AIGP Understanding the Foundations of AI Governance: 337 practice questions

Every question below comes with an explanation for each answer option — not just the correct one. The wrong answers are where most candidates lose marks, so that is where the explanations go into detail.

Preparing for AIGP? Take the free 5-min readiness quiz →

All 337 questions

• A system built to perform a specific task or narrow range: In generally accepted AI terminology, which →
• Ethics and bias risk: Which of the following is such a category commonly attributed specifically to AI →
• Opacity, where the internal reasoning of a model is: Among the unique characteristics of AI that make →
• Transparency and explainability: Which responsible-AI principle does this most directly reflect? →
• So that accountability for AI decisions and oversight is: When establishing an AI governance program, why is →
• It brings diverse expertise and perspectives to bear so AI: What is the primary governance rationale for this →
• Tailor content and depth to each audience while covering: Given this constraint, what is the most appropriate →
• Governance intensity should scale with the organization's: Which principle best guides differentiating their →
• Deployer, because it puts an existing AI system into use: From a governance perspective, in what role is the →
• Deployment and monitoring: Within the AI life cycle, which stage does this control most directly address? →
• Evaluate and update those existing policies so they: Which approach best reflects sound governance as it →
• Use procurement assessments and contract terms that impose: To govern the third-party risk this introduces, →
• Supervised learning: Which type of machine learning does this describe? →
• Complexity and scalability: Which characteristic of AI harm does this scenario most directly illustrate? →
• Probabilistic versus deterministic outputs: Which AI characteristic most directly explains this behavior? →
• Human-centricity: Which is the most defensible choice? →
• Assign clear executive accountability for AI governance: To fix the root governance defect, which action is →
• Embed the relevant functions in AI review from the design: Which change best addresses the underlying →
• Give non-technical staff role-relevant training on AI: Which approach fits best? →
• Scale governance to the high-risk: Which approach best reconciles these competing factors? →
• An actor that develops an AI system or has it developed: From an AI governance perspective, which description →
• Use case assessment: Which AI life-cycle stage is this? →
• Intellectual property policy: Which existing organizational policy most directly needs to be evaluated and →
• A company relies on an external vendor's AI component: Which of the following situations is the clearest →
• It produces new content such as text: In common AI terminology, what most distinctly characterizes 'generative →
• Ethics and bias risk: Which category of AI risk does this situation most directly illustrate? →
• Probabilistic outputs and opacity: Which pair of AI characteristics best explains this governance challenge? →
• Transparency and explainability: Which responsible-AI principle is the bank primarily operationalizing? →
• An AI governance committee or council: Which structure best fits this responsibility? →
• Diverse expertise surfaces risks and perspectives: What is the primary reason for this cross-functional →
• Differentiate content by role so executives: Which approach best reflects effective AI training and awareness →
• Governance should scale to size: Which statement best reflects how their AI governance approaches should →
• It acts as a deployer: From a governance perspective, which role does the company primarily take on, and what →
• Use case assessment: Which life-cycle stage does this control primarily govern? →
• AI introduces novel data and IP risks that existing: Why is updating these existing policies, rather than only →
• Impose contractual terms on data use: Which action most effectively addresses these constraints? →
• A generative, general-purpose model, since it produces new: Which characterization is most precise? →
• Misalignment with the intended objective combined: Which combination of AI risks is most clearly illustrated? →
• Autonomy, speed and scale, and opacity together, so harms: Which characteristics most justify a comprehensive, →
• Add explainability tooling and bias testing so: Which approach best honors the responsible-AI principles in →
• Senior leadership or an AI governance body that owns: In AI governance, which role is generally responsible →
• A team drawing on legal: Which group best reflects that principle? →
• To build shared understanding of AI terminology: What is the primary purpose of an AI training and awareness →
• Because approaches should reflect each organization's size: Why does effective AI governance vary from one →
• A provider develops or supplies the AI system: From a governance perspective, which statement correctly →
• All stages of the AI life cycle: AI governance policies are intended to ensure oversight and accountability →
• Update the IP policy to address AI-generated output: What is the most appropriate governance response before →
• Contractual clauses and vendor assessments requiring: Which mechanism most directly provides that assurance? →
• Machine learning is a subset of AI in which systems learn: A team debates whether their new tool should be →
• Bias risk arising from unrepresentative training data: Which AI risk are they describing? →
