cert
cert-1
cert-2

Pass Isaca AAIA Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AAIA Exam - Verified By Experts
AAIA Premium Bundle
$14.99

AAIA Premium Bundle

$74.99
$89.98
  • Premium File 556 Questions & Answers. Last update: Nov 08, 2026
  • Training Course 110 Video Lectures
 
$89.98
$74.99
accept 22 downloads in last 7 days
block-screenshots
Purchase Isaca AAIA Exam Training Products Individually
Isaca AAIA Premium File
Premium File 556 Q&A
$76.99$69.99
Isaca AAIA Video Training Course
Training Course 110 Lectures
$21.99 $19.99
Isaca AAIA Practice Test 106

Question 1050

An independent AI auditor reviews this case: A bank gives auditors only handpicked fair-decision examples and refuses independently selected records. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Inspect source test inputs, environment version, expected result, output logs and exception handling.
  2. Inspect version timelines, drift monitors, incident dates, feature snapshots and time-based sampling criteria.
  3. Define the AI audit universe and scope using use-case impact, third parties, control reliance and key risk scenarios.
  4. Use vendor screenshots or scripted demonstrations as substitutes for independent evidence when testing is feasible.
  5. Reperform representative positive and negative controls using independently selected inputs and authorized challenge procedures.

Explanation

Correct Answers

A:

The reason it is necessary is: Control operation is better evidenced by observed outcomes and reproducible test steps than management assertions. The corrective action is: Reperform representative positive and negative controls using independently selected inputs and authorized challenge procedures.

E:

The reason it is necessary is: Control operation is better evidenced by observed outcomes and reproducible test steps than management assertions. For this situation: A bank gives auditors only handpicked fair-decision examples and refuses independently selected records.

Incorrect Answers

B:

This option concerns Time-based audit testing for drifting AI systems, which is a related but different AI governance concern. It does not establish control effectiveness for Reperformance and adversarial audit test cases.

C:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. For this situation: A bank gives auditors only handpicked fair-decision examples and refuses independently selected records.

D:

This attractive shortcut does not resolve the Reperformance and adversarial audit test cases weakness: Use vendor screenshots or scripted demonstrations as substitutes for independent evidence when testing is feasible. For this situation: A bank gives auditors only handpicked fair-decision examples and refuses independently selected records.

Question 1051

A governance and assurance review uncovers the following: A bank gives auditors only handpicked fair-decision examples and refuses independently selected records. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Use vendor screenshots or scripted demonstrations as substitutes for independent evidence when testing is feasible.
  2. Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence.
  3. Inspect source test inputs, environment version, expected result, output logs and exception handling.
  4. Inspect population completeness, test objective, sampling design, tolerable error and audit projection rules.

Explanation

Correct Answer

C:

The reason it is necessary is: Control operation is better evidenced by observed outcomes and reproducible test steps than management assertions. The acceptable verified outcome is: Independent repeat tests reproduce control behavior and deviations generate substantiated findings.

Incorrect Answers

A:

This attractive shortcut does not resolve the Reperformance and adversarial audit test cases weakness: Use vendor screenshots or scripted demonstrations as substitutes for independent evidence when testing is feasible. Effective closure requires: Independent repeat tests reproduce control behavior and deviations generate substantiated findings.

B:

This option concerns Reproducible audit data transformations, which is a related but different AI governance concern. It does not establish control effectiveness for Reperformance and adversarial audit test cases.

D:

This option concerns Attribute and variable sampling for AI controls, which is a related but different AI governance concern. In this case: A bank gives auditors only handpicked fair-decision examples and refuses independently selected records.

Question 1052

A risk-based audit engagement examines this operating condition: A bank gives auditors only handpicked fair-decision examples and refuses independently selected records. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. A second reviewer reproduces key findings from the recorded inputs and processing logic.
  2. Reported conclusions state what the sample supports and do not overgeneralize judgmental observations.
  3. Use vendor screenshots or scripted demonstrations as substitutes for independent evidence when testing is feasible.
  4. Independent repeat tests reproduce control behavior and deviations generate substantiated findings.

Explanation

Correct Answer

D:

The reason it is necessary is: Control operation is better evidenced by observed outcomes and reproducible test steps than management assertions. Independent audit evidence includes: Inspect source test inputs, environment version, expected result, output logs and exception handling.

Incorrect Answers

A:

This option concerns Reproducible audit data transformations, which is a related but different AI governance concern. For this situation: A bank gives auditors only handpicked fair-decision examples and refuses independently selected records.

B:

This option concerns Attribute and variable sampling for AI controls, which is a related but different AI governance concern. For this situation: A bank gives auditors only handpicked fair-decision examples and refuses independently selected records.

C:

This attractive shortcut does not resolve the Reperformance and adversarial audit test cases weakness: Use vendor screenshots or scripted demonstrations as substitutes for independent evidence when testing is feasible. Reperform representative positive and negative controls using independently selected inputs and authorized challenge procedures.

