AI Vendor Risk Assessment Practices Quiz

1. Which control helps mitigate the risk of AI vendor lock-in?

Accepting vendor's proprietary formats

Requiring data portability, model interoperability, and exit clauses

Avoiding contracts

Lock-in is not a concern

2. How should organizations approach reputational risk from AI vendor failures?

Ignore vendor reputation entirely

Assess vendor track record, customer references, and regulatory enforcement history

Reputation does not affect organizational risk

Only market share indicates reliability

3. Which best practice should be included in AI vendor contracts to support GRC compliance?

Vague terms to allow flexibility

Clear audit rights, SLAs, compliance obligations, and liability clauses

No specific compliance language needed

Contracts should focus only on features

4. What is the purpose of a vendor risk scoring model in AI procurement?

To eliminate all vendors

To standardize and compare vendor risks against organizational thresholds

Scoring is not needed if vendors are established

Risk scoring only applies to financial institutions

5. How does supply chain risk apply to AI vendor relationships?

AI vendors operate independently with no supply chain risk

Vendors depend on subcontractors, cloud providers, and data sources that introduce risk

Supply chain is irrelevant to AI

Only physical products have supply chain risk

6. What should be evaluated regarding an AI vendor's incident response and breach notification processes?

Vendors do not need incident response plans

Response time, notification procedures, and post-breach support capabilities

Only incident severity matters

Breach notification is optional

7. Which GRC component ensures ongoing compliance with AI vendor obligations?

Governance only

Risk assessment alone

Compliance monitoring through audits, reporting, and enforcement mechanisms

No ongoing compliance needed

8. What is the importance of vendor security certifications in AI procurement?

Certifications guarantee no security issues will occur

They provide baseline evidence of security controls and compliance commitment

Certifications are marketing only

Security certifications are irrelevant

9. How should organizations address AI model bias risks from vendors?

Ignore bias; it is not a business concern

Request bias testing, documentation, and mitigation strategies from vendor

Assume all vendors test for bias

Bias is only a technical issue

10. What role does continuous monitoring play in AI vendor risk management?

It is unnecessary after initial assessment

It detects security incidents, compliance drift, and performance degradation

It only applies to financial vendors

Monitoring is not relevant to AI

11. Which framework is most commonly used to assess AI vendor security and compliance requirements?

ISO 27001 and SOC 2

GDPR alone

Internal company policies only

Marketing certifications

12. What should be included in an AI vendor risk assessment scorecard?

Only vendor size

Security, compliance, operational, financial, and reputational risk ratings

Vendor's social media followers

Only cost metrics

13. How does GRC 'Risk' management apply to AI vendor selection?

Ignoring all potential vendor risks

Identifying, assessing, and mitigating vendor-related security and operational risks

Assuming vendors never fail

Risk management is unnecessary

14. What is a key compliance risk when using third-party AI models?

Vendor might change pricing

Models may violate regulations like GDPR, CCPA, or industry standards

AI models always comply automatically

Compliance is not relevant to AI

15. Which assessment should be performed to evaluate an AI vendor's security posture?

Marketing audit

Security assessment, penetration testing, and vulnerability scans

Customer satisfaction survey

Financial audit only

16. How should organizations handle AI vendor contracts regarding data residency and sovereignty?

Accept vendor's default data location

Specify data location, access controls, and compliance requirements explicitly

Assume vendor follows all laws automatically

Data location is irrelevant for AI

17. What risk does an AI vendor pose if they lack transparent model documentation?

Low risk; transparency is optional

Inability to audit model behavior, compliance violations, and bias detection

Only reputational risk

No impact on operations

18. In GRC integration, what does 'Governance' primarily address in AI vendor relationships?

Pricing negotiations

Decision-making structures and vendor oversight policies

Marketing strategies

Employee training budgets

19. Which of the following is a critical component of AI vendor due diligence?

Vendor's marketing budget

Data handling practices and model transparency

Vendor office location

Number of sales representatives

20. What is the primary purpose of vendor risk assessment in AI projects?

To reduce vendor costs

To identify security, compliance, and operational risks before engagement

To eliminate all third-party dependencies

To accelerate project timelines

SecAI+ AI Vendor Risk Assessment Practices Quiz