Ethics in AI and Responsible Innovation

Chapter 10
Governance, Accountability, and Organizational Management

Bachelors Program in AI & ML
Ethics in AI and Responsible Innovation • Bachelor

Governance, Accountability, and Organizational Management

Introduction and Context

Responsible innovation is not achieved by a model card, an ethics statement, or a one-time impact assessment alone. It depends on how an organization distributes authority, makes decisions, monitors risks, responds to incidents, and rewards conduct. Governance is therefore the organizational infrastructure through which ethical principles become operational practice.

Artificial intelligence systems create governance challenges because responsibility is distributed across many actors. A data engineer may select training data, a product manager may define the intended use, a vendor may supply a foundation model, a compliance officer may interpret legal requirements, and an operational team may deploy the system. Harm can arise from the interaction of these decisions rather than from a single technical error. Effective governance must consequently clarify who owns a decision, who has authority to approve or stop a system, who must be consulted, and who independently verifies that controls work.

This chapter examines governance structures, decision rights, escalation mechanisms, oversight committees, the three-lines accountability model, policies, training, vendor management, whistleblowing, incentives, and organizational culture. The emphasis is practical: students should be able to design a governance arrangement for an AI-enabled product or service and evaluate whether it supports responsible innovation.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain why AI governance requires organizational rather than purely technical controls.

2. Design ownership and decision rights for the AI system life cycle.

3. Apply the three-lines accountability model to AI risk management.

4. Propose effective oversight committees, escalation pathways, and stop-work criteria.

5. Evaluate policies, training, vendor controls, and whistleblowing mechanisms.

6. Analyze how incentives and organizational culture influence responsible innovation.

7. Develop a proportionate governance plan for an AI system.

1. Governance as a System of Organizational Control

Governance is the system by which an organization is directed, controlled, and held accountable. It includes structures, processes, authorities, information flows, norms, and sanctions. Management concerns the execution of plans; governance concerns who decides, under what authority, according to which principles, and subject to what oversight.

AI governance has at least four dimensions:

Strategic governance: deciding which AI applications the organization should pursue and which uses are unacceptable.
Operational governance: controlling design, development, procurement, deployment, monitoring, and retirement.
Risk governance: identifying, assessing, treating, and escalating risks.
Socio-technical governance: accounting for users, affected communities, institutions, markets, and broader social consequences.

A mature governance system connects these dimensions. For example, a bank may strategically approve fraud detection but prohibit automated credit denial without meaningful human review. Operational governance then defines data controls, validation, deployment approvals, monitoring, and appeal processes. Risk governance establishes thresholds for bias, security, reliability, and regulatory exposure. Socio-technical governance considers whether customers can understand and challenge decisions.

Governance should be proportionate. A low-risk internal text-classification tool should not require the same approval process as an AI system affecting employment, credit, healthcare, education, or access to public services. Proportionality does not mean ignoring ethics; it means matching scrutiny, documentation, and independence to potential impact.

2. Accountability, Responsibility, and Answerability

These terms are related but distinct.

Responsibility is the duty to perform a task or prevent a foreseeable problem.
Accountability is the obligation to explain and justify decisions and to accept consequences for outcomes.
Answerability is the requirement to provide information to those entitled to ask questions.
Liability is legal responsibility for harm or loss, determined by applicable law.
Ownership is the organizational assignment of authority and duty for a system, decision, or risk.

An organization should never treat “the algorithm” as an accountable actor. Models do not hold authority, sign approvals, investigate complaints, or provide remedies. Accountability remains with people and institutions.

A useful governance principle is that authority and accountability should be aligned. A person who is accountable for a system should have sufficient authority, resources, and access to information to influence its design and operation. Assigning accountability without decision rights creates symbolic governance. Conversely, granting broad decision rights without review can create unchecked power.

