AI Risk Management Literacy

1. Question 1
   • It is primarily a software bug that requires a code fix to prevent incorrect course recommendations.
   • It reflects a composite risk involving the likelihood of confabulation and the consequence of student schedule disruption.
   • It is purely a data privacy issue because the student shared their academic record with the system.
   • It is an unavoidable outcome of using any automated system for advising tasks.
2. Question 2
   • AI risk is a socio-technical composite that includes not just technical failure but also the probability and magnitude of consequences for individuals, organizations, and society.
   • AI risk is solely about the accuracy of the model, while traditional software risk is about system uptime.
   • AI systems always fail more often than traditional software, so the risk is inherently higher.
   • AI systems cannot be tested, so their risks are entirely unknown and impossible to manage.
3. Question 3
   • The sum of all identified probabilities of failure.
   • The maximum severity of any single identified failure mode.
   • The number of users who might be affected by an error.
   • A composite measure of the likelihood of each potential negative event and the magnitude of its consequences.
4. Question 4
   • The risk is a statistical anomaly that will correct itself with more data over time.
   • The risk is primarily a legal compliance issue that can be resolved by documenting the accuracy disparity.
   • The risk must be assessed as the composite of the likelihood of a misdiagnosis for that group and the potential consequence of a missed or incorrect diagnosis.
   • The risk is negligible because the tool's overall accuracy meets the hospital's threshold.
5. Question 5
   • MAP, then MANAGE, then MEASURE.
   • MEASURE, then MAP, then MANAGE.
   • MAP, then MEASURE, then MANAGE.
   • MANAGE, then MAP, then MEASURE.
6. Question 6
   • GOVERN
   • MEASURE
   • MANAGE
   • MAP
7. Question 7
   • Model failures are a security concern that should be handled by the IT department.
   • The main risk is that users might complain on social media if they get a wrong answer.
   • Model failure is unavoidable, so we should accept it and move on.
   • We should define the risk more broadly as the likelihood of the model failing and the magnitude of harm that failure could cause to users and the organization, not just the failure itself.
8. Question 8
   • AI risk encompasses not just technical performance but also broader socio-technical impacts on individuals, groups, and society, including fairness, privacy, and accountability.
   • Traditional software risks are exclusively about security, while AI risks are about accuracy.
   • Unlike software, AI systems cannot be patched or updated after deployment.
   • AI systems are more expensive to build than traditional software.
9. Question 9
   • Cybersecurity risk frameworks can be applied directly to AI without any modifications.
   • AI risk is simpler to manage because it is always probabilistic, whereas cybersecurity threats are deterministic.
   • AI risk is governed by completely different laws, so cybersecurity frameworks are irrelevant.
   • While related, AI risk includes concerns like harmful bias, explainability, and confabulation that go beyond traditional cybersecurity concerns and require a broader socio-technical approach.
10. Question 10
    • It is an AI risk defined by the probability of confabulation and the magnitude of the potential consequence, such as a doctor making an incorrect treatment decision.
    • It is an unavoidable risk that cannot be measured or managed.
    • It is a data privacy issue because the system is handling sensitive patient data.
    • It is solely a software quality assurance problem.
11. Question 11
    • The risk is solely defined by the likelihood of the model making a prediction error, which has not occurred.
    • The risk arises from a combination of the system's technical performance and its socio-technical context, including potential inequitable outcomes.
    • The risk is limited to legal liability, which only applies if a lawsuit is filed.
    • The system is functioning correctly as designed, so there is no risk to manage.
12. Question 12
    • This is not a risk because the model is just generating text based on patterns in its training data.
    • This is a security vulnerability because the model has been poisoned by malicious training data.
    • This is a risk only if the stereotypes are factually incorrect.
    • This is an example of a harmful bias risk, which falls under the broader category of content risks specific to generative AI.
13. Question 13
    • The tool's benefits always outweigh its risks if its overall accuracy exceeds 95%.
    • The likelihood component of risk is measured by the size of the training dataset, not accuracy.
    • Fit for purpose requires that the AI system's performance is validated in the specific context of use, including its target population.
    • Risk is static once the model is evaluated, so the original accuracy metric is sufficient.
14. Question 14
    • Measure risk as the average accuracy of the escalation decision, ignoring the different consequences of each type of error.
    • Treat the incorrect escalations as a separate operational issue, not an AI risk, since the chatbot is working as designed.
