cert
cert-1
cert-2

Pass Isaca AAIA Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AAIA Exam - Verified By Experts
AAIA Premium Bundle
$14.99

AAIA Premium Bundle

$74.99
$89.98
  • Premium File 556 Questions & Answers. Last update: Nov 08, 2026
  • Training Course 110 Video Lectures
 
$89.98
$74.99
accept 22 downloads in last 7 days
block-screenshots
Purchase Isaca AAIA Exam Training Products Individually
Isaca AAIA Premium File
Premium File 556 Q&A
$76.99$69.99
Isaca AAIA Video Training Course
Training Course 110 Lectures
$21.99 $19.99
Isaca AAIA Practice Test 102

Question 1010

An independent AI auditor reviews this case: A credit model's audit sample randomly selects 200 approvals and contains no adverse-denial cases to test fairness. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Inspect population completeness, test objective, sampling design, tolerable error and audit projection rules.
  2. Combine risk-weighted stratification and justified random sampling across consequential outcomes and populations.
  3. Claim an absence of observed harm proves no problem when the sample excluded the at-risk group.
  4. Inspect sampling frame, strata, selection method, base rates, exclusions and subgroup results.
  5. Reperform representative positive and negative controls using independently selected inputs and authorized challenge procedures.

Explanation

Correct Answers

B:

The reason it is necessary is: A statistically large aggregate sample may fail to capture rare but material AI failure conditions. This response fits the risk associated with Stratified sampling for rare AI harms: Combine risk-weighted stratification and justified random sampling across consequential outcomes and populations.

D:

The reason it is necessary is: A statistically large aggregate sample may fail to capture rare but material AI failure conditions. The corrective action is: Combine risk-weighted stratification and justified random sampling across consequential outcomes and populations.

Incorrect Answers

A:

This option concerns Attribute and variable sampling for AI controls, which is a related but different AI governance concern. The decisive principle here is: A statistically large aggregate sample may fail to capture rare but material AI failure conditions.

C:

This attractive shortcut does not resolve the Stratified sampling for rare AI harms weakness: Claim an absence of observed harm proves no problem when the sample excluded the at-risk group. For this situation: A credit model's audit sample randomly selects 200 approvals and contains no adverse-denial cases to test fairness.

E:

This option concerns Reperformance and adversarial audit test cases, which is a related but different AI governance concern. It does not establish control effectiveness for Stratified sampling for rare AI harms.

Question 1011

A governance and assurance review uncovers the following: A credit model's audit sample randomly selects 200 approvals and contains no adverse-denial cases to test fairness. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Claim an absence of observed harm proves no problem when the sample excluded the at-risk group.
  2. Reconcile AI inventory, data flows, business ownership, complaints, material incidents and risk appetite to audit plan.
  3. Inspect sampling frame, strata, selection method, base rates, exclusions and subgroup results.
  4. Inspect audit program, control objectives, regulatory applicability, measurements and management agreement on criteria.

Explanation

Correct Answer

C:

The reason it is necessary is: A statistically large aggregate sample may fail to capture rare but material AI failure conditions. For this situation: A credit model's audit sample randomly selects 200 approvals and contains no adverse-denial cases to test fairness.

Incorrect Answers

A:

This attractive shortcut does not resolve the Stratified sampling for rare AI harms weakness: Claim an absence of observed harm proves no problem when the sample excluded the at-risk group. The auditor should instead examine: Inspect sampling frame, strata, selection method, base rates, exclusions and subgroup results.

B:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. The decisive principle here is: A statistically large aggregate sample may fail to capture rare but material AI failure conditions.

D:

This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. It does not establish control effectiveness for Stratified sampling for rare AI harms.

Question 1012

A risk-based audit engagement examines this operating condition: A credit model's audit sample randomly selects 200 approvals and contains no adverse-denial cases to test fairness. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. Claim an absence of observed harm proves no problem when the sample excluded the at-risk group.
  2. The plan covers material high-risk deployments and states documented scope boundaries and assurance limitations.
  3. Reported conclusions state what the sample supports and do not overgeneralize judgmental observations.
  4. The sample has defensible coverage of high-impact segments and limitations are transparently reported.

Explanation

Correct Answer

D:

The reason it is necessary is: A statistically large aggregate sample may fail to capture rare but material AI failure conditions. This is an observable validation result for Stratified sampling for rare AI harms, not just management assurance: The sample has defensible coverage of high-impact segments and limitations are transparently reported.

Incorrect Answers

A:

This attractive shortcut does not resolve the Stratified sampling for rare AI harms weakness: Claim an absence of observed harm proves no problem when the sample excluded the at-risk group. Combine risk-weighted stratification and justified random sampling across consequential outcomes and populations.

B:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. For this situation: A credit model's audit sample randomly selects 200 approvals and contains no adverse-denial cases to test fairness.

C:

This option concerns Attribute and variable sampling for AI controls, which is a related but different AI governance concern. For this situation: A credit model's audit sample randomly selects 200 approvals and contains no adverse-denial cases to test fairness.