Accountability is also distributed. A product owner may be accountable for business purpose and user outcomes; an engineering lead for technical implementation; a data steward for data quality and provenance; a security leader for cybersecurity; a legal or compliance function for regulatory interpretation; and an executive sponsor for strategic risk acceptance. Distributed accountability must not become fragmented accountability. A named system owner should coordinate the whole life cycle and maintain a complete accountability record.

3. Life-Cycle Governance and Decision Rights

AI governance should follow the system life cycle rather than begin at deployment. A typical life cycle includes:

1. Problem definition and use-case selection.

2. Impact and risk assessment.

3. Data acquisition, preparation, and governance.

4. Model development or procurement.

5. Validation and testing.

6. Approval and deployment.

7. Monitoring, incident response, and change management.

8. Retirement, deletion, or replacement.

At every stage, governance should specify decision rights. A practical tool is a RACI matrix:

Responsible: performs the work.
Accountable: owns the outcome and has final authority.
Consulted: provides required expertise before a decision.
Informed: receives relevant information after or during the decision.

Each activity should normally have one accountable role, although multiple people may be responsible or consulted. A RACI matrix is not a substitute for judgment; it is a device for exposing gaps and conflicts.

For an employee-screening system, an example allocation might be:

|---|---|---|---|---|

The table illustrates separation of duties. The team that develops a system should not be the only team deciding whether it is safe to deploy. Separation reduces conflicts of interest and the tendency to approve work in which one has invested considerable effort.

Decision gates

Decision gates are formal points at which evidence is reviewed before work proceeds. Typical gates include:

Use-case gate: Is the purpose legitimate, necessary, and compatible with organizational values?
Data gate: Are collection, provenance, quality, consent, access, and retention acceptable?
Model gate: Are performance, robustness, explainability, privacy, and security evidence adequate?
Deployment gate: Are users trained, controls operational, human oversight meaningful, and affected people informed?
Change gate: Does a material modification require reassessment or reapproval?

A gate should define required evidence, approval authority, conditions, and rejection or deferral criteria. “Approved with conditions” is often more useful than an unqualified yes or no, provided conditions have owners and deadlines.

4. The Three Lines of Accountability

The three-lines model, widely used in risk management, clarifies how management and independent assurance interact. Terminology varies across organizations, but the underlying logic is stable.

First line: operational ownership

The first line comprises product, engineering, data, and operational teams that design and run systems. They own day-to-day risks and controls. Their responsibilities include documenting intended use, testing systems, managing access, monitoring performance, recording incidents, and correcting defects.

The first line cannot outsource its accountability merely because a vendor supplies the technology. Procurement may transfer some activities, but the organization remains responsible for deciding whether the system is appropriate for its context.

Second line: risk, compliance, and specialist oversight

The second line establishes methods, advises the first line, sets policies, challenges decisions, and monitors adherence. It may include risk management, legal, privacy, information security, model risk management, responsible AI, and compliance functions. It should possess sufficient independence to challenge delivery pressure while remaining close enough to understand operational realities.

The second line does not normally operate the system. If it both designs a control and performs all operational work, its ability to challenge management may be weakened.

Third line: internal audit

Internal audit provides independent, risk-based assurance to senior management and the governing body. It evaluates whether governance, risk management, and controls are designed adequately and operating effectively. It may examine whether approvals were genuine, whether monitoring data are complete, whether incidents were concealed, and whether corrective actions were implemented.

Internal audit should not own the AI policy or approve individual models as a management function. Doing so can compromise its independence.

Governing body and external assurance

The board or equivalent governing body sets risk appetite, oversees significant risks, challenges executives, and ensures that accountability is not concentrated in an opaque technical function. External auditors, regulators, certification bodies, independent experts, and civil society organizations can provide additional perspectives, but external assurance complements rather than replaces internal accountability.

5. Oversight Committees and Escalation

An AI oversight committee should have a clear mandate rather than become a forum for general discussion. Its charter should specify:

scope of systems covered;
authority to approve, reject, condition, pause, or retire systems;
membership and required expertise;
quorum and conflict-of-interest rules;
evidence required for decisions;
reporting obligations;
treatment of urgent incidents; and
review and appeal procedures.

