An auditor references AI management-system ideas such as roles, risk tiers, and controls for city programs at a literacy level. What governance awareness is illustrated?

An auditor referencing AI management-system ideas such as roles, risk tiers, and controls for city programs at a literacy level illustrates awareness of AI management and governance system concepts for agencies. The correct answer is awareness of AI management and governance system concepts for agencies. Effective municipal AI oversight borrows management-system thinking: assigned roles (owners, reviewers), risk tiers that scale scrutiny, and controls (testing, logging, access, incident response). Literacy at this level lets auditors and managers ask coherent questions without needing awareness of AI privacy and regulatory compliance concepts for agencies. Awareness of AI privacy and regulatory compliance concepts for agencies fails because the scenario describes an auditor citing governance concepts at literacy level, not handling privacy notices, data subject rights, or regulatory compliance obligations. Awareness of AI model auditing and bias mitigation concepts for agencies fails because the referenced ideas are AI management-system concepts—roles, risk tiers, and controls—at literacy level, rather than auditing models for bias or applying mitigation measures. Awareness of AI supply chain and vendor management concepts for agencies fails because literacy at this level means recognizing and applying governance concepts, not managing vendors, supply-chain risks, or third-party AI components. Exam caveat: management-system literacy is not certification as an ISO auditor. The tested awareness is understanding roles, risk tiers, and controls as organizing ideas for agency AI governance, not memorizing a specific commercial standard's clause numbers.

Operational check: define RACI for each significant AI system, assign risk tiers from the city AI policy, map required controls per tier, brief auditors and department leads on that vocabulary, and include role/tier/control evidence in annual AI governance reporting.