories: harmful output, data leakage through responses, discovered poisoning, drift into unreliability, provider failure.

Two things differ from conventional incident response:

Containment usually means restricting or disabling capability, because you cannot patch a model the way you patch code.
Business impact analysis must consider decision quality, not just availability. A model that is up and wrong can be worse than one that is down.

Sample questions

Question 1. A risk register entry for an AI system states the risk as 'the model may be inaccurate'. Which is the BEST improvement?

A. Restate it with a measurable threshold, the affected population and the consequence of breach
B. Add a high severity rating to the existing wording
C. Remove it, since all models are inaccurate to some degree
D. Assign the risk to the model vendor

Show answer

Answer: A

Expressing the risk with a measurable threshold, an affected population and a consequence makes it assessable, monitorable and reportable, which a general statement of possible inaccuracy is not. Adding a severity rating to a vague statement does not make it measurable, deleting it loses a real risk, and assigning it to the vendor does not transfer accountability.

Question 2. An enterprise relies on a single hosted model provider for a critical process. Which supply chain control MOST directly addresses continuity risk?

A. A contractual requirement for change notification
B. Enhanced monitoring of model output quality
C. An assessed and tested fallback: an alternative provider or a degraded manual process
D. An uptime service level agreement with financial penalties

Show answer

Answer: C

An assessed fallback, whether an alternative provider or a degraded manual process, is what preserves the process if the provider fails or withdraws the model. Contractual notification addresses change rather than failure, monitoring detects problems without resolving them, and an uptime SLA compensates financially without maintaining the process.

Question 3. A content filter was implemented to prevent an AI assistant producing unsafe output. The risk practitioner is assessing controls management. Which question is MOST important?

A. How much the filter cost to implement
B. What evidence exists that the filter blocks what it is intended to block
C. Which vendor supplied the filter
D. When the filter was deployed

Show answer

Answer: B

Controls validation asks whether there is evidence the control operates as intended, which for a filter means testing that it actually blocks what it is meant to block. Cost, vendor identity and deployment date are administrative facts that say nothing about effectiveness.

What to practise

Take your organisation’s risk process and write the AI variant of each step: one AI risk scenario properly worded with a measurable threshold, one treatment decision including an acceptance, one control with its validation evidence, one metric you would report monthly, six supply chain due diligence questions, and one AI incident scenario with its containment action.

That is six artefacts, it is 42% of the exam, and every one of them is useful at work.