cert
cert-1
cert-2

Pass Isaca AAIA Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AAIA Exam - Verified By Experts
AAIA Premium Bundle
$14.99

AAIA Premium Bundle

$74.99
$89.98
  • Premium File 556 Questions & Answers. Last update: Nov 08, 2026
  • Training Course 110 Video Lectures
 
$89.98
$74.99
accept 22 downloads in last 7 days
block-screenshots
Purchase Isaca AAIA Exam Training Products Individually
Isaca AAIA Premium File
Premium File 556 Q&A
$76.99$69.99
Isaca AAIA Video Training Course
Training Course 110 Lectures
$21.99 $19.99
Isaca AAIA Practice Test 107

Question 1060

An independent AI auditor reviews this case: A financial model's decision log is editable by developers and no changes are recorded. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Define objective risk-based audit criteria from approved organizational policies, relevant standards and applicable law.
  2. Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions.
  3. Collect timestamped evidence with integrity protection, authorized access and traceable provenance.
  4. Assume a spreadsheet exported by the system owner is immutable proof of past model decisions.
  5. Inspect audit log access, integrity hash or signing, clock synchronization, record linkage and retention.

Explanation

Correct Answers

C:

This response fits the risk associated with Immutable AI decision audit trail and provenance: Collect timestamped evidence with integrity protection, authorized access and traceable provenance.

E:

The reason it is necessary is: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change. For this situation: A financial model's decision log is editable by developers and no changes are recorded.

Incorrect Answers

A:

This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. For this situation: A financial model's decision log is editable by developers and no changes are recorded.

B:

This option concerns Evidence sufficiency when source model is inaccessible, which is a related but different AI governance concern. It does not establish control effectiveness for Immutable AI decision audit trail and provenance.

D:

This attractive shortcut does not resolve the Immutable AI decision audit trail and provenance weakness: Assume a spreadsheet exported by the system owner is immutable proof of past model decisions. Effective closure requires: A sampled decision and intervention sequence can be reconstructed from tamper-evident records.

Question 1061

A governance and assurance review uncovers the following: An AI support system's historical tool-call receipts are overwritten when its database rotates. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Collect timestamped evidence with integrity protection, authorized access and traceable provenance.
  2. Document reproducible extraction, definitions, feature joins, calculations and review of exceptions.
  3. Assume a spreadsheet exported by the system owner is immutable proof of past model decisions.
  4. Triangulate available independent evidence and document unresolved access limitations instead of overstating assurance.

Explanation

Correct Answer

A:

The reason it is necessary is: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change. This is the proportionate control response to Immutable AI decision audit trail and provenance: Collect timestamped evidence with integrity protection, authorized access and traceable provenance.

Incorrect Answers

B:

This option concerns Reproducible audit data transformations, which is a related but different AI governance concern. The decisive principle here is: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change.

C:

This attractive shortcut does not resolve the Immutable AI decision audit trail and provenance weakness: Assume a spreadsheet exported by the system owner is immutable proof of past model decisions. In this case: An AI support system's historical tool-call receipts are overwritten when its database rotates.

D:

This option concerns Evidence sufficiency when source model is inaccessible, which is a related but different AI governance concern. The decisive principle here is: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change.

Question 1062

A risk-based audit engagement examines this operating condition: An AI support system's historical tool-call receipts are overwritten when its database rotates. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change.
  2. Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound.
  3. Assume a spreadsheet exported by the system owner is immutable proof of past model decisions.
  4. Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference.

Explanation

Correct Answer

A:

The acceptable verified outcome is: A sampled decision and intervention sequence can be reconstructed from tamper-evident records. Independent audit evidence includes: Inspect audit log access, integrity hash or signing, clock synchronization, record linkage and retention.

Incorrect Answers

B:

This option concerns Model version and retrieval evidence preservation, which is a related but different AI governance concern. The decisive principle here is: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change.

C:

This attractive shortcut does not resolve the Immutable AI decision audit trail and provenance weakness: Assume a spreadsheet exported by the system owner is immutable proof of past model decisions. For this situation: An AI support system's historical tool-call receipts are overwritten when its database rotates.

D:

This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. The decisive principle here is: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change.

Question 1063

An audit committee asks for a defensible assessment of this situation: An AI support system's historical tool-call receipts are overwritten when its database rotates. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Inspect audit log access, integrity hash or signing, clock synchronization, record linkage and retention.
  2. Inspect row counts, independent totals, missing keys, excluded statuses and transformation logs.
  3. Assume a spreadsheet exported by the system owner is immutable proof of past model decisions.
  4. Reconcile AI inventory, data flows, business ownership, complaints, material incidents and risk appetite to audit plan.