• Its outputs are probabilistic and can differ for similar: Which characteristic of AI most directly explains →
• Human-centricity: Which responsible-AI principle does this override requirement most directly operationalize? →
• Define and assign clear roles and responsibilities so each: Which governance action would most directly →
• Diverse expertise and perspectives surface risks and blind: What is the primary governance benefit the AIGP →
• Tailor content and depth to each audience's role while: Which approach best reflects sound AI training and →
• The fintech needs stronger controls for its regulated: Which recommendation best reflects how governance →
• Monitoring the model's real-world impact on its customers: From a governance perspective, which responsibility →
• A missing deployment and monitoring policy: Which lifecycle-stage policy gap most directly explains this →
• Intellectual property and data governance policies: Which existing policy area most urgently needs updating →
• Use procurement assessments and contract terms setting: Which measure most directly manages this third-party →
• A system that learns patterns from data to make: Which description best characterizes a machine learning →
• Ethics and bias risk: Which category of AI risk does this best illustrate? →
• Opacity, because the model's internal decision-making is: Which characteristic of AI does this describe? →
• Accountability: Which responsible-AI principle does this commitment express? →
• To provide oversight of AI initiatives and set direction: In many organizations, what is the primary purpose →
• Because AI risks span legal: Why does effective AI governance typically require collaboration across multiple →
• Strategic implications: Which focus is most appropriate for this specific audience? →
• More rigorous: Given only this constraint, which governance posture is most appropriate for the organization →
• Deciding what information is appropriate to enter and how: From a governance perspective, which concern →
• At ethics by design: At which lifecycle stage should the governing policy require this ethical evaluation to →
• The data privacy policy: Which existing policy most directly needs review before proceeding? →
• Conduct a vendor due-diligence assessment covering: Which action best reflects sound third-party AI risk →
• Generative AI: Which type of AI does this capability best exemplify? →
• Harm to society: Which level of AI harm does this concern most directly illustrate? →
• Speed and scale: Which characteristic of AI most directly amplified the impact of this single mistake? →
• Transparency and explainability for the understandable: Which responsible-AI principles most directly →
• Ultimate accountability with the senior executive: Which allocation of roles best satisfies all three of the →
• Add legal and compliance plus a fairness and ethics: Which additions to the committee would most directly have →
• Deliver role-based training tailored to each audience's: Which design principle should most shape the program →
• Scale governance formality to risk and context: Which approach best reflects how AI governance should differ →
• The provider, which develops or has an AI system made: In common AI-governance terminology distinguishing →
• Incident management: Which of the following is a recognized AI life-cycle stage that such policies should →
• Data privacy, information security, data governance: Which set of existing policy areas most directly needs →
• Vendor due-diligence assessments combined with contractual: Which mechanism is the primary tool for managing →
• A type of AI in which systems learn patterns and improve: Among the generally accepted definitions and types →
• Algorithmic bias in which a model systematically produces: Which of the following is an example of an →
• Transparency and explainability: Which responsible-AI principle does this configuration most directly serve? →
• The model or system owner: Which stakeholder is typically assigned this responsibility? →
• AI governance needs cross-functional collaboration: What does this outcome most directly illustrate about AI →
• To build a shared baseline of AI literacy and awareness: What is the primary purpose of requiring this program →
• The insurer's regulated industry and higher-impact use: Which factor most justifies a more formalized, →
• Deployer, because it uses an AI system under its own: In AI-governance terms, which role does the retailer →
• Use-case assessment: Which AI life-cycle stage does this control primarily target? →
• Data privacy and acceptable-use policy: Updating which existing policy area most directly addresses this →
• Pre-contract due-diligence assessment: Which combination of third-party controls most completely addresses the →
• A general-purpose foundation model: Which term most precisely describes this system? →
• Misalignment between the optimized objective and human: Which characterization best captures the primary →
• Data dependency: Which set of AI characteristics best explains why traditional IT governance is insufficient →
• Fairness for protected groups: Which mapping pairs each requirement with the responsible-AI principle it most →
• To establish clear accountability so specific individuals: What is the primary purpose of formally assigning →
• Because diverse expertise and perspectives improve: Why does effective AI governance rely on cross-functional →
• Deliver awareness to all stakeholders so the whole: Which approach best reflects the intent of such a program? →
• Governance should be scaled and shaped to fit each: Which statement best captures this guidance? →
