Week 8 self-check | AI GRCA Practice Lab

WEEK 8 · NIST AI RMF · NIST MEASURE

A good acceptance criterion should be set:

After testing, once results are knownBefore testing, as a measurable threshold with a rule for unacceptable failureOnly by the AI vendorAs a vague aspiration

WEEK 8 · NIST AI RMF · NIST MEASURE

'Human oversight testing' evaluates:

Whether human review is genuinely effective at catching errors and being able to change outcomesOnly staff satisfaction with the toolOnly the number of reviewers employedWhether a human technically exists in the workflow

WEEK 8 · NIST AI RMF · NIST MEASURE

What is the primary purpose of the MEASURE function?

Testing, evaluating and capturing evidence against defined criteriaMapping affected peopleWriting the final approval decisionSetting governance policy

WEEK 8 · NIST AI RMF · NIST MEASURE

What's the risk of setting acceptance criteria only after seeing initial test results?

This is the recommended standard approachNo risk — criteria can always be adjusted freelyCriteria set after seeing results can be unconsciously or deliberately shaped to pass, undermining their purposePost-hoc criteria are always stricter

WEEK 8 · NIST AI RMF · NIST MEASURE

How does a 'system card' differ from a 'model card'?

System cards only apply to hardwareModel cards replace the need for testingThey are identical documentsA system card covers the broader AI system (architecture, data, safeguards); a model card focuses on a specific model

WEEK 8 · NIST AI RMF · NIST MEASURE

What should happen if a system fails its defined acceptance criteria during MEASURE?

Release anyway since testing is just a formalityThe failure should block release or trigger further treatment, per the pre-agreed criteriaQuietly lower the threshold to pass itIgnore it if the vendor disagrees with the result

WEEK 8 · NIST AI RMF · NIST MEASURE

What is the difference between a false positive and a false negative in a fraud-detection model, and why does MEASURE care about the distinction?

Only false positives matter for testingThe distinction is irrelevant to acceptance criteriaThey are the same error typeA false positive wrongly flags a legitimate case; a false negative misses a real one — the acceptable balance between them should be a deliberate, tested decision

WEEK 8 · NIST AI RMF · NIST MEASURE

What is a 'benchmark' in AI testing?

Only relevant to hardwareA legal requirement in every jurisdictionA standard test or dataset used to measure and compare system performanceA synonym for a model card