Question 1013

An audit committee asks for a defensible assessment of this situation: A hospital model review samples mostly common diagnoses while missing high-harm rare conditions. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Preserve professional objectivity, disclose conflicts and independently validate AI-assisted audit decisions.
  2. Combine risk-weighted stratification and justified random sampling across consequential outcomes and populations.
  3. Sample across relevant periods, model versions and operational shifts and reconstruct point-in-time inputs.
  4. Claim an absence of observed harm proves no problem when the sample excluded the at-risk group.

Explanation

Correct Answer

B:

The reason it is necessary is: A statistically large aggregate sample may fail to capture rare but material AI failure conditions. In this case: A hospital model review samples mostly common diagnoses while missing high-harm rare conditions.

Incorrect Answers

A:

This option concerns Auditor independence with AI-enabled workpapers, which is a related but different AI governance concern. It does not establish control effectiveness for Stratified sampling for rare AI harms.

C:

This option concerns Time-based audit testing for drifting AI systems, which is a related but different AI governance concern. It does not establish control effectiveness for Stratified sampling for rare AI harms.

D:

This attractive shortcut does not resolve the Stratified sampling for rare AI harms weakness: Claim an absence of observed harm proves no problem when the sample excluded the at-risk group. In this case: A hospital model review samples mostly common diagnoses while missing high-harm rare conditions.

Question 1014

During an AI controls assessment, the team learns that a hospital model review samples mostly common diagnoses while missing high-harm rare conditions. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. Outsourced AI decisions remain material to the customer organization even if source code is not accessible.
  2. Sampling claims require valid method, controls over selection and a clear interpretation of exceptions.
  3. A statistically large aggregate sample may fail to capture rare but material AI failure conditions.
  4. Claim an absence of observed harm proves no problem when the sample excluded the at-risk group.

Explanation

Correct Answer

C:

The corrective action is: Combine risk-weighted stratification and justified random sampling across consequential outcomes and populations. In this case: A hospital model review samples mostly common diagnoses while missing high-harm rare conditions.

Incorrect Answers

A:

This option concerns Third-party AI assurance boundary and audit rights, which is a related but different AI governance concern. It does not establish control effectiveness for Stratified sampling for rare AI harms.

B:

This option concerns Attribute and variable sampling for AI controls, which is a related but different AI governance concern. In this case: A hospital model review samples mostly common diagnoses while missing high-harm rare conditions.

D:

This attractive shortcut does not resolve the Stratified sampling for rare AI harms weakness: Claim an absence of observed harm proves no problem when the sample excluded the at-risk group. For this situation: A hospital model review samples mostly common diagnoses while missing high-harm rare conditions.

Question 1015

An independent AI auditor reviews this case: A hospital model review samples mostly common diagnoses while missing high-harm rare conditions. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Claim an absence of observed harm proves no problem when the sample excluded the at-risk group.
  2. Inspect population completeness, test objective, sampling design, tolerable error and audit projection rules.
  3. Inspect sampling frame, strata, selection method, base rates, exclusions and subgroup results.
  4. Inspect service organization reports, contract rights, complementary controls, model monitoring and exception records.

Explanation

Correct Answer

C:

The reason it is necessary is: A statistically large aggregate sample may fail to capture rare but material AI failure conditions. This evidence directly tests the asserted control for Stratified sampling for rare AI harms: Inspect sampling frame, strata, selection method, base rates, exclusions and subgroup results.

Incorrect Answers

A:

This attractive shortcut does not resolve the Stratified sampling for rare AI harms weakness: Claim an absence of observed harm proves no problem when the sample excluded the at-risk group. Effective closure requires: The sample has defensible coverage of high-impact segments and limitations are transparently reported.

B:

This option concerns Attribute and variable sampling for AI controls, which is a related but different AI governance concern. For this situation: A hospital model review samples mostly common diagnoses while missing high-harm rare conditions.

D:

This option concerns Third-party AI assurance boundary and audit rights, which is a related but different AI governance concern. For this situation: A hospital model review samples mostly common diagnoses while missing high-harm rare conditions.

Question 1016

A governance and assurance review uncovers the following: A hospital model review samples mostly common diagnoses while missing high-harm rare conditions. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. Independent repeat tests reproduce control behavior and deviations generate substantiated findings.
  2. Claim an absence of observed harm proves no problem when the sample excluded the at-risk group.
  3. The sample has defensible coverage of high-impact segments and limitations are transparently reported.
  4. Independent auditors retain final conclusions and conflicts are mitigated with transparent quality review.

Explanation

Correct Answer

C:

The reason it is necessary is: A statistically large aggregate sample may fail to capture rare but material AI failure conditions. Independent audit evidence includes: Inspect sampling frame, strata, selection method, base rates, exclusions and subgroup results.

Incorrect Answers

A:

This option concerns Reperformance and adversarial audit test cases, which is a related but different AI governance concern. The decisive principle here is: A statistically large aggregate sample may fail to capture rare but material AI failure conditions.

B:

For this situation: A hospital model review samples mostly common diagnoses while missing high-harm rare conditions.

D:

This option concerns Auditor independence with AI-enabled workpapers, which is a related but different AI governance concern. For this situation: A hospital model review samples mostly common diagnoses while missing high-harm rare conditions.