Membership should be multidisciplinary. Depending on the use case, it may include product, engineering, data protection, security, legal, compliance, risk, human resources, accessibility, domain experts, and representatives of affected groups. Technical expertise alone is insufficient because many AI risks concern power, rights, institutional practice, and social context.

Committees should avoid two common failures. The first is rubber-stamping, where deadlines and commercial pressure make approval automatic. The second is ethics washing, where a committee creates the appearance of responsibility without authority, resources, or access to information. Evidence of committee effectiveness includes documented challenges, conditional approvals, rejected use cases, follow-up actions, and escalation records—not merely the number of meetings held.

Escalation design

Escalation is the movement of a concern to a person or body with greater authority, expertise, or independence. A robust pathway defines:

1. what triggers escalation;

2. to whom the matter goes;

3. how quickly it must be handled;

4. what temporary controls apply;

5. who communicates with affected parties; and

6. how closure is verified.

Triggers may include material performance degradation, unexpected disparate impact, a privacy or security breach, unauthorized use, inability to explain a consequential decision, credible evidence of manipulation, or a complaint indicating systemic harm.

Escalation should not depend solely on managerial permission. Employees need a safe route to report concerns outside the immediate chain of command. Serious issues may require immediate suspension, preservation of evidence, regulatory notification, customer communication, remediation, and independent investigation.

6. Policies, Standards, and Records

A policy states what the organization requires and why. A standard specifies measurable or testable requirements. A procedure explains how work is performed. A record demonstrates what happened. Confusing these layers produces either vague principles or unmanageable paperwork.

An AI governance policy should address at least:

approved, restricted, and prohibited uses;
roles and decision rights;
impact and risk assessment;
data protection and information security;
testing, validation, and documentation;
human oversight and user notification;
accessibility and inclusion;
monitoring and incident response;
procurement and vendor obligations;
retention, deletion, and retirement;
training and competence; and
disciplinary consequences for bypassing controls.

Documentation should be proportionate but sufficient for reconstruction. Useful records include a use-case description, system inventory entry, data sheet, model or system card, risk assessment, test results, approval decision, change log, monitoring reports, incident log, complaints, and remediation evidence.

A system inventory is especially important. Organizations cannot govern systems they do not know exist. The inventory should identify the owner, purpose, users, affected groups, vendor dependencies, data categories, risk classification, deployment status, review date, and retirement plan.

7. Training, Competence, and Organizational Culture

Training is a control, not a ceremonial activity. Different roles require different capabilities. Developers need training in data quality, security, robustness, documentation, and evaluation. Product managers need competence in purpose limitation, impact assessment, user research, and escalation. Executives need to understand uncertainty, risk appetite, and the limits of performance metrics. Procurement staff need to assess vendor claims and contractual protections. Users need to know system limitations, prohibited inputs, human-review procedures, and reporting channels.

Effective training has four features:

it is role-specific;
it uses realistic scenarios rather than only legal text;
it is refreshed when systems, threats, or requirements change; and
it is evaluated through exercises, assessments, or observed behavior.

Culture concerns the informal norms that shape what people do when rules are incomplete. A culture of responsible innovation encourages questioning, transparency, learning from failure, and respect for affected people. A culture of irresponsible innovation may reward speed, secrecy, exaggerated claims, and the suppression of bad news.

Leaders communicate culture through resource allocation and response to incidents. If employees who raise valid concerns are penalized while teams that bypass controls receive promotions, a written ethics policy will have little effect. Psychological safety is therefore a governance asset: people must be able to report uncertainty and mistakes without fearing retaliation, while deliberate misconduct remains subject to proportionate consequences.