• The party that puts an AI system into use in a specific: Which description best characterizes a deployer as →
• Supervised learning from labeled hiring outcomes: Which learning approach best describes the training method? →
• Reinforcement learning from action-linked rewards: Which learning method characterizes the pilot? →
• The estimator predicts: Which classification distinguishes their outputs? →
• The model and its connected sociotechnical context: What boundary should the governance review use? →
• Use the probabilities as decision support with calibrated: Which governance response is most appropriate? →
• Add controls proportionate to autonomous rejection: With the same model and data, what governance change is →
• Record individual and group impacts separately: Which distinction should reviewers record? →
• Treat reliability as unestablished because performance: Which conclusion is most defensible? →
• Show the factors behind that product’s forecast change: Which improvement most directly addresses →
• Access restrictions address security: Which pairing correctly identifies these controls? →
• Select fairness measures by context and assess: Which governance principle best frames this issue? →
• Tailor information to each audience’s purpose: Which explanation approach best meets both needs? →
• Verify category labels are defined and applied: Which control most directly addresses the learning method? →
• Define and monitor the reward signal: Which control directly fits this learning approach? →
• The score predicts: Which distinction correctly classifies the outputs? →
• Govern the whole sociotechnical system: Which boundary should governance apply? →
• Train staff to interpret uncertainty before using scores: Which control most directly addresses the →
• Require human review and broader validation before: Which control most directly addresses the combined risk →
• Audit group-level impacts alongside individual accuracy: Which control best addresses the primary governance →
• Test across representative conditions: Which control most directly addresses the reliability concern? →
• Show the key inputs and their decision influence: Which additional control most directly addresses the →
• Test hazards and block unsafe sequences before execution: Which additional control most directly addresses the →
• Measure false-negative rates separately for each group: Which additional control most directly investigates →
• Give the customer a plain-language reason: Which additional control is most direct for the customer-facing →
• Model A is supervised: Which classification follows from these training methods? →
• Supervised learning plus reinforcement learning: What classification is supported? →
• The first predicts: What distinction does the evidence support? →
• Govern the integrated sociotechnical system: What should the company treat as the relevant object of →
• Provide reviewers with interpretable rationales: What conclusion is best supported? →
• Increase oversight for the redesign’s broader autonomous: What governance implication follows? →
• Investigate supplier-specific impacts before concluding: What conclusion best fits trustworthy-AI reasoning? →
• Recognize sample accuracy while treating reliability as: Which interpretation is most defensible? →
• Use the records for transparency and provide: Which distinction best guides the response? →
• Test safe behavior in unusual conditions as well as: Which evaluation is most appropriate? →
• Compare group-specific error harms first: Which conclusion best reflects governance principles? →
• Provide contextual interpretation to the adjuster: Which information pairing is most appropriate? →
• A labeled validation sample comparing cluster assignments: Before approval, which evidence would most directly →
• Inspect reward traces across representative scenarios: Before approval, which evidence most directly tests →
• Classify the output as a forecast or generated instruction: Before selecting evaluation and governance →
• Trace predictions through staff outreach: Before approval, which evidence best determines whether review must →
• Calibration results plus agent override performance: Which evidence is most decision-relevant? →
• Testing counselor intervention rates and error detection: Before approval, which evidence best resolves the →
• Error and stockout rates stratified by store size: Which evidence is most useful? →
• Repeated evaluation across varied: Before approval for varied productions, which evidence most directly →
• Publish system outcomes and retain case-level decision: Which evidence plan best matches those distinct needs? →
• Test security and rare-case safety: Before approval, which evidence best addresses both risks and the →
• Tie the metric choice to the relevant access harms: What evidence should guide approval? →
• Provide engineers feature attributions and leaders: Which evidence plan best serves both audiences? →
• Use supervised learning trained on verified category: Which approach best fits? →
• Use reinforcement learning shaped by employee ratings: Which approach best fits this constraint? →
• Procure a predictive model that estimates fraud likelihood: Which approach fits that constraint? →
• Govern the full sociotechnical screening system: What boundary should the team adopt? →
• Require calibrated evaluation and human review: Which procurement condition best addresses the immediate →
• Limit adaptation and require review before suspensions: Which design choice best fits both constraints? →
• Address the individual harm while examining relevant group: Which response is most suitable? →
