AI Governance and Risk

AAIA · 66 questions

• A city CIO asks internal audit to review a permitting chatbot design. Ordinance FAQs change often and must cite current code text. Which model approach best fits those municipal assurance needs?
• A county public-health office proposes a multimodal model that reads clinic intake forms and photos of vaccination cards. What should audit emphasize first when evaluating that design?
• A transit authority wants generative AI that drafts rider alerts. What should audit confirm before model selection proceeds?
• A housing authority considers a black-box vendor scoring model for waitlist prioritization. What explainability concern should audit raise?
• A court clerk pilot needs an AI summarizer limited to local procedural manuals, not open-web knowledge. Which requirement should audit verify is enforced?
• A water utility evaluates edge versus cloud inference for plant anomaly detection under continuity constraints. What should audit prioritize in that topology review?
• A 311 program lists latency, citation, and language-support requirements for a resident assistant model. How should audit use that list?
• A parks department wants a vision model for trail-condition photos. What should audit check before accepting the pilot metrics?
• A school district proposes student-chat tutoring AI. What special consideration should audit map before model approval?
• A municipal open-data office asks whether a generative model is needed or a rules-plus-search design suffices for structured dataset lookups. What should audit challenge?
• A city emergency-management team wants AI triage of 911 text tips. Which requirement set should audit review as mission-critical?
• A library consortium considers fine-tuning on patron chat logs. What training-data issue should audit flag?
• A building department reviews vendor claims that a plan-check AI meets local code coverage requirements. What should audit require?
• A county IT board asks audit to confirm an AI solution’s alignment before funding. What fit should audit evaluate?
• A city creates an AI steering committee but leaves permitting AI without a named business owner. What governance gap should audit highlight?
• A county adopts an AI policy binder that has never been mapped to operating procedures for 311 bots. What should audit assess?
• A housing authority AI inventory omits shadow GenAI tools caseworkers use on personal devices. What completeness issue should audit raise?
• A transit agency assigns AI ethics review only after go-live of a fare-evasion camera model. What lifecycle issue should audit cite?
• A municipal CIO AI charter lacks escalation paths when model outputs affect resident eligibility. What should audit recommend emphasizing?
• A school district AI program has no RACI for vendors, data owners, and internal audit. What should program management establish?
• A city council asks audit whether AI awareness training aligns to the published AI policy. What should audit evaluate?
• A water utility AI PMO tracks projects but not residual risk acceptance by executives. What linkage should audit seek?
• A court AI pilot has no periodic governance review cadence after initial approval. What should audit emphasize?
• A parks department delegates all AI vendor management to procurement without IT assurance input. What integration gap should audit note?
• A county AI board publishes principles but no measurable KPIs for program health. What should audit recommend?
• A city's 311 AI chatbot change board reviews prompts and model updates but never includes privacy or equity stakeholders. What should an auditor recommend?
• Several municipal departments purchase SaaS AI copilots without involving the enterprise architecture office. Which control best prevents uncontrolled AI sprawl?
• A city risk register lists permitting AI only under generic technology risk with no AI-specific scenarios. What finding should the auditor raise?
• A county public-health AI triage tool is scheduled for production, but inherent and residual risk were never documented. What should audit insist on before go-live?
• A transit predictive-maintenance model has no key risk indicators for false-negative rates that could miss safety defects. Which action best addresses the gap?
• A housing-eligibility AI control design looks strong on paper, but auditors find the control has never been tested in operation. What distinction should the report emphasize?
• A court transcription AI risk assessment scopes only the model and ignores effects on downstream clerk workflows. What should the auditor recommend?
• A water utility treats silent third-party model updates to a SCADA anomaly detector as low risk and skips re-assessment. What is the most appropriate audit response?
• A school district AI risk heat map underweights fairness risk for special-education recommendation tools. Which recommendation is most appropriate?
• Risk acceptances for a 311 chatbot are signed only by IT, not by the resident-services business owner. What should audit conclude?
• A city emergency AI dispatcher-assist tool has no documented risk appetite thresholds. What should leadership establish before wider use?
• A library recommendation AI skips threat modeling because staff say it only suggests books. How should an auditor respond?
• A county folds AI risk into an annual ERM refresh and never updates after major model-drift events. What improvement is most needed?
• A parks vision-model risk file omits privacy risk from geotagged resident-submitted trail photos. Which gap should audit highlight?
• A municipal vendor AI questionnaire is completed, but results never feed the enterprise AI risk register. What should audit recommend?
• A permitting AI ingests applicant Social Security numbers without a data-minimization review. What should the auditor recommend first?
• A public-health chatbot retains chat logs indefinitely for future training without retention rules. Which control gap is most significant?
• A housing AI shares case notes with a vendor whose subprocessor list audit cannot obtain. What is the primary privacy-governance concern?
• A transit ridership model trains on supposedly de-identified tap data that analysts show is still re-identifiable. What should audit emphasize?
• A court AI assistant can access sealed-case text without a purpose-limitation statement. What control should be required?
• A 311 GenAI tool scrapes the open-data portal plus unpublished citizen emails without classification checks. What should audit recommend?
• A school district AI uses student data for tutoring recommendations without parental notice. Which privacy-program action is most appropriate?
• A water utility AI data catalog lists datasets but does not tag which datasets train which models. What accountability gap does this create?
• A city completed a DPIA/PIA for a CRM, then added an AI scoring layer without updating the assessment. What should audit require?
• A library AI sends research-query embeddings to a cloud service without reviewing residency or encryption standards. What should the auditor recommend?
• A parks permit AI stores biometric face photos from kiosk check-in beyond the stated operational need. What should the auditor emphasize?
• A county AI program names data stewards for warehouses but assigns none to model feature stores. What gap should audit highlight?
• A municipal open-data AI remixes published datasets that include suppressed small-cell demographics. What privacy risk should the auditor flag?
• A city claims AI ethics alignment but cannot map practices to any recognized AI standard or framework. What should the auditor recommend?
• A hiring AI for city jobs shows disparate impact across demographic groups. What should audit prioritize?
• A public-health GenAI summarizer may invent citations that staff could treat as authoritative. What ethical concern should the auditor raise?
• A transit surveillance AI may perform biometric identification in public spaces subject to a local ordinance. What should the auditor verify?
• A housing chatbot disclaimer fails to meet emerging AI transparency and notice expectations for residents. What improvement should audit recommend?
• A court AI research tool may be used by self-represented litigants in ways that raise unauthorized-practice and due-process concerns. What should the auditor emphasize?
• A school district AI vendor contract ignores emerging AI intellectual-property and training-data licensing issues. What should audit recommend?
• A 311 AI policy cites GDPR-style individual rights even though the city is outside that jurisdiction. What should the auditor check?
• A water utility references NIST AI RMF language in policy but implements none of the framework functions. What finding is most appropriate?
• A parks department uses generative AI to create promotional art depicting recognizable residents without likeness or consent review. What should audit require?
• A county AI board asks whether ISO/IEC AI management standards should inform its control catalog. What is the most appropriate auditor response?
• A municipal AI trust-and-safety charter omits accessibility obligations for disabled residents. What should the auditor recommend?
• A city attorney asks internal audit to verify AI use against sector guidance for health, education, and public safety. What should audit do?