cert
cert-1
cert-2

Pass Isaca AAIA Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AAIA Exam - Verified By Experts
AAIA Premium Bundle
$14.99

AAIA Premium Bundle

$74.99
$89.98
  • Premium File 556 Questions & Answers. Last update: Nov 08, 2026
  • Training Course 110 Video Lectures
 
$89.98
$74.99
accept 22 downloads in last 7 days
block-screenshots
Purchase Isaca AAIA Exam Training Products Individually
Isaca AAIA Premium File
Premium File 556 Q&A
$76.99$69.99
Isaca AAIA Video Training Course
Training Course 110 Lectures
$21.99 $19.99
Isaca AAIA Practice Test 103

Question 1020

An independent AI auditor reviews this case: An HR scoring audit uses one overall random sample despite important disparities across protected groups. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Combine risk-weighted stratification and justified random sampling across consequential outcomes and populations.
  2. Inspect sampling frame, strata, selection method, base rates, exclusions and subgroup results.
  3. Reperform representative positive and negative controls using independently selected inputs and authorized challenge procedures.
  4. Review engagement conflicts, tool ownership, reviewer signoff, challenge evidence and decision trail.
  5. Claim an absence of observed harm proves no problem when the sample excluded the at-risk group.

Explanation

Correct Answers

A:

The reason it is necessary is: A statistically large aggregate sample may fail to capture rare but material AI failure conditions. For this situation: An HR scoring audit uses one overall random sample despite important disparities across protected groups.

B:

The corrective action is: Combine risk-weighted stratification and justified random sampling across consequential outcomes and populations.

Incorrect Answers

C:

This option concerns Reperformance and adversarial audit test cases, which is a related but different AI governance concern. The audit must corroborate: Inspect sampling frame, strata, selection method, base rates, exclusions and subgroup results.

D:

This option concerns Auditor independence with AI-enabled workpapers, which is a related but different AI governance concern. For this situation: An HR scoring audit uses one overall random sample despite important disparities across protected groups.

E:

For this situation: An HR scoring audit uses one overall random sample despite important disparities across protected groups.

Question 1021

A governance and assurance review uncovers the following: An audit uses one training-period dataset to judge a fraud model now deployed in a very different market. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Combine risk-weighted stratification and justified random sampling across consequential outcomes and populations.
  2. Reperform representative positive and negative controls using independently selected inputs and authorized challenge procedures.
  3. Sample across relevant periods, model versions and operational shifts and reconstruct point-in-time inputs.
  4. Assume last month's clean output validates all past and future behavior of a changing model.

Explanation

Correct Answer

C:

The reason it is necessary is: AI controls can be effective in one period but fail after model, data or environmental changes. This is the proportionate control response to Time-based audit testing for drifting AI systems: Sample across relevant periods, model versions and operational shifts and reconstruct point-in-time inputs.

Incorrect Answers

A:

This option concerns Stratified sampling for rare AI harms, which is a related but different AI governance concern. It does not establish control effectiveness for Time-based audit testing for drifting AI systems.

B:

This option concerns Reperformance and adversarial audit test cases, which is a related but different AI governance concern. It does not establish control effectiveness for Time-based audit testing for drifting AI systems.

D:

This attractive shortcut does not resolve the Time-based audit testing for drifting AI systems weakness: Assume last month's clean output validates all past and future behavior of a changing model.

Question 1022

A risk-based audit engagement examines this operating condition: An audit uses one training-period dataset to judge a fraud model now deployed in a very different market. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. Control operation is better evidenced by observed outcomes and reproducible test steps than management assertions.
  2. AI controls can be effective in one period but fail after model, data or environmental changes.
  3. Audit scope must follow enterprise AI exposure, not only visible software projects or infrastructure boundaries.
  4. Assume last month's clean output validates all past and future behavior of a changing model.

Explanation

Correct Answer

B:

Independent audit evidence includes: Inspect version timelines, drift monitors, incident dates, feature snapshots and time-based sampling criteria. This is the applicable AI audit principle for Time-based audit testing for drifting AI systems: AI controls can be effective in one period but fail after model, data or environmental changes.

Incorrect Answers

A:

This option concerns Reperformance and adversarial audit test cases, which is a related but different AI governance concern. The decisive principle here is: AI controls can be effective in one period but fail after model, data or environmental changes.

C:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. It does not establish control effectiveness for Time-based audit testing for drifting AI systems.

D:

This attractive shortcut does not resolve the Time-based audit testing for drifting AI systems weakness: Assume last month's clean output validates all past and future behavior of a changing model. For this situation: An audit uses one training-period dataset to judge a fraud model now deployed in a very different market.

Question 1023

An audit committee asks for a defensible assessment of this situation: An audit uses one training-period dataset to judge a fraud model now deployed in a very different market. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Inspect version timelines, drift monitors, incident dates, feature snapshots and time-based sampling criteria.
  2. Assume last month's clean output validates all past and future behavior of a changing model.
  3. Inspect sampling frame, strata, selection method, base rates, exclusions and subgroup results.
  4. Inspect population completeness, test objective, sampling design, tolerable error and audit projection rules.