Explanation

Correct Answer

A:

The reason it is necessary is: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change. This evidence directly tests the asserted control for Immutable AI decision audit trail and provenance: Inspect audit log access, integrity hash or signing, clock synchronization, record linkage and retention.

Incorrect Answers

B:

This option concerns Audit data completeness and reconciliation, which is a related but different AI governance concern. The decisive principle here is: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change.

C:

This attractive shortcut does not resolve the Immutable AI decision audit trail and provenance weakness: Assume a spreadsheet exported by the system owner is immutable proof of past model decisions. Collect timestamped evidence with integrity protection, authorized access and traceable provenance.

D:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. The decisive principle here is: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change.

Question 1064

During an AI controls assessment, the team learns that an AI support system's historical tool-call receipts are overwritten when its database rotates. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. Assume a spreadsheet exported by the system owner is immutable proof of past model decisions.
  2. A sampled decision and intervention sequence can be reconstructed from tamper-evident records.
  3. Workpapers map each issue to an explicit criterion, condition, cause, consequence and evidence.
  4. The plan covers material high-risk deployments and states documented scope boundaries and assurance limitations.

Explanation

Correct Answer

B:

The reason it is necessary is: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change. This is an observable validation result for Immutable AI decision audit trail and provenance, not just management assurance: A sampled decision and intervention sequence can be reconstructed from tamper-evident records.

Incorrect Answers

A:

It misses the key control principle: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change.

C:

This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. For this situation: An AI support system's historical tool-call receipts are overwritten when its database rotates.

D:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. For this situation: An AI support system's historical tool-call receipts are overwritten when its database rotates.

Question 1065

An independent AI auditor reviews this case: A hospital can retrieve model outputs but cannot establish when inputs or human overrides were modified. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Triangulate available independent evidence and document unresolved access limitations instead of overstating assurance.
  2. Assume a spreadsheet exported by the system owner is immutable proof of past model decisions.
  3. Capture model and prompt versions, retrieval sources, seeds where relevant and external state for reproducible testing.
  4. Collect timestamped evidence with integrity protection, authorized access and traceable provenance.

Explanation

Correct Answer

D:

The reason it is necessary is: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change. In this case: A hospital can retrieve model outputs but cannot establish when inputs or human overrides were modified.

Incorrect Answers

A:

This option concerns Evidence sufficiency when source model is inaccessible, which is a related but different AI governance concern. In this case: A hospital can retrieve model outputs but cannot establish when inputs or human overrides were modified.

B:

This attractive shortcut does not resolve the Immutable AI decision audit trail and provenance weakness: Assume a spreadsheet exported by the system owner is immutable proof of past model decisions. In this case: A hospital can retrieve model outputs but cannot establish when inputs or human overrides were modified.

C:

This option concerns Model version and retrieval evidence preservation, which is a related but different AI governance concern. In this case: A hospital can retrieve model outputs but cannot establish when inputs or human overrides were modified.

Question 1066

A governance and assurance review uncovers the following: A hospital can retrieve model outputs but cannot establish when inputs or human overrides were modified. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. Assume a spreadsheet exported by the system owner is immutable proof of past model decisions.
  2. Reliable audit analytics depend on traceable transformations, not merely attractive final charts.
  3. Incomplete populations and silent joins can bias control effectiveness conclusions.
  4. Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change.

Explanation

Correct Answer

D:

The acceptable verified outcome is: A sampled decision and intervention sequence can be reconstructed from tamper-evident records. In this case: A hospital can retrieve model outputs but cannot establish when inputs or human overrides were modified.

Incorrect Answers

A:

This attractive shortcut does not resolve the Immutable AI decision audit trail and provenance weakness: Assume a spreadsheet exported by the system owner is immutable proof of past model decisions. For this situation: A hospital can retrieve model outputs but cannot establish when inputs or human overrides were modified.

B:

This option concerns Reproducible audit data transformations, which is a related but different AI governance concern. In this case: A hospital can retrieve model outputs but cannot establish when inputs or human overrides were modified.

C:

This option concerns Audit data completeness and reconciliation, which is a related but different AI governance concern. In this case: A hospital can retrieve model outputs but cannot establish when inputs or human overrides were modified.

