Isaca AAIA Practice Test 10
Question 90
An independent AI auditor reviews this case: A financial firm inventories only centrally hosted AI while embedded SaaS AI features make employee decisions. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Assign decision rights and responsibilities for design, operation, risk acceptance, independent challenge and remediation.
- Maintain a current AI system inventory covering owned, procured and embedded capabilities, data flows, owners and criticality.
- Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation.
- Reconcile software contracts, cloud billing, SSO logs, network egress, procurement and departmental attestations to inventory entries.
- Compare approved risk appetite, model-level KRIs, customer impact metrics, exceptions and board action minutes.
Explanation
Correct Answers
B:The reason it is necessary is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown. For this situation: A financial firm inventories only centrally hosted AI while embedded SaaS AI features make employee decisions.
D:The reason it is necessary is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown. The corrective action is: Maintain a current AI system inventory covering owned, procured and embedded capabilities, data flows, owners and criticality.
Incorrect Answers
A:This option concerns Accountable ownership and three-lines roles, which is a related but different AI governance concern. In this case: A financial firm inventories only centrally hosted AI while embedded SaaS AI features make employee decisions.
C:This attractive shortcut does not resolve the Enterprise AI inventory and shadow-AI discovery weakness: Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation. For this situation: A financial firm inventories only centrally hosted AI while embedded SaaS AI features make employee decisions.
E:This option concerns Board reporting of AI risk appetite and outcomes, which is a related but different AI governance concern. The decisive principle here is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown.
Question 91
A governance and assurance review uncovers the following: A financial firm inventories only centrally hosted AI while embedded SaaS AI features make employee decisions. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect SOC reports where relevant, model cards, contracts, retention terms, subprocessor lists, SLAs and exit tests.
- Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation.
- Reconcile software contracts, cloud billing, SSO logs, network egress, procurement and departmental attestations to inventory entries.
- Inspect approved exception register, justifications, expiry, control alternatives and follow-up evidence.
Explanation
Correct Answer
C:The reason it is necessary is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown. Independent audit evidence includes: Reconcile software contracts, cloud billing, SSO logs, network egress, procurement and departmental attestations to inventory entries.
Incorrect Answers
A:This option concerns Third-party foundation model procurement assurance, which is a related but different AI governance concern. For this situation: A financial firm inventories only centrally hosted AI while embedded SaaS AI features make employee decisions.
B:This attractive shortcut does not resolve the Enterprise AI inventory and shadow-AI discovery weakness: Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation. Maintain a current AI system inventory covering owned, procured and embedded capabilities, data flows, owners and criticality.
D:This option concerns AI policy exception governance, which is a related but different AI governance concern. The decisive principle here is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown.
Question 92
A risk-based audit engagement examines this operating condition: A financial firm inventories only centrally hosted AI while embedded SaaS AI features make employee decisions. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation.
- Oversight triggers corrective decisions when measurable thresholds are breached and tracks closure.
- Material AI uses are inventoried, risk-tiered and linked to approved business/data owners before production use.
- Employees handle realistic AI exceptions and know approved tools, restricted data and escalation paths.
Explanation
Correct Answer
C:This is an observable validation result for Enterprise AI inventory and shadow-AI discovery, not just management assurance: Material AI uses are inventoried, risk-tiered and linked to approved business/data owners before production use.
Incorrect Answers
A:For this situation: A financial firm inventories only centrally hosted AI while embedded SaaS AI features make employee decisions.
B:This option concerns Board reporting of AI risk appetite and outcomes, which is a related but different AI governance concern. For this situation: A financial firm inventories only centrally hosted AI while embedded SaaS AI features make employee decisions.
D:This option concerns AI workforce literacy and policy awareness, which is a related but different AI governance concern. It does not establish control effectiveness for Enterprise AI inventory and shadow-AI discovery.
Question 93
An audit committee asks for a defensible assessment of this situation: An HR division turns on a vendor resume-ranking feature without listing it in the organization's AI use-case register. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Classify AI uses by impact and autonomy, then apply evidence and approval gates proportionate to the actual exposure.
- Require decision-level explanations proportionate to the use case, validated predictive benefit, documented limitations and a meaningful appeal path.
- Maintain a current AI system inventory covering owned, procured and embedded capabilities, data flows, owners and criticality.
- Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation.
Explanation
Correct Answer
C:The reason it is necessary is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown. In this case: An HR division turns on a vendor resume-ranking feature without listing it in the organization's AI use-case register.
Incorrect Answers
A:This option concerns Risk-tiering and proportional approval gates, which is a related but different AI governance concern. In this case: An HR division turns on a vendor resume-ranking feature without listing it in the organization's AI use-case register.
B:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. It does not establish control effectiveness for Enterprise AI inventory and shadow-AI discovery.
D:This attractive shortcut does not resolve the Enterprise AI inventory and shadow-AI discovery weakness: Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation. In this case: An HR division turns on a vendor resume-ranking feature without listing it in the organization's AI use-case register.
Question 94
During an AI controls assessment, the team learns that an HR division turns on a vendor resume-ranking feature without listing it in the organization's AI use-case register. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements.
- Policy awareness is effective only when personnel understand and apply controls in actual AI workflows.
- Governance cannot assess or monitor AI risk if material use cases and external processors are unknown.
- Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation.
Explanation
Correct Answer
C:The acceptable verified outcome is: Material AI uses are inventoried, risk-tiered and linked to approved business/data owners before production use. In this case: An HR division turns on a vendor resume-ranking feature without listing it in the organization's AI use-case register.
Incorrect Answers
A:This option concerns AI policy exception governance, which is a related but different AI governance concern. In this case: An HR division turns on a vendor resume-ranking feature without listing it in the organization's AI use-case register.
B:This option concerns AI workforce literacy and policy awareness, which is a related but different AI governance concern. The decisive principle here is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown.
D:This attractive shortcut does not resolve the Enterprise AI inventory and shadow-AI discovery weakness: Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation. For this situation: An HR division turns on a vendor resume-ranking feature without listing it in the organization's AI use-case register.
Question 95
An independent AI auditor reviews this case: An HR division turns on a vendor resume-ranking feature without listing it in the organization's AI use-case register. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Reconcile software contracts, cloud billing, SSO logs, network egress, procurement and departmental attestations to inventory entries.
- Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
- Inspect approved exception register, justifications, expiry, control alternatives and follow-up evidence.
- Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation.
Explanation
Correct Answer
A:The acceptable verified outcome is: Material AI uses are inventoried, risk-tiered and linked to approved business/data owners before production use.
Incorrect Answers
B:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. For this situation: An HR division turns on a vendor resume-ranking feature without listing it in the organization's AI use-case register.
C:This option concerns AI policy exception governance, which is a related but different AI governance concern. For this situation: An HR division turns on a vendor resume-ranking feature without listing it in the organization's AI use-case register.
D:For this situation: An HR division turns on a vendor resume-ranking feature without listing it in the organization's AI use-case register.
Question 96
A governance and assurance review uncovers the following: An HR division turns on a vendor resume-ranking feature without listing it in the organization's AI use-case register. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Material AI uses are inventoried, risk-tiered and linked to approved business/data owners before production use.
- Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation.
- Employees handle realistic AI exceptions and know approved tools, restricted data and escalation paths.
- Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives.
Explanation
Correct Answer
A:In this case: An HR division turns on a vendor resume-ranking feature without listing it in the organization's AI use-case register.
Incorrect Answers
B:It misses the key control principle: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown.
C:This option concerns AI workforce literacy and policy awareness, which is a related but different AI governance concern. For this situation: An HR division turns on a vendor resume-ranking feature without listing it in the organization's AI use-case register.
D:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. The decisive principle here is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown.
Question 97
A risk-based audit engagement examines this operating condition: A risk committee approves an AI claims engine but cannot name who can accept residual model risk or suspend it. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Assume assigning every AI issue to the IT department removes management responsibility for business outcomes.
- Assign decision rights and responsibilities for design, operation, risk acceptance, independent challenge and remediation.
- Classify AI uses by impact and autonomy, then apply evidence and approval gates proportionate to the actual exposure.
- Require decision-level explanations proportionate to the use case, validated predictive benefit, documented limitations and a meaningful appeal path.
Explanation
Correct Answer
B:The reason it is necessary is: Accountability requires named authorities with escalation and separation between control operation and independent assurance. This is the proportionate control response to Accountable ownership and three-lines roles: Assign decision rights and responsibilities for design, operation, risk acceptance, independent challenge and remediation.
Incorrect Answers
A:This attractive shortcut does not resolve the Accountable ownership and three-lines roles weakness: Assume assigning every AI issue to the IT department removes management responsibility for business outcomes.
C:This option concerns Risk-tiering and proportional approval gates, which is a related but different AI governance concern. It does not establish control effectiveness for Accountable ownership and three-lines roles.
D:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. It does not establish control effectiveness for Accountable ownership and three-lines roles.
Question 98
An audit committee asks for a defensible assessment of this situation: A risk committee approves an AI claims engine but cannot name who can accept residual model risk or suspend it. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Assume assigning every AI issue to the IT department removes management responsibility for business outcomes.