Explanation

Correct Answer

A:

The reason it is necessary is: AI controls can be effective in one period but fail after model, data or environmental changes. This evidence directly tests the asserted control for Time-based audit testing for drifting AI systems: Inspect version timelines, drift monitors, incident dates, feature snapshots and time-based sampling criteria.

Incorrect Answers

B:

This attractive shortcut does not resolve the Time-based audit testing for drifting AI systems weakness: Assume last month's clean output validates all past and future behavior of a changing model. The auditor should instead examine: Inspect version timelines, drift monitors, incident dates, feature snapshots and time-based sampling criteria.

C:

This option concerns Stratified sampling for rare AI harms, which is a related but different AI governance concern. The decisive principle here is: AI controls can be effective in one period but fail after model, data or environmental changes.

D:

This option concerns Attribute and variable sampling for AI controls, which is a related but different AI governance concern. It does not establish control effectiveness for Time-based audit testing for drifting AI systems.

Question 1024

During an AI controls assessment, the team learns that an audit uses one training-period dataset to judge a fraud model now deployed in a very different market. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. Assume last month's clean output validates all past and future behavior of a changing model.
  2. Audit tests distinguish current and historical control effectiveness with reproducible period evidence.
  3. The plan covers material high-risk deployments and states documented scope boundaries and assurance limitations.
  4. The sample has defensible coverage of high-impact segments and limitations are transparently reported.

Explanation

Correct Answer

B:

The reason it is necessary is: AI controls can be effective in one period but fail after model, data or environmental changes. This is an observable validation result for Time-based audit testing for drifting AI systems, not just management assurance: Audit tests distinguish current and historical control effectiveness with reproducible period evidence.

Incorrect Answers

A:

This attractive shortcut does not resolve the Time-based audit testing for drifting AI systems weakness: Assume last month's clean output validates all past and future behavior of a changing model. Effective closure requires: Audit tests distinguish current and historical control effectiveness with reproducible period evidence.

C:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. The decisive principle here is: AI controls can be effective in one period but fail after model, data or environmental changes.

D:

This option concerns Stratified sampling for rare AI harms, which is a related but different AI governance concern. For this situation: An audit uses one training-period dataset to judge a fraud model now deployed in a very different market.

Question 1025

An independent AI auditor reviews this case: A customer support model has changed six times but auditors test only the latest version without examining incident periods. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Reconcile source populations, failed records, joins and transformations before interpreting AI audit analytics.
  2. Sample across relevant periods, model versions and operational shifts and reconstruct point-in-time inputs.
  3. Match attribute, variables and judgmental methods to the test purpose with transparent population and exception logic.
  4. Assume last month's clean output validates all past and future behavior of a changing model.

Explanation

Correct Answer

B:

The reason it is necessary is: AI controls can be effective in one period but fail after model, data or environmental changes. In this case: A customer support model has changed six times but auditors test only the latest version without examining incident periods.

Incorrect Answers

A:

This option concerns Audit data completeness and reconciliation, which is a related but different AI governance concern. It does not establish control effectiveness for Time-based audit testing for drifting AI systems.

C:

This option concerns Attribute and variable sampling for AI controls, which is a related but different AI governance concern. The decisive principle here is: AI controls can be effective in one period but fail after model, data or environmental changes.

D:

This attractive shortcut does not resolve the Time-based audit testing for drifting AI systems weakness: Assume last month's clean output validates all past and future behavior of a changing model. In this case: A customer support model has changed six times but auditors test only the latest version without examining incident periods.

Question 1026

A governance and assurance review uncovers the following: A customer support model has changed six times but auditors test only the latest version without examining incident periods. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. A statistically large aggregate sample may fail to capture rare but material AI failure conditions.
  2. AI controls can be effective in one period but fail after model, data or environmental changes.
  3. Assume last month's clean output validates all past and future behavior of a changing model.
  4. Audit scope must follow enterprise AI exposure, not only visible software projects or infrastructure boundaries.

Explanation

Correct Answer

B:

Independent audit evidence includes: Inspect version timelines, drift monitors, incident dates, feature snapshots and time-based sampling criteria. In this case: A customer support model has changed six times but auditors test only the latest version without examining incident periods.

Incorrect Answers

A:

This option concerns Stratified sampling for rare AI harms, which is a related but different AI governance concern. In this case: A customer support model has changed six times but auditors test only the latest version without examining incident periods.

C:

This attractive shortcut does not resolve the Time-based audit testing for drifting AI systems weakness: Assume last month's clean output validates all past and future behavior of a changing model. For this situation: A customer support model has changed six times but auditors test only the latest version without examining incident periods.

D:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. In this case: A customer support model has changed six times but auditors test only the latest version without examining incident periods.