8. Incentives and Performance Management

Incentives can undermine governance even when policies are sound. If a product team is rewarded only for launch speed and adoption, it may interpret testing, documentation, and consultation as obstacles. Responsible innovation requires balanced objectives, such as:

delivery and user value;
reliability and security;
fairness and accessibility;
privacy and data stewardship;
quality of documentation;
timely remediation; and
stakeholder trust and complaint resolution.

Metrics must be interpreted carefully. A low complaint count may indicate satisfaction, or it may indicate that users cannot access a complaint channel. A high model accuracy score may coexist with unacceptable performance for a minority group. A high training-completion rate does not prove competence.

Performance systems should reward early risk identification, not only successful launches. Risk acceptance should be explicit and attributable. Managers should not be able to avoid accountability by transferring difficult decisions to a committee with no authority or by labeling a system experimental indefinitely.

9. Vendor and Third-Party Governance

Organizations frequently rely on cloud platforms, data brokers, model providers, consultants, and software libraries. Third-party dependence creates risks involving opacity, data reuse, security, intellectual property, service continuity, jurisdiction, and limited ability to audit.

Vendor due diligence should assess:

the vendor’s governance and security practices;
training-data provenance and lawful use;
model limitations and known failure modes;
documentation and change-notification processes;
testing and independent assurance;
subcontractors and supply-chain dependencies;
incident response and notification times;
data location, retention, and deletion;
accessibility and performance across relevant groups; and
business continuity and exit arrangements.

Contracts should translate expectations into enforceable duties. Appropriate clauses may cover permitted data use, confidentiality, audit or evidence rights, vulnerability disclosure, incident notification, service levels, model-change approval, cooperation with investigations, deletion or return of data, subcontractor controls, indemnities where appropriate, and termination rights.

A vendor questionnaire is not sufficient evidence. Claims should be corroborated through documentation, demonstrations, independent reports, sample testing, contractual commitments, and ongoing monitoring. Procurement and technical teams should also assess concentration risk: dependence on one provider may make suspension or replacement impossible during an incident.

10. Whistleblowing, Complaints, and Remedy

Whistleblowing enables insiders to report serious wrongdoing, concealment, retaliation, or failures that ordinary management channels have not resolved. A credible mechanism provides confidential or anonymous reporting options where legally permitted, independent intake, protection from retaliation, triage, investigation, feedback, and recordkeeping.

Whistleblowing is distinct from ordinary complaints. A customer complaint may concern an incorrect decision; a whistleblower may report that staff knowingly deployed an untested system or manipulated an evaluation. Both are valuable sources of governance information.

Affected people should have accessible channels to question or challenge consequential outcomes. Meaningful remedy may involve explanation, human reconsideration, correction of records, compensation, restoration of access, system modification, or deletion of improperly used data. Apology without correction is not adequate remedy.

A governance system should analyze complaints for patterns. Repeated complaints from one group may reveal disparate impact, poor communication, or an inaccessible appeal process. Closing individual cases without addressing systemic causes is a form of governance failure.

11. Regulatory and Ethical Alignment

AI governance must operate within applicable law and regulation, including requirements concerning privacy, equality and non-discrimination, consumer protection, employment, safety, cybersecurity, intellectual property, records, and sector-specific duties. Organizations should not assume that legal compliance exhausts ethical responsibility. Law may be incomplete, uncertain, or slow to address emerging harms.

At the same time, ethical governance should not be detached from legal accountability. A principle such as fairness must be translated into context-sensitive requirements: which groups are affected, what outcome is being evaluated, what evidence is relevant, what trade-offs are acceptable, and who can challenge the decision?

Contemporary regulatory approaches increasingly emphasize risk classification, transparency, documentation, human oversight, technical robustness, accountability, and post-deployment monitoring. Exact legal duties differ across jurisdictions and sectors, so governance teams must maintain a legal horizon-scanning process and obtain qualified advice for high-impact uses.

12. Illustrative Case: Automated Benefits Triage

The following is a fictional illustrative case.