    • Combine both the likelihood and the impact of each type of failure, including wasted resources and poor customer outcomes, to assess overall risk.
    • Focus only on the failures to escalate, because those cases represent the highest likelihood of harm.
15. Question 15
    • Convincing the university administration to adopt the model because its overall prediction accuracy is high.
    • Deciding to deploy the model only for students above a certain age to reduce the chance of bias.
    • Testing the model's performance separately for each demographic group and quantifying the disparity in false positive rates.
    • Defining the team's risk tolerance and assigning a responsible officer to oversee the project.
16. Question 16
    • An AI model is reliable but requires a large amount of computing power, making its operation unsustainable.
    • An AI system is accurate but was trained on data from only one geographic region, so it fails when deployed in a different region.
    • An AI system performs reliably in a laboratory setting but is not robust to changes in its operating environment.
    • An AI tool has been thoroughly tested and is 99.9% accurate at classifying loan applications, but its operations are completely opaque, making it impossible to identify if it is discriminating against a protected group.
17. Question 17
    • Secure and Resilient
    • Privacy-enhanced
    • Safety
    • Explainable and Interpretable
18. Question 18
    • It is not secure and resilient to adversarial attacks.
    • It is not accountable because the hospital did not train staff on how to use it.
    • It is not safe, and it has managed harmful bias poorly, even though it may be valid and reliable for other groups.
    • It is not valid or reliable.
19. Question 19
    • Explainability and Privacy
    • Validity and Reliability
    • Safety and Security
    • Accountability and Transparency
20. Question 20
    • Security and resilience are the most important characteristics, but the developer should also focus on safety.
    • A system that is secure does not need to be explainable.
    • The developer's assessment is correct because security is the foundation of all other characteristics.
    • Trustworthiness is a constellation of characteristics, and focusing solely on security ignores validity, safety, fairness, explainability, privacy, and accountability.
21. Question 21
    • A reason to abandon the project.
    • A compliance issue that can be solved by only working with one regulatory body.
    • A clear failure of the development team.
    • An unavoidable trade-off between the 'valid and reliable' and 'explainable and interpretable' characteristics that requires organizational judgement.
22. Question 22
    • Accountability is optional if a system is transparent.
    • Accountability presupposes transparency; it is difficult to hold an opaque system accountable.
    • Transparency and accountability are the same thing.
    • Accountability is about having clear roles, and it is not related to transparency.
23. Question 23
    • Document the disparity, investigate its root causes, and assess whether it constitutes harmful bias even if it is a byproduct of a legitimate cost-saving measure.
    • Eliminate the model and process all claims manually.
    • Launch the model anyway and address complaints on a case-by-case basis.
    • Ignore the finding because accuracy is the same and the difference is small.
24. Question 24
    • It makes the system run faster.
    • It ensures the system is 100% accurate.
    • It is a legal requirement in every country.
    • It helps build trust by allowing applicants and administrators to understand why a particular admissions decision was made.
25. Question 25
    • The system is expensive to maintain.
    • The system requires a large amount of data to function.
    • The system is slow and causes delays in police response times.
    • The system is accurate but leads to a state where a person's life, health, property, or the environment is endangered.
26. Question 26
    • Valid and Reliable
    • Privacy-enhanced
    • Fair with Harmful Bias Managed
    • Safety
27. Question 27
    • It may fail to meet minimum accuracy thresholds required by the organization.
    • It may violate data privacy regulations by storing user data without encryption.
    • It may produce biased outcomes that go undetected due to lack of interpretability.
    • It may be vulnerable to adversarial attacks that manipulate its inputs.
28. Question 28
    • Security and resilience only
    • Explainability and fairness with harmful bias managed
    • Accountability and transparency only
    • Safety and privacy enhancement
29. Question 29
    • Model B, because it is less complex and therefore less likely to fail.
    • Model A, because higher accuracy is the most important characteristic for loan decisions.
    • Model A, because a neural network is more secure and resilient to hacking.
    • Model B, because explainability allows the institution to verify fairness and compliance.
30. Question 30
    • Safety, because the system may cause physical harm if it makes wrong decisions.
    • Privacy enhancement, because postcode is a proxy for sensitive personal data.
    • Accountability and transparency, because the hospital did not disclose how postcodes were used.
    • Fair with harmful bias managed, because the model uses a feature that introduces socioeconomic bias.

Flashcards will appear here once they are ready.