- Accountability requires named authorities with escalation and separation between control operation and independent assurance.
- Activity counts alone do not evidence acceptable risk or success against stated strategic objectives.
- Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements.
Explanation
Correct Answer
B:Independent audit evidence includes: Review RACI, committee charters, risk decisions, escalation records, owner acceptance and audit independence. This is the applicable AI audit principle for Accountable ownership and three-lines roles: Accountability requires named authorities with escalation and separation between control operation and independent assurance.
Incorrect Answers
A:This attractive shortcut does not resolve the Accountable ownership and three-lines roles weakness: Assume assigning every AI issue to the IT department removes management responsibility for business outcomes. For this situation: A risk committee approves an AI claims engine but cannot name who can accept residual model risk or suspend it.
C:This option concerns Board reporting of AI risk appetite and outcomes, which is a related but different AI governance concern. It does not establish control effectiveness for Accountable ownership and three-lines roles.
D:This option concerns AI policy exception governance, which is a related but different AI governance concern. It does not establish control effectiveness for Accountable ownership and three-lines roles.
Question 99
During an AI controls assessment, the team learns that a risk committee approves an AI claims engine but cannot name who can accept residual model risk or suspend it. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect approved exception register, justifications, expiry, control alternatives and follow-up evidence.
- Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
- Assume assigning every AI issue to the IT department removes management responsibility for business outcomes.
- Review RACI, committee charters, risk decisions, escalation records, owner acceptance and audit independence.
Explanation
Correct Answer
D:The reason it is necessary is: Accountability requires named authorities with escalation and separation between control operation and independent assurance. This evidence directly tests the asserted control for Accountable ownership and three-lines roles: Review RACI, committee charters, risk decisions, escalation records, owner acceptance and audit independence.
Incorrect Answers
A:This option concerns AI policy exception governance, which is a related but different AI governance concern. For this situation: A risk committee approves an AI claims engine but cannot name who can accept residual model risk or suspend it.
B:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. For this situation: A risk committee approves an AI claims engine but cannot name who can accept residual model risk or suspend it.
C:This attractive shortcut does not resolve the Accountable ownership and three-lines roles weakness: Assume assigning every AI issue to the IT department removes management responsibility for business outcomes. The auditor should instead examine: Review RACI, committee charters, risk decisions, escalation records, owner acceptance and audit independence.
Question 100
An independent AI auditor reviews this case: A risk committee approves an AI claims engine but cannot name who can accept residual model risk or suspend it. Which THREE elements together provide a defensible AI audit conclusion: the corrective control, the evidence to test it, and a verified outcome? Select THREE answers.
- Review RACI, committee charters, risk decisions, escalation records, owner acceptance and audit independence.
- Assign decision rights and responsibilities for design, operation, risk acceptance, independent challenge and remediation.
- Review classification methodology, autonomy and data sensitivity, impact scoring, approval records and reclassification triggers.
- A significant AI issue has a named accountable owner, documented decision and independent audit challenge.
- Maintain a current AI system inventory covering owned, procured and embedded capabilities, data flows, owners and criticality.
- Assume assigning every AI issue to the IT department removes management responsibility for business outcomes.
Explanation
Correct Answers
A:The reason it is necessary is: Accountability requires named authorities with escalation and separation between control operation and independent assurance. For this situation: A risk committee approves an AI claims engine but cannot name who can accept residual model risk or suspend it.
B:The reason it is necessary is: Accountability requires named authorities with escalation and separation between control operation and independent assurance. This response fits the risk associated with Accountable ownership and three-lines roles: Assign decision rights and responsibilities for design, operation, risk acceptance, independent challenge and remediation.
D:The reason it is necessary is: Accountability requires named authorities with escalation and separation between control operation and independent assurance. This is an observable validation result for Accountable ownership and three-lines roles, not just management assurance: A significant AI issue has a named accountable owner, documented decision and independent audit challenge.
Incorrect Answers
C:This option concerns Risk-tiering and proportional approval gates, which is a related but different AI governance concern. For this situation: A risk committee approves an AI claims engine but cannot name who can accept residual model risk or suspend it.
E:This option concerns Enterprise AI inventory and shadow-AI discovery, which is a related but different AI governance concern. It does not establish control effectiveness for Accountable ownership and three-lines roles.
F:This attractive shortcut does not resolve the Accountable ownership and three-lines roles weakness: Assume assigning every AI issue to the IT department removes management responsibility for business outcomes. Assign decision rights and responsibilities for design, operation, risk acceptance, independent challenge and remediation.