Background

A regional public agency introduces an AI system to prioritize applications for housing assistance. The system estimates urgency using application information, historical case records, and household characteristics. It does not formally reject applications, but low-priority cases experience longer waits.

Problem

After deployment, community organizations report that applicants with limited digital access and applicants whose records contain inconsistent addresses are disproportionately classified as low priority. The product team argues that overall accuracy is acceptable and that the system only recommends priorities.

Analysis

The system affects access to a significant public service, so its indirect effects matter. The agency’s initial governance was weak: the vendor was treated as responsible for the model, no affected-community representative participated in approval, the agency lacked a documented appeal process, and monitoring focused on average processing time rather than group outcomes. Accountability was also unclear because the operations manager assumed the vendor owned the risk while the vendor contract disclaimed responsibility for local decisions.

The case demonstrates why “recommendation” does not eliminate accountability. A recommendation can shape outcomes when staff rely on it, resources are limited, and affected people cannot see or challenge the ranking.

Approach and solution

The agency pauses expansion and performs an impact assessment. It appoints a named system owner and establishes an oversight group including housing specialists, legal and privacy staff, data scientists, frontline caseworkers, and community representatives. The agency:

documents the intended purpose and prohibited uses;
reviews data provenance and removes unnecessary variables;
tests outcomes across relevant groups and error conditions;
introduces a human review requirement for low-priority classifications;
creates a clear appeal and correction process;
requires the vendor to disclose material model changes;
monitors waiting times, errors, complaints, and group-level outcomes;
trains caseworkers not to treat scores as definitive; and
reports results to senior leadership and the public in accessible language.

Outcome

The revised process identifies that address inconsistency was a proxy for unstable housing and administrative exclusion rather than urgency. The agency changes the workflow so that inconsistent records trigger assistance from a caseworker rather than automatic deprioritization. It also discovers that the vendor’s original documentation did not describe this failure mode. The system is retained only for limited triage, subject to quarterly review and a formal suspension trigger.

Learning points

The case illustrates five principles. First, accountability follows impact, not contractual labels. Second, average performance can conceal unequal effects. Third, human oversight must be empowered and informed, not merely nominal. Fourth, affected communities can identify risks that technical teams miss. Fifth, procurement, monitoring, complaints, and remedy are parts of one governance system.

13. Challenges and Limitations

Governance itself has risks. Excessive approval layers can slow beneficial innovation and encourage shadow systems outside official channels. Committees may lack technical literacy or may overemphasize documentation at the expense of actual outcomes. Quantitative thresholds can create false precision, especially when social values cannot be reduced to a single metric. Independence can also be difficult in small organizations where the same people perform multiple roles.

Other limitations include:

uncertainty about future uses and emergent behavior;
difficulty identifying all affected stakeholders;
dependence on incomplete vendor information;
tension between transparency and security or intellectual property;
jurisdictional differences in legal requirements;
limited resources for small organizations; and
the possibility that responsible governance is judged by paperwork rather than harm reduction.

These limitations support an adaptive approach. Governance should be reviewed after incidents, major changes, new evidence, regulatory developments, and meaningful stakeholder feedback. Controls should be tested in practice, and organizations should be willing to retire systems whose risks cannot be controlled.

14. A Practical Governance Design Method

A student or practitioner designing governance for an AI system can use the following sequence:

1. Describe the purpose and affected people. State what the system does, what it does not do, and who may benefit or bear risks.

2. Classify impact and risk. Consider rights, safety, access to opportunity, privacy, security, financial exposure, and scale.

3. Name the system owner. Give that person authority, resources, and a duty to maintain the life-cycle record.

4. Map decision rights. Use RACI or a similar method for design, procurement, deployment, change, incident response, and retirement.

5. Apply the three lines. Separate operational control, specialist challenge, and independent assurance as far as practicable.

6. Define gates and escalation triggers. Specify evidence, approvers, deadlines, temporary controls, and stop-work powers.

