Isaca AAIA Practice Test 1
Question 1
A governance and assurance review uncovers the following: A lender replaces a documented rules engine with an opaque scoring service but cannot explain individual credit denials to reviewers. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable.
- Test whether less identifying features or on-premises transformations satisfy the business purpose.
- Require decision-level explanations proportionate to the use case, validated predictive benefit, documented limitations and a meaningful appeal path.
- Design usable human review with understandable context, authority to intervene, escalation and traceable decisions.
Explanation
Correct Answer
C:The reason it is necessary is: Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations. The acceptable verified outcome is: Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives.
Incorrect Answers
A:This attractive shortcut does not resolve the Explainable credit-model selection for adverse decisions weakness: Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable.
B:This option concerns Privacy by design for model features, which is a related but different AI governance concern. It does not establish control effectiveness for Explainable credit-model selection for adverse decisions.
D:This option concerns Human oversight design for high-impact AI, which is a related but different AI governance concern. It does not establish control effectiveness for Explainable credit-model selection for adverse decisions.
Question 2
A risk-based audit engagement examines this operating condition: A lender replaces a documented rules engine with an opaque scoring service but cannot explain individual credit denials to reviewers. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable.
- A human rubber stamp without information or authority does not provide effective human oversight.
- Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations.
- An anomaly is a deviation from a learned baseline, not an independently verified fraud or misconduct conclusion.
Explanation
Correct Answer
C:The acceptable verified outcome is: Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives. In this case: A lender replaces a documented rules engine with an opaque scoring service but cannot explain individual credit denials to reviewers.
Incorrect Answers
A:This attractive shortcut does not resolve the Explainable credit-model selection for adverse decisions weakness: Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable. For this situation: A lender replaces a documented rules engine with an opaque scoring service but cannot explain individual credit denials to reviewers.
B:This option concerns Human oversight design for high-impact AI, which is a related but different AI governance concern. For this situation: A lender replaces a documented rules engine with an opaque scoring service but cannot explain individual credit denials to reviewers.
D:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. It does not establish control effectiveness for Explainable credit-model selection for adverse decisions.
Question 3
An audit committee asks for a defensible assessment of this situation: A lender replaces a documented rules engine with an opaque scoring service but cannot explain individual credit denials to reviewers. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable.
- Inspect retrieval traces, passage IDs, document dates, authorization filters, answer citation fidelity and no-answer cases.
- Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
- Sample user interface, override permissions, time pressure, rationale records and actual reviewer interventions.
Explanation
Correct Answer
C:The reason it is necessary is: Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations. In this case: A lender replaces a documented rules engine with an opaque scoring service but cannot explain individual credit denials to reviewers.
Incorrect Answers
A:This attractive shortcut does not resolve the Explainable credit-model selection for adverse decisions weakness: Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable. The auditor should instead examine: Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
B:This option concerns Retrieval-augmented answer grounding, which is a related but different AI governance concern. It does not establish control effectiveness for Explainable credit-model selection for adverse decisions.
D:This option concerns Human oversight design for high-impact AI, which is a related but different AI governance concern. The decisive principle here is: Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations.
Question 4
During an AI controls assessment, the team learns that a lender replaces a documented rules engine with an opaque scoring service but cannot explain individual credit denials to reviewers. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Flagged cases receive contextual review with measured precision, recall proxies and acceptable false-intervention rates.
- Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives.
- Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable.
- A stratified answer test shows supported citations, correct version use and safe abstention when evidence is absent.
Explanation
Correct Answer
B:The reason it is necessary is: Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations. This is an observable validation result for Explainable credit-model selection for adverse decisions, not just management assurance: Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives.
Incorrect Answers
A:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. For this situation: A lender replaces a documented rules engine with an opaque scoring service but cannot explain individual credit denials to reviewers.
C:This attractive shortcut does not resolve the Explainable credit-model selection for adverse decisions weakness: Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable. Effective closure requires: Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives.
D:This option concerns Retrieval-augmented answer grounding, which is a related but different AI governance concern. For this situation: A lender replaces a documented rules engine with an opaque scoring service but cannot explain individual credit denials to reviewers.
Question 5
An independent AI auditor reviews this case: A mortgage team chooses a deep model only for a marginal accuracy gain while its appeals team cannot reconstruct adverse-action factors. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Require decision-level explanations proportionate to the use case, validated predictive benefit, documented limitations and a meaningful appeal path.
- Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable.
- Require traceable retrieved-source references, corpus version controls and answer checks that distinguish source evidence from inference.
- Evaluate training distribution, drift, thresholds, false-positive harms and human triage before using unsupervised scores for consequential actions.
Explanation
Correct Answer
A:The reason it is necessary is: Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations. In this case: A mortgage team chooses a deep model only for a marginal accuracy gain while its appeals team cannot reconstruct adverse-action factors.
Incorrect Answers
B:This attractive shortcut does not resolve the Explainable credit-model selection for adverse decisions weakness: Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable. In this case: A mortgage team chooses a deep model only for a marginal accuracy gain while its appeals team cannot reconstruct adverse-action factors.
C:This option concerns Retrieval-augmented answer grounding, which is a related but different AI governance concern. The decisive principle here is: Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations.
D:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. The decisive principle here is: Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations.
Question 6
A governance and assurance review uncovers the following: A mortgage team chooses a deep model only for a marginal accuracy gain while its appeals team cannot reconstruct adverse-action factors. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated.
- Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable.
- Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations.
- An anomaly is a deviation from a learned baseline, not an independently verified fraud or misconduct conclusion.