• Stability across conditions and the costs of errors: Which evidence should govern deployment? →
• Provide process facts and applicant-specific decision: Which communication plan best separates the relevant →
• Security concerns unauthorized access: Which pairing correctly identifies the two governance concerns? →
• Select Model Y because error rates match: Which choice follows that requirement? →
• Give executives operational facts and planners decision: Which communication approach best serves both →
• Source labels transfer to the target population without: Which assumption no longer holds? →
• Representative checks comparing recorded acceptance: Before approval, which evidence would most directly →
• Generated content composing applicant-facing explanations: Which distinction best describes the new output? →
• The full sociotechnical process: Which boundary is most important for governance analysis? →
• Reviewers need authority and information to interpret: What governance implication follows most directly? →
• Executives retain responsibility for resources: Which accountability distinction is decisive? →
• Separate operational ownership from independent challenge: What role distinction should govern the →
• A defined escalation route with suspension authority: What governance capability is missing? →
• Include dispatch: Which governance design best reflects the needed participation? →
• Role-specific training matched to decisions and authority: Which training approach best fits governance needs? →
• Competence must be demonstrated in the role's required: Which distinction best explains the governance gap? →
• Governance should be proportionate to context: Which principle supports this approach? →
• Pause deployment for accountable review: Which action best applies the policy? →
• The retailer must govern its deployment context: Which responsibility distinction matters most? →
• Sufficient time and information for informed intervention: What is missing for meaningful human override? →
• Assign explicit escalation authority for exceptions: What governance distinction is decisive? →
• The administrator retains accountability and needs: Which distinction is decisive? →
• Formal executive accountability for residual system risks: What is the most direct missing control? →
• Defined authority to resolve disputes and pause operation: Which missing control is most direct? →
• Explicit escalation authority for unresolved high-impact: What control is missing? →
• Include an employee representative in governance: Which missing control most directly addresses that gap? →
• Deliver role-specific training: What is the most direct missing control? →
• Assess and remediate practical intervention competence: Which missing control most directly addresses the →
• Scale governance controls to organizational resources: What missing governance adjustment is most direct? →
• Assign independent challenge authority to the risk: Which missing control most directly addresses this →
• Assign a deployment monitoring owner: Which control is missing? →
• Give the supervisor override authority: Which missing control most directly creates meaningful human →
• Define acceptable-risk thresholds for staff decisions: Which control addresses the stated gap? →
• Assign an internal owner for updates: Which missing control most directly addresses the company’s continuing →
• Executive authority and escalation need clarification: What conclusion is best supported? →
• The manager is the operational owner: What do these observations support? →
• Authorize escalation to pause release: What governance control is most important? →
• Governance is incomplete without participation: What conclusion is best supported? →
• Provide role-based training: Which training design best fits the responsibilities? →
• Training effectiveness is unproven despite high attendance: What does the evidence show? →
• Assign clear owners and proportionate oversight: Which governance approach is most defensible? →
• Escalate for authorized testing and a rollout decision: What action is supported by the evidence? →
• Document shared lifecycle accountability and escalation: What governance conclusion follows? →
• A nominal override exists: Which observation is most important? →
• State acceptable risk boundaries and explain escalation: What communication best supports accountable →
• The insurer retains governance responsibility: Which conclusion best follows from these observations about →
• A signed accountability and escalation matrix: Which evidence most directly resolves whether approval →
• Role records plus a documented independent challenge: Before approval, which evidence would establish both →
• A documented escalation protocol: Before approval, what evidence is most probative? →
• Meeting records naming affected stakeholders and decision: Which evidence best resolves whether participation →
• Role-based curricula with practical assessments: Which evidence is most decisive? →
• Scenario assessments testing override and escalation: Which evidence best resolves whether training was →
• A scaled role-and-escalation record: Which evidence best tests proportionality without abandoning →
• A decision record showing independent challenge: Which evidence best demonstrates that these conflicting →
• A responsibility matrix assigning development: Before approval, which evidence best clarifies accountability →
• A scenario test showing informed reviewers can pause: Which evidence best resolves the approval uncertainty →
• A risk statement defining tolerable errors: What evidence is required before approval? →