Question 1017

A risk-based audit engagement examines this operating condition: An HR scoring audit uses one overall random sample despite important disparities across protected groups. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Define objective risk-based audit criteria from approved organizational policies, relevant standards and applicable law.
  2. Combine risk-weighted stratification and justified random sampling across consequential outcomes and populations.
  3. Preserve professional objectivity, disclose conflicts and independently validate AI-assisted audit decisions.
  4. Claim an absence of observed harm proves no problem when the sample excluded the at-risk group.

Explanation

Correct Answer

B:

The reason it is necessary is: A statistically large aggregate sample may fail to capture rare but material AI failure conditions. The acceptable verified outcome is: The sample has defensible coverage of high-impact segments and limitations are transparently reported.

Incorrect Answers

A:

This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. The decisive principle here is: A statistically large aggregate sample may fail to capture rare but material AI failure conditions.

C:

This option concerns Auditor independence with AI-enabled workpapers, which is a related but different AI governance concern. The decisive principle here is: A statistically large aggregate sample may fail to capture rare but material AI failure conditions.

D:

This attractive shortcut does not resolve the Stratified sampling for rare AI harms weakness: Claim an absence of observed harm proves no problem when the sample excluded the at-risk group. In this case: An HR scoring audit uses one overall random sample despite important disparities across protected groups.

Question 1018

An audit committee asks for a defensible assessment of this situation: An HR scoring audit uses one overall random sample despite important disparities across protected groups. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. Audit scope must follow enterprise AI exposure, not only visible software projects or infrastructure boundaries.
  2. A statistically large aggregate sample may fail to capture rare but material AI failure conditions.
  3. Claim an absence of observed harm proves no problem when the sample excluded the at-risk group.
  4. Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference.

Explanation

Correct Answer

B:

The corrective action is: Combine risk-weighted stratification and justified random sampling across consequential outcomes and populations. Independent audit evidence includes: Inspect sampling frame, strata, selection method, base rates, exclusions and subgroup results.

Incorrect Answers

A:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. The audit must corroborate: Inspect sampling frame, strata, selection method, base rates, exclusions and subgroup results.

C:

This attractive shortcut does not resolve the Stratified sampling for rare AI harms weakness: Claim an absence of observed harm proves no problem when the sample excluded the at-risk group. For this situation: An HR scoring audit uses one overall random sample despite important disparities across protected groups.

D:

This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. For this situation: An HR scoring audit uses one overall random sample despite important disparities across protected groups.

Question 1019

During an AI controls assessment, the team learns that an HR scoring audit uses one overall random sample despite important disparities across protected groups. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Inspect sampling frame, strata, selection method, base rates, exclusions and subgroup results.
  2. Reconcile AI inventory, data flows, business ownership, complaints, material incidents and risk appetite to audit plan.
  3. Claim an absence of observed harm proves no problem when the sample excluded the at-risk group.
  4. Inspect population completeness, test objective, sampling design, tolerable error and audit projection rules.

Explanation

Correct Answer

A:

The reason it is necessary is: A statistically large aggregate sample may fail to capture rare but material AI failure conditions. In this case: An HR scoring audit uses one overall random sample despite important disparities across protected groups.

Incorrect Answers

B:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. For this situation: An HR scoring audit uses one overall random sample despite important disparities across protected groups.

C:

It misses the key control principle: A statistically large aggregate sample may fail to capture rare but material AI failure conditions.

D:

This option concerns Attribute and variable sampling for AI controls, which is a related but different AI governance concern. The audit must corroborate: Inspect sampling frame, strata, selection method, base rates, exclusions and subgroup results.

Question 1020

An independent AI auditor reviews this case: An HR scoring audit uses one overall random sample despite important disparities across protected groups. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Combine risk-weighted stratification and justified random sampling across consequential outcomes and populations.
  2. Inspect sampling frame, strata, selection method, base rates, exclusions and subgroup results.
  3. Reperform representative positive and negative controls using independently selected inputs and authorized challenge procedures.
  4. Review engagement conflicts, tool ownership, reviewer signoff, challenge evidence and decision trail.
  5. Claim an absence of observed harm proves no problem when the sample excluded the at-risk group.

Explanation

Correct Answers

A:

The reason it is necessary is: A statistically large aggregate sample may fail to capture rare but material AI failure conditions. For this situation: An HR scoring audit uses one overall random sample despite important disparities across protected groups.

B:

The corrective action is: Combine risk-weighted stratification and justified random sampling across consequential outcomes and populations.

Incorrect Answers

C:

This option concerns Reperformance and adversarial audit test cases, which is a related but different AI governance concern. The audit must corroborate: Inspect sampling frame, strata, selection method, base rates, exclusions and subgroup results.

D:

This option concerns Auditor independence with AI-enabled workpapers, which is a related but different AI governance concern. For this situation: An HR scoring audit uses one overall random sample despite important disparities across protected groups.

E:

For this situation: An HR scoring audit uses one overall random sample despite important disparities across protected groups.

ISACA Advanced in AI Audit (AAIA) Practice Tests