Question 1053

An audit committee asks for a defensible assessment of this situation: An external provider claims prompt injection is mitigated without permitting a scoped negative tool-call test. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Match attribute, variables and judgmental methods to the test purpose with transparent population and exception logic.
  2. Use vendor screenshots or scripted demonstrations as substitutes for independent evidence when testing is feasible.
  3. Sample across relevant periods, model versions and operational shifts and reconstruct point-in-time inputs.
  4. Reperform representative positive and negative controls using independently selected inputs and authorized challenge procedures.

Explanation

Correct Answer

D:

The reason it is necessary is: Control operation is better evidenced by observed outcomes and reproducible test steps than management assertions. In this case: An external provider claims prompt injection is mitigated without permitting a scoped negative tool-call test.

Incorrect Answers

A:

This option concerns Attribute and variable sampling for AI controls, which is a related but different AI governance concern. In this case: An external provider claims prompt injection is mitigated without permitting a scoped negative tool-call test.

B:

This attractive shortcut does not resolve the Reperformance and adversarial audit test cases weakness: Use vendor screenshots or scripted demonstrations as substitutes for independent evidence when testing is feasible. In this case: An external provider claims prompt injection is mitigated without permitting a scoped negative tool-call test.

C:

This option concerns Time-based audit testing for drifting AI systems, which is a related but different AI governance concern. In this case: An external provider claims prompt injection is mitigated without permitting a scoped negative tool-call test.

Question 1054

During an AI controls assessment, the team learns that an external provider claims prompt injection is mitigated without permitting a scoped negative tool-call test. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. Sampling claims require valid method, controls over selection and a clear interpretation of exceptions.
  2. A statistically large aggregate sample may fail to capture rare but material AI failure conditions.
  3. Use vendor screenshots or scripted demonstrations as substitutes for independent evidence when testing is feasible.
  4. Control operation is better evidenced by observed outcomes and reproducible test steps than management assertions.

Explanation

Correct Answer

D:

Independent audit evidence includes: Inspect source test inputs, environment version, expected result, output logs and exception handling. In this case: An external provider claims prompt injection is mitigated without permitting a scoped negative tool-call test.

Incorrect Answers

A:

This option concerns Attribute and variable sampling for AI controls, which is a related but different AI governance concern. For this situation: An external provider claims prompt injection is mitigated without permitting a scoped negative tool-call test.

B:

This option concerns Stratified sampling for rare AI harms, which is a related but different AI governance concern. It does not establish control effectiveness for Reperformance and adversarial audit test cases.

C:

This attractive shortcut does not resolve the Reperformance and adversarial audit test cases weakness: Use vendor screenshots or scripted demonstrations as substitutes for independent evidence when testing is feasible. For this situation: An external provider claims prompt injection is mitigated without permitting a scoped negative tool-call test.

Question 1055

An independent AI auditor reviews this case: An external provider claims prompt injection is mitigated without permitting a scoped negative tool-call test. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Inspect source test inputs, environment version, expected result, output logs and exception handling.
  2. Use vendor screenshots or scripted demonstrations as substitutes for independent evidence when testing is feasible.
  3. Inspect population completeness, test objective, sampling design, tolerable error and audit projection rules.
  4. Inspect row counts, independent totals, missing keys, excluded statuses and transformation logs.

Explanation

Correct Answer

A:

In this case: An external provider claims prompt injection is mitigated without permitting a scoped negative tool-call test.

Incorrect Answers

B:

For this situation: An external provider claims prompt injection is mitigated without permitting a scoped negative tool-call test.

C:

This option concerns Attribute and variable sampling for AI controls, which is a related but different AI governance concern. The audit must corroborate: Inspect source test inputs, environment version, expected result, output logs and exception handling.

D:

This option concerns Audit data completeness and reconciliation, which is a related but different AI governance concern. In this case: An external provider claims prompt injection is mitigated without permitting a scoped negative tool-call test.

Question 1056

A governance and assurance review uncovers the following: An external provider claims prompt injection is mitigated without permitting a scoped negative tool-call test. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. Workpapers map each issue to an explicit criterion, condition, cause, consequence and evidence.
  2. Independent repeat tests reproduce control behavior and deviations generate substantiated findings.
  3. End-to-end reconciliations explain missing and duplicated records before sampling and metrics.
  4. Use vendor screenshots or scripted demonstrations as substitutes for independent evidence when testing is feasible.

Explanation

Correct Answer

B:

This is an observable validation result for Reperformance and adversarial audit test cases, not just management assurance: Independent repeat tests reproduce control behavior and deviations generate substantiated findings.

Incorrect Answers

A:

This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. In this case: An external provider claims prompt injection is mitigated without permitting a scoped negative tool-call test.

C:

This option concerns Audit data completeness and reconciliation, which is a related but different AI governance concern. For this situation: An external provider claims prompt injection is mitigated without permitting a scoped negative tool-call test.