• A responsibility matrix assigning monitoring: Which evidence best addresses that concern? →
• Name an executive risk owner with acceptance authority: Which approach satisfies both constraints? →
• The service manager operates: Which assignment correctly distinguishes their roles? →
• Escalate unresolved risk to an authorized accountable: Which governance arrangement is required before →
• Use a cross-functional review with documented executive: Which approach best meets those constraints? →
• Provide role-specific modules with practical checks: Which program best fits the different responsibilities? →
• Scenario-based assessments measuring override: Which evidence should drive the decision? →
• Assign clear ownership and use risk-based controls: Which approach is most suitable? →
• Require independent review before deployment: Which approach best respects that constraint? →
• Assign university owners to validate context: Which responsibility should the university retain? →
• Provide reasons: Which control is most defensible? →
• State thresholds: Which communication best conveys the organization’s risk tolerance? →
• Retain internal accountability and monitor vendor: Which arrangement best reflects the retailer’s governance →
• The low-impact-use assumption no longer holds: Which prior assumption no longer holds? →
• The operational owner can substitute for independent: Which prior governance assumption should be rejected? →
• Submit the applicant-prioritization use: Which action most directly addresses the approval requirement? →
• Clerical-only input is no longer sufficient: Which prior assumption no longer holds? →
• Training transferability: Which prior assumption requires reconsideration? →
• Assign clear scaled roles: Which requirement best reflects proportionate governance? →
• Assign independent challenge authority: Which governance change best addresses this conflict? →
• Vendor testing is sufficient without employer validation: Which assumption about the supplier evidence must →
• Resource empowered review with escalation and fallback: Which control is most defensible? →
• State operational thresholds: Which communication is most necessary first? →
• Provider monitoring alone supplies complete oversight: Which governance assumption must be rejected? →
• Unowned residual risk: What risk remains? →
• Independent challenge occurs after control changes take: Which governance gap is demonstrated? →
• Assign escalation authority: Which mitigation is most urgent? →
• Reviewers may lack time: Which specific remaining risk most directly requires attention? →
• Train by job responsibility: Which distinction is most important? →
• Use realistic decision scenarios and assess coaching: Which evaluation best tests whether training is →
• The inventory should record the tool and its accountable: Which distinction is decisive? →
• Assign approval requirements according to each use’s: Which approval distinction is decisive? →
• The exception needs an expiry: Which distinction controls the decision? →
• Request use-case-specific evidence: What is the decisive procurement requirement? →
• Document provenance: Which distinction is decisive? →
• Monitor use and escalate suspected policy breaches: Which control is decisive? →
• Require formal change approval: Which workflow distinction is decisive? →
• Escalate because the incident exceeds the owner’s assigned: Which distinction is decisive? →
• Link input provenance: Which retention approach best supports traceability? →
• Require advance notice of material model: What contract requirement is decisive? →
• Add AI-specific controls for supplier dependencies: What is the decisive policy gap? →
• Trigger review when the population or data use materially: Which review trigger is most decisive? →
• Create an inventory and intake record linking each use: Which missing control is most direct? →
• Link documented risk tiers to approval routes and decision: Which missing control is most direct? →
• Record an accountable owner and expiry or review date: Which missing control is most direct? →
• Require use-case evidence: Which missing control is most direct? →
• Document approval confirming transcript provenance: Which missing control is most direct? →
• Specify allowed: Which control directly closes the gap? →
• Establish risk-based change approval before deployment: What should be added? →
• Define harm triggers: Which control most directly fixes the escalation gap? →
• Link deployment artifacts: Which control restores traceability? →
• Require supplier change notification: What single contractual control is most direct? →
• Define AI artifact: Which addition most directly closes the AI-specific policy gap? →
• Define event-based policy review triggers: What is the most direct missing control? →
• The inventory is incomplete: What does this evidence most directly support? →
• Approval lacks risk-tier differentiation: What does the evidence most directly indicate? →
• Give each exception an owner: What does the evidence most directly support? →
• Record a scoped performance claim: For this internal procurement decision, with any applicable EU AI Act →
• Document provenance: Before approving the reuse, which evidence is decisive? →
• Escalate and restrict the assistant to verified: Under the organization’s acceptable-use policy, what is the →
• Require change review with affected-line validation: What approval action best fits the evidence? →
• Escalate the incident and preserve affected records: What should happen? →