Explanation
Correct Answer
C:The acceptable verified outcome is: Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives. In this case: A mortgage team chooses a deep model only for a marginal accuracy gain while its appeals team cannot reconstruct adverse-action factors.
Incorrect Answers
A:This option concerns Multi-model ensemble risk and failure correlation, which is a related but different AI governance concern. It does not establish control effectiveness for Explainable credit-model selection for adverse decisions.
B:This attractive shortcut does not resolve the Explainable credit-model selection for adverse decisions weakness: Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable. For this situation: A mortgage team chooses a deep model only for a marginal accuracy gain while its appeals team cannot reconstruct adverse-action factors.
D:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. For this situation: A mortgage team chooses a deep model only for a marginal accuracy gain while its appeals team cannot reconstruct adverse-action factors.
Question 7
A risk-based audit engagement examines this operating condition: A mortgage team chooses a deep model only for a marginal accuracy gain while its appeals team cannot reconstruct adverse-action factors. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect retrieval traces, passage IDs, document dates, authorization filters, answer citation fidelity and no-answer cases.
- Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable.
- Compare feature necessity, identifiability, model utility, transformation design and data retention.
- Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
Explanation
Correct Answer
D:The reason it is necessary is: Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations. This evidence directly tests the asserted control for Explainable credit-model selection for adverse decisions: Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
Incorrect Answers
A:This option concerns Retrieval-augmented answer grounding, which is a related but different AI governance concern. For this situation: A mortgage team chooses a deep model only for a marginal accuracy gain while its appeals team cannot reconstruct adverse-action factors.
B:This attractive shortcut does not resolve the Explainable credit-model selection for adverse decisions weakness: Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable. Require decision-level explanations proportionate to the use case, validated predictive benefit, documented limitations and a meaningful appeal path.
C:This option concerns Privacy by design for model features, which is a related but different AI governance concern. The decisive principle here is: Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations.
Question 8
An audit committee asks for a defensible assessment of this situation: A mortgage team chooses a deep model only for a marginal accuracy gain while its appeals team cannot reconstruct adverse-action factors. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable.
- Reviewers demonstrate independent judgment and appropriate overturns with auditable documentation.
- Independent challenge tests detect correlated failure and evidence supports any reliability uplift claimed for the ensemble.
- Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives.
Explanation
Correct Answer
D:The reason it is necessary is: Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations. Independent audit evidence includes: Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
Incorrect Answers
A:For this situation: A mortgage team chooses a deep model only for a marginal accuracy gain while its appeals team cannot reconstruct adverse-action factors.
B:This option concerns Human oversight design for high-impact AI, which is a related but different AI governance concern. In this case: A mortgage team chooses a deep model only for a marginal accuracy gain while its appeals team cannot reconstruct adverse-action factors.
C:This option concerns Multi-model ensemble risk and failure correlation, which is a related but different AI governance concern. For this situation: A mortgage team chooses a deep model only for a marginal accuracy gain while its appeals team cannot reconstruct adverse-action factors.
Question 9
During an AI controls assessment, the team learns that a regional bank wants automatic credit limits from a vendor model and has no access to feature importance or decision-level reason codes. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Test whether less identifying features or on-premises transformations satisfy the business purpose.
- Require decision-level explanations proportionate to the use case, validated predictive benefit, documented limitations and a meaningful appeal path.
- Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable.
- Assess individual and group impact before deployment, require proportional human intervention and record appeal and remediation processes.
Explanation
Correct Answer
B:The reason it is necessary is: Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations. In this case: A regional bank wants automatic credit limits from a vendor model and has no access to feature importance or decision-level reason codes.
Incorrect Answers
A:This option concerns Privacy by design for model features, which is a related but different AI governance concern. In this case: A regional bank wants automatic credit limits from a vendor model and has no access to feature importance or decision-level reason codes.
C:This attractive shortcut does not resolve the Explainable credit-model selection for adverse decisions weakness: Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable. In this case: A regional bank wants automatic credit limits from a vendor model and has no access to feature importance or decision-level reason codes.
D:This option concerns Automated decision impact on individuals, which is a related but different AI governance concern. It does not establish control effectiveness for Explainable credit-model selection for adverse decisions.
Question 10
An independent AI auditor reviews this case: A regional bank wants automatic credit limits from a vendor model and has no access to feature importance or decision-level reason codes. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
- Require decision-level explanations proportionate to the use case, validated predictive benefit, documented limitations and a meaningful appeal path.
- Inspect retrieval traces, passage IDs, document dates, authorization filters, answer citation fidelity and no-answer cases.
- Evaluate training distribution, drift, thresholds, false-positive harms and human triage before using unsupervised scores for consequential actions.
- Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable.
Explanation
Correct Answers
A:The reason it is necessary is: Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations. The corrective action is: Require decision-level explanations proportionate to the use case, validated predictive benefit, documented limitations and a meaningful appeal path.
B:The reason it is necessary is: Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations. For this situation: A regional bank wants automatic credit limits from a vendor model and has no access to feature importance or decision-level reason codes.
Incorrect Answers
C:This option concerns Retrieval-augmented answer grounding, which is a related but different AI governance concern. In this case: A regional bank wants automatic credit limits from a vendor model and has no access to feature importance or decision-level reason codes.
D:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. In this case: A regional bank wants automatic credit limits from a vendor model and has no access to feature importance or decision-level reason codes.
E:This attractive shortcut does not resolve the Explainable credit-model selection for adverse decisions weakness: Approve the highest aggregate AUC and assume a supplier marketing statement proves individual decisions are explainable. For this situation: A regional bank wants automatic credit limits from a vendor model and has no access to feature importance or decision-level reason codes.