D:

It misses the key control principle: Control operation is better evidenced by observed outcomes and reproducible test steps than management assertions.

Question 1057

A risk-based audit engagement examines this operating condition: A financial model's decision log is editable by developers and no changes are recorded. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Collect timestamped evidence with integrity protection, authorized access and traceable provenance.
  2. Define the AI audit universe and scope using use-case impact, third parties, control reliance and key risk scenarios.
  3. Assume a spreadsheet exported by the system owner is immutable proof of past model decisions.
  4. Reconcile source populations, failed records, joins and transformations before interpreting AI audit analytics.

Explanation

Correct Answer

A:

The reason it is necessary is: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change. The acceptable verified outcome is: A sampled decision and intervention sequence can be reconstructed from tamper-evident records.

Incorrect Answers

B:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. It does not establish control effectiveness for Immutable AI decision audit trail and provenance.

C:

This attractive shortcut does not resolve the Immutable AI decision audit trail and provenance weakness: Assume a spreadsheet exported by the system owner is immutable proof of past model decisions.

D:

This option concerns Audit data completeness and reconciliation, which is a related but different AI governance concern. It does not establish control effectiveness for Immutable AI decision audit trail and provenance.

Question 1058

An audit committee asks for a defensible assessment of this situation: A financial model's decision log is editable by developers and no changes are recorded. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. Evidence handling must protect confidentiality and integrity while maintaining the ability to demonstrate provenance.
  2. Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change.
  3. Assume a spreadsheet exported by the system owner is immutable proof of past model decisions.
  4. Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound.

Explanation

Correct Answer

B:

The acceptable verified outcome is: A sampled decision and intervention sequence can be reconstructed from tamper-evident records. This is the applicable AI audit principle for Immutable AI decision audit trail and provenance: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change.

Incorrect Answers

A:

This option concerns Chain of custody for sensitive AI audit extracts, which is a related but different AI governance concern. It does not establish control effectiveness for Immutable AI decision audit trail and provenance.

C:

This attractive shortcut does not resolve the Immutable AI decision audit trail and provenance weakness: Assume a spreadsheet exported by the system owner is immutable proof of past model decisions. For this situation: A financial model's decision log is editable by developers and no changes are recorded.

D:

This option concerns Model version and retrieval evidence preservation, which is a related but different AI governance concern. It does not establish control effectiveness for Immutable AI decision audit trail and provenance.

Question 1059

During an AI controls assessment, the team learns that a financial model's decision log is editable by developers and no changes are recorded. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence.
  2. Inspect audit program, control objectives, regulatory applicability, measurements and management agreement on criteria.
  3. Inspect audit log access, integrity hash or signing, clock synchronization, record linkage and retention.
  4. Assume a spreadsheet exported by the system owner is immutable proof of past model decisions.

Explanation

Correct Answer

C:

The reason it is necessary is: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change. In this case: A financial model's decision log is editable by developers and no changes are recorded.

Incorrect Answers

A:

This option concerns Reproducible audit data transformations, which is a related but different AI governance concern. It does not establish control effectiveness for Immutable AI decision audit trail and provenance.

B:

This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. It does not establish control effectiveness for Immutable AI decision audit trail and provenance.

D:

This attractive shortcut does not resolve the Immutable AI decision audit trail and provenance weakness: Assume a spreadsheet exported by the system owner is immutable proof of past model decisions. The auditor should instead examine: Inspect audit log access, integrity hash or signing, clock synchronization, record linkage and retention.

Question 1060

An independent AI auditor reviews this case: A financial model's decision log is editable by developers and no changes are recorded. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Define objective risk-based audit criteria from approved organizational policies, relevant standards and applicable law.
  2. Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions.
  3. Collect timestamped evidence with integrity protection, authorized access and traceable provenance.
  4. Assume a spreadsheet exported by the system owner is immutable proof of past model decisions.
  5. Inspect audit log access, integrity hash or signing, clock synchronization, record linkage and retention.

Explanation

Correct Answers

C:

This response fits the risk associated with Immutable AI decision audit trail and provenance: Collect timestamped evidence with integrity protection, authorized access and traceable provenance.

E:

The reason it is necessary is: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change. For this situation: A financial model's decision log is editable by developers and no changes are recorded.

Incorrect Answers

A:

This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. For this situation: A financial model's decision log is editable by developers and no changes are recorded.

B:

This option concerns Evidence sufficiency when source model is inaccessible, which is a related but different AI governance concern. It does not establish control effectiveness for Immutable AI decision audit trail and provenance.

D:

This attractive shortcut does not resolve the Immutable AI decision audit trail and provenance weakness: Assume a spreadsheet exported by the system owner is immutable proof of past model decisions. Effective closure requires: A sampled decision and intervention sequence can be reconstructed from tamper-evident records.

ISACA Advanced in AI Audit (AAIA) Practice Tests