Question 1027

A risk-based audit engagement examines this operating condition: A customer support model has changed six times but auditors test only the latest version without examining incident periods. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Inspect version timelines, drift monitors, incident dates, feature snapshots and time-based sampling criteria.
  2. Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence.
  3. Reconcile AI inventory, data flows, business ownership, complaints, material incidents and risk appetite to audit plan.
  4. Assume last month's clean output validates all past and future behavior of a changing model.

Explanation

Correct Answer

A:

The reason it is necessary is: AI controls can be effective in one period but fail after model, data or environmental changes. The corrective action is: Sample across relevant periods, model versions and operational shifts and reconstruct point-in-time inputs.

Incorrect Answers

B:

This option concerns Reproducible audit data transformations, which is a related but different AI governance concern. It does not establish control effectiveness for Time-based audit testing for drifting AI systems.

C:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. For this situation: A customer support model has changed six times but auditors test only the latest version without examining incident periods.

D:

This attractive shortcut does not resolve the Time-based audit testing for drifting AI systems weakness: Assume last month's clean output validates all past and future behavior of a changing model. Sample across relevant periods, model versions and operational shifts and reconstruct point-in-time inputs.

Question 1028

An audit committee asks for a defensible assessment of this situation: A customer support model has changed six times but auditors test only the latest version without examining incident periods. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. Independent repeat tests reproduce control behavior and deviations generate substantiated findings.
  2. Assume last month's clean output validates all past and future behavior of a changing model.
  3. Workpapers map each issue to an explicit criterion, condition, cause, consequence and evidence.
  4. Audit tests distinguish current and historical control effectiveness with reproducible period evidence.

Explanation

Correct Answer

D:

The reason it is necessary is: AI controls can be effective in one period but fail after model, data or environmental changes. Independent audit evidence includes: Inspect version timelines, drift monitors, incident dates, feature snapshots and time-based sampling criteria.

Incorrect Answers

A:

This option concerns Reperformance and adversarial audit test cases, which is a related but different AI governance concern. In this case: A customer support model has changed six times but auditors test only the latest version without examining incident periods.

B:

For this situation: A customer support model has changed six times but auditors test only the latest version without examining incident periods.

C:

This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. It does not establish control effectiveness for Time-based audit testing for drifting AI systems.

Question 1029

During an AI controls assessment, the team learns that a transaction detector had seasonal errors yet auditors sample only a quiet week from last year. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Define the AI audit universe and scope using use-case impact, third parties, control reliance and key risk scenarios.
  2. Reconcile source populations, failed records, joins and transformations before interpreting AI audit analytics.
  3. Sample across relevant periods, model versions and operational shifts and reconstruct point-in-time inputs.
  4. Assume last month's clean output validates all past and future behavior of a changing model.

Explanation

Correct Answer

C:

The reason it is necessary is: AI controls can be effective in one period but fail after model, data or environmental changes. In this case: A transaction detector had seasonal errors yet auditors sample only a quiet week from last year.

Incorrect Answers

A:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. In this case: A transaction detector had seasonal errors yet auditors sample only a quiet week from last year.

B:

This option concerns Audit data completeness and reconciliation, which is a related but different AI governance concern. The decisive principle here is: AI controls can be effective in one period but fail after model, data or environmental changes.

D:

This attractive shortcut does not resolve the Time-based audit testing for drifting AI systems weakness: Assume last month's clean output validates all past and future behavior of a changing model. In this case: A transaction detector had seasonal errors yet auditors sample only a quiet week from last year.

Question 1030

An independent AI auditor reviews this case: A transaction detector had seasonal errors yet auditors sample only a quiet week from last year. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Inspect version timelines, drift monitors, incident dates, feature snapshots and time-based sampling criteria.
  2. Sample across relevant periods, model versions and operational shifts and reconstruct point-in-time inputs.
  3. Inspect source test inputs, environment version, expected result, output logs and exception handling.
  4. Reconcile source populations, failed records, joins and transformations before interpreting AI audit analytics.
  5. Assume last month's clean output validates all past and future behavior of a changing model.

Explanation

Correct Answers

A:

The reason it is necessary is: AI controls can be effective in one period but fail after model, data or environmental changes. The acceptable verified outcome is: Audit tests distinguish current and historical control effectiveness with reproducible period evidence.

B:

The reason it is necessary is: AI controls can be effective in one period but fail after model, data or environmental changes. For this situation: A transaction detector had seasonal errors yet auditors sample only a quiet week from last year.

Incorrect Answers

C:

This option concerns Reperformance and adversarial audit test cases, which is a related but different AI governance concern. In this case: A transaction detector had seasonal errors yet auditors sample only a quiet week from last year.

D:

This option concerns Audit data completeness and reconciliation, which is a related but different AI governance concern. For this situation: A transaction detector had seasonal errors yet auditors sample only a quiet week from last year.

E:

This attractive shortcut does not resolve the Time-based audit testing for drifting AI systems weakness: Assume last month's clean output validates all past and future behavior of a changing model. For this situation: A transaction detector had seasonal errors yet auditors sample only a quiet week from last year.

ISACA Advanced in AI Audit (AAIA) Practice Tests