• Link each output to model: For this internal reproducibility requirement, with any applicable EU AI Act review →
• Require material-change notice: What contract term closes the governance gap? →
• Extend the policy with AI-specific assets: What governance action best closes the identified gap? →
• Trigger review for material use or data changes: What should policy governance require? →
• Obtain written data-use and retention terms: Which evidence would resolve the most important uncertainty →
• A stratified, versioned validation using representative: Before approval, which evidence most directly →
• A bounded exception record covering those required fields: Which evidence is decisive? →
• Representative use-case validation with documented limits: Which evidence resolves the uncertainty? →
• Documented data-use approval tracing the required lineage: What is most decisive? →
• Review live-use logs: Before wider deployment, which evidence is most probative? →
• A contractual change-notification requirement: What should be obtained first? →
• Use a severity matrix with the supplier escalation route: Which evidence resolves both uncertainties? →
• Create a case-linked record of model version: Which additional evidence should be added first? →
• Require contractual notice and cooperation for material: Before approving the arrangement, which evidence →
• Complete a deployment-specific control-gap assessment: Before approval, which evidence best addresses this →
• Reconstruct data transformations and compare product-line: Which evidence most directly resolves that →
• Pause use until an owner and suitability evidence are: Which approach is most defensible? →
• Classify by consequential use: Which approval approach satisfies risk-tiered governance? →
• Name an owner: Which record element best satisfies all four requirements? →
• Require subgroup performance evidence for the intended: Which requirement addresses the key evidence gap? →
• Verify provenance and fitness before reuse: What should approval require first? →
• Block inputs, log attempts, notify the owner, and escalate: Which enforcement response best operationalizes →
• Perform impact analysis and obtain change approval before: Which action should occur before deployment? →
• Escalate the alert under the critical-incident process: What should the operator do first? →
• Link source versions: Which approach best supports traceability? →
• Require advance supplier change notification: Which contract term best satisfies that constraint? →
• Create AI-specific governance requirements: Before expansion, which approach best addresses both constraints? →
• Add event-based review triggers alongside annual review: Which trigger design is strongest? →
• The approved purpose and input-data scope: Which original approval assumption must be reopened? →
• Reassess and obtain tiered approval for customer ranking: What should the team do before the new use? →
• Continued use lacks a current basis: Which conclusion best captures the governance issue before any continued →
• A benchmark proves deployment fitness: What assumption should be rejected? →
• The data is fit for automated rejection: Which prior assumption no longer holds? →
• The approved data use remains unchanged: Which assumption fails? →
• Reassess and approve the new model and personalized use: What is required before deployment? →
• The assessed population and data context changed: Under an organizational AI governance policy, which prior →
• Inputs, transformations, versions, and decision records: What should be preserved for the changed use? →
• Require material-change notice: Before the supplier replaces the underlying model and adds an external data →
• Unassigned AI accountability and escalation: Which gap is most decisive? →
• Adding overnight routes: Which event satisfies that review trigger? →
• Inability to determine necessary safeguards: What specific residual risk remains after this internal →
• Human involvement may not remove consequential: What specific risk remains? →
• Unvalidated omissions and absent accountable review remain: Which residual governance risk remains most →
• Population-specific evidence and data lineage: What should procurement require before approval? →
• Residual linkage and inference risk remains despite: Which remaining concern is most specific before →
• Classifier changes may undermine suitability without: What specific risk remains most important? →
• Limited examples cannot establish changed routing is: Before approving deployment, what remaining risk should →
• Preserve evidence and escalate promptly: What should happen next? →
• Retain inputs: Which retention improvement most directly restores traceability? →
• Require prompt change notice with impact evidence before: Which contractual mitigation best addresses the →
• Supplier incidents may remain undiscovered or unreported: What specific risk remains? →
• The policy may remain unsuitable after material model: What risk remains? →
• The business owner supplies use and data details: Which handoff is correct? →
• The independent assessor should challenge evidence: After governance classifies the use as high risk, which →
• Risk owner approves: Which handoff correctly preserves accountability? →
• The operational owner evaluates evidence and escalates: Before award, who should verify that evidence matches →
• The business data owner coordinates privacy and supplier: Who must resolve the purpose, provenance, →
• The owner pauses use: Which handoff best enforces the boundary? →
• Escalate the decision to the model risk committee: Who should decide whether deployment approval can proceed? →