An audit, in which an independent reviewer systematically: Which periodic assessment activity best fits this

An independent audit provides objective assurance that the system still complies with documented policies and controls.

The question

Preparing for AIGP? Take the free 5-min readiness quiz →

1. Red teaming, in which testers adversarially attack the system to discover exploitable safety and security failures before real malicious actors do so.

   Plausible as a listed assessment, but red teaming probes adversarial failures rather than verifying compliance with documented controls for the board.
2. Threat modeling, in which the team maps assets and attacker goals to prioritize where security weaknesses are most likely to arise.

   Plausible and related, but threat modeling is a security-planning exercise, not independent assurance of control compliance.
3. An audit, in which an independent reviewer systematically examines controls, records, and compliance to provide objective assurance to the board. ✓

   Correct because an audit provides the independent, evidence-based assurance of policy and control adherence the scenario requires.
4. A/B testing, in which two model variants are compared on live production traffic to determine which one produces better performance.

   Plausible as evaluation, but A/B testing compares variants for performance, not independent verification of compliance and controls.

How to remember it

An independent audit provides objective assurance that the system still complies with documented policies and controls.

More Understanding How to Govern AI Deployment and Use questions

• Model drift, where changing real-world fraud patterns: What does this pattern most likely indicate? →
• Record it in a risk register with owner and mitigations: To govern this responsibly, what should the company →
• Constrain the chatbot's scope so out-of-domain requests: To reduce this unintended downstream harm, which →
• All 424 Understanding How to Govern AI Deployment and Use questions →