7. Set policies and records. Make requirements testable and preserve evidence of decisions.

8. Control suppliers. Assess vendors before purchase and monitor them after contract signature.

9. Train and align incentives. Make responsible conduct part of competence and performance evaluation.

10. Provide voice and remedy. Establish complaints, appeals, whistleblowing, investigation, and correction mechanisms.

11. Monitor outcomes. Review technical performance, real-world effects, group disparities, incidents, and stakeholder experience.

12. Learn and adapt. Revise controls or retire the system when evidence changes.

Professional and Employability Implications

Graduates working in AI will rarely be responsible only for writing code. They may be asked to document assumptions, participate in review committees, challenge a launch decision, evaluate a vendor, explain limitations to managers, or investigate an incident. Employability therefore depends on the ability to communicate across technical, legal, managerial, and social domains.

Useful professional habits include maintaining decision records, distinguishing evidence from opinion, escalating uncertainty early, asking who is affected but absent from the room, and refusing to represent unverified claims as facts. Responsible practitioners understand that technical competence includes knowing when a system should not be built or deployed.

Chapter Summary

AI governance converts ethical commitments into organizational authority, processes, controls, and accountability. Effective governance distinguishes responsibility, accountability, answerability, ownership, and legal liability, while ensuring that people—not algorithms—remain accountable for decisions.

Governance should cover the entire AI life cycle through proportionate risk classification, decision gates, system inventories, documentation, monitoring, and retirement. RACI matrices clarify roles, while the three-lines model separates operational ownership, specialist risk and compliance challenge, and independent internal audit. Oversight committees require clear authority, multidisciplinary expertise, conflict-of-interest controls, and evidence of real challenge rather than symbolic review.

Policies should be supported by standards, procedures, and records. Training must be role-specific and evaluated. Vendor contracts and due diligence should address data, security, transparency, auditability, model changes, incidents, and exit. Whistleblowing, complaints, appeals, and remedy provide essential channels for detecting and correcting harm. Finally, incentives and culture determine whether formal controls operate in practice. Responsible innovation requires leaders to reward early risk identification, protect good-faith challenge, and align commercial success with social responsibility.

Key Terms

Accountability: The obligation to explain and justify decisions and accept consequences for outcomes.

AI governance: Structures and processes for directing, controlling, and overseeing AI systems.

Answerability: The duty to provide relevant information to authorized questioners.

Decision gate: A formal life-cycle checkpoint at which evidence is reviewed before proceeding.

Escalation: Moving a concern to a higher authority or more independent source of expertise.

First line: Operational teams that own and manage risks in daily work.

Governance: The system by which an organization is directed and controlled.

Human oversight: Meaningful human capacity to understand, intervene in, or stop an AI-supported process.

Impact assessment: A structured examination of potential effects on people, groups, rights, and interests.

Internal audit: An independent assurance function evaluating governance and controls.

Model owner: The person accountable for a model or AI system across its life cycle.

Psychological safety: A climate in which people can raise concerns or admit mistakes without unjust retaliation.

RACI matrix: A tool identifying who is Responsible, Accountable, Consulted, and Informed.

Remedy: Action that corrects harm or restores affected people’s rights or interests.

Risk appetite: The amount and type of risk an organization is willing to accept.

Second line: Risk, compliance, and specialist functions that guide and challenge operations.

System inventory: A maintained record of an organization’s AI systems and their governance attributes.

Three-lines model: An accountability model separating operations, specialist oversight, and independent assurance.

Whistleblowing: Reporting suspected wrongdoing or serious control failure through protected channels.

Review Questions

Short Answer Questions

1. Distinguish responsibility from accountability in AI governance.

2. What are the three lines in the three-lines accountability model?

3. Why should an organization maintain an AI system inventory?

4. State two features of an effective oversight committee.

5. Why is vendor governance necessary even when an AI system is externally supplied?

Long Answer Questions

1. Explain how decision rights and life-cycle gates can reduce accountability gaps in an AI project.

2. Discuss the relationship between organizational culture, incentives, and responsible innovation.

3. Describe how policies, standards, procedures, and records work together in AI governance.

4. Evaluate the strengths and limitations of the three-lines model when applied to a small organization.

5. Explain how complaints, whistleblowing, and remedy contribute to organizational learning.

Analytical / Application Questions

1. Design a governance structure for an AI system used to shortlist university scholarship applicants. Identify the owner, oversight committee, decision gates, escalation triggers, and appeal process.

2. A vendor refuses to disclose meaningful information about a foundation model used in a high-impact service. Analyze the governance risks and recommend procurement and contractual responses.

3. An AI monitoring dashboard shows excellent average accuracy but a sharp increase in complaints from one demographic group. Explain how the organization should investigate, escalate, communicate, and decide whether to pause the system.

Multiple Choice Questions with Answers

Question 1

Which statement best describes accountability in AI governance?

A. The model is responsible for explaining its outputs

B. A person or institution must justify decisions and accept consequences

C. Only the vendor is accountable for system outcomes

D. Accountability means maximizing model accuracy

Correct Answer: B. A person or institution must justify decisions and accept consequences

Question 2

Which activity belongs primarily to the first line of the three-lines model?

A. Independent audit of governance effectiveness

B. Setting external legal requirements

C. Day-to-day operation and control of an AI system

D. Investigating regulators’ enforcement priorities

Correct Answer: C. Day-to-day operation and control of an AI system

Question 3

What is the main purpose of a decision gate?

A. To guarantee that every project is approved

B. To review evidence before allowing a project to proceed

C. To transfer accountability to a committee

D. To eliminate the need for monitoring after deployment

Correct Answer: B. To review evidence before allowing a project to proceed

Question 4

In a RACI matrix, who is Accountable?

A. The person who receives information only

B. The person who performs every task

C. The person who owns the outcome and has final authority

D. Any external stakeholder affected by the system

Correct Answer: C. The person who owns the outcome and has final authority

Question 5

Which practice best supports meaningful human oversight?

A. Requiring a human to click approve without relevant information

B. Allowing trained staff to understand, challenge, and stop a process

C. Hiding model limitations from operational users

D. Removing all human review to avoid inconsistency

Correct Answer: B. Allowing trained staff to understand, challenge, and stop a process

Question 6

Why can average model performance be insufficient for governance?

A. Average performance always understates accuracy

B. It may conceal unequal errors or impacts across groups

C. It proves that the model is legally prohibited

D. It prevents any form of technical testing

Correct Answer: B. It may conceal unequal errors or impacts across groups

Question 7

Which is an appropriate vendor-governance control?

A. Accepting marketing claims without evidence

B. Prohibiting all third-party technology

C. Requiring incident notification and controls on data use

D. Allowing vendors to change models without notice

Correct Answer: C. Requiring incident notification and controls on data use

Question 8

What is a central function of internal audit?

A. Operating every AI system

B. Providing independent, risk-based assurance

C. Replacing the system owner

D. Writing software requirements for vendors

Correct Answer: B. Providing independent, risk-based assurance

Question 9

Which incentive most clearly supports responsible innovation?

A. Rewarding only rapid launches

B. Penalizing employees who report uncertainty

C. Rewarding early risk identification and timely remediation

D. Measuring success only by user growth

Correct Answer: C. Rewarding early risk identification and timely remediation

Question 10

What distinguishes whistleblowing from an ordinary customer complaint?

A. Whistleblowing may report serious wrongdoing or concealed control failures

B. Whistleblowing can only concern technical accuracy

C. Customer complaints never provide governance information

D. Whistleblowing eliminates the need for investigation

Correct Answer: A. Whistleblowing may report serious wrongdoing or concealed control failures

Ethics in AI and Responsible Innovation
Chapter 10 of 14

Chapter 10 Governance, Accountability, and Organizational Management