Question 1067

A risk-based audit engagement examines this operating condition: A hospital can retrieve model outputs but cannot establish when inputs or human overrides were modified. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Inspect deployment identifiers, prompt hashes, retrieval snapshots, tool trace IDs and evaluation settings.
  2. Inspect audit program, control objectives, regulatory applicability, measurements and management agreement on criteria.
  3. Assume a spreadsheet exported by the system owner is immutable proof of past model decisions.
  4. Inspect audit log access, integrity hash or signing, clock synchronization, record linkage and retention.

Explanation

Correct Answer

D:

The reason it is necessary is: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change. The corrective action is: Collect timestamped evidence with integrity protection, authorized access and traceable provenance.

Incorrect Answers

A:

This option concerns Model version and retrieval evidence preservation, which is a related but different AI governance concern. For this situation: A hospital can retrieve model outputs but cannot establish when inputs or human overrides were modified.

B:

This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. In this case: A hospital can retrieve model outputs but cannot establish when inputs or human overrides were modified.

C:

For this situation: A hospital can retrieve model outputs but cannot establish when inputs or human overrides were modified.

Question 1068

An audit committee asks for a defensible assessment of this situation: A hospital can retrieve model outputs but cannot establish when inputs or human overrides were modified. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. Workpapers map each issue to an explicit criterion, condition, cause, consequence and evidence.
  2. Auditors can reproduce or defensibly explain a decision with known context and documented stochastic limits.
  3. A sampled decision and intervention sequence can be reconstructed from tamper-evident records.
  4. Assume a spreadsheet exported by the system owner is immutable proof of past model decisions.

Explanation

Correct Answer

C:

The reason it is necessary is: Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change. Independent audit evidence includes: Inspect audit log access, integrity hash or signing, clock synchronization, record linkage and retention.

Incorrect Answers

A:

This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. For this situation: A hospital can retrieve model outputs but cannot establish when inputs or human overrides were modified.

B:

This option concerns Model version and retrieval evidence preservation, which is a related but different AI governance concern. The audit must corroborate: Inspect audit log access, integrity hash or signing, clock synchronization, record linkage and retention.

D:

The auditor should instead examine: Inspect audit log access, integrity hash or signing, clock synchronization, record linkage and retention.

Question 1069

During an AI controls assessment, the team learns that an AI auditor copies patient prompts into an unrestricted collaboration folder during evidence collection. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Define objective risk-based audit criteria from approved organizational policies, relevant standards and applicable law.
  2. Email unredacted extracts broadly and rely on filename similarity to establish forensic identity.
  3. Capture model and prompt versions, retrieval sources, seeds where relevant and external state for reproducible testing.
  4. Preserve evidence chain of custody, minimize personal data and verify controlled analytical copies.

Explanation

Correct Answer

D:

The reason it is necessary is: Evidence handling must protect confidentiality and integrity while maintaining the ability to demonstrate provenance. Independent audit evidence includes: Inspect acquisition records, file hashes, access log, transfer receipts and approved retention/destruction.

Incorrect Answers

A:

This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. It does not establish control effectiveness for Chain of custody for sensitive AI audit extracts.

B:

This attractive shortcut does not resolve the Chain of custody for sensitive AI audit extracts weakness: Email unredacted extracts broadly and rely on filename similarity to establish forensic identity.

C:

This option concerns Model version and retrieval evidence preservation, which is a related but different AI governance concern. It does not establish control effectiveness for Chain of custody for sensitive AI audit extracts.

Question 1070

An independent AI auditor reviews this case: An AI auditor copies patient prompts into an unrestricted collaboration folder during evidence collection. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Collect timestamped evidence with integrity protection, authorized access and traceable provenance.
  2. Preserve evidence chain of custody, minimize personal data and verify controlled analytical copies.
  3. Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions.
  4. Email unredacted extracts broadly and rely on filename similarity to establish forensic identity.
  5. Inspect acquisition records, file hashes, access log, transfer receipts and approved retention/destruction.

Explanation

Correct Answers

B:

The reason it is necessary is: Evidence handling must protect confidentiality and integrity while maintaining the ability to demonstrate provenance. This response fits the risk associated with Chain of custody for sensitive AI audit extracts: Preserve evidence chain of custody, minimize personal data and verify controlled analytical copies.

E:

The reason it is necessary is: Evidence handling must protect confidentiality and integrity while maintaining the ability to demonstrate provenance. This evidence directly tests the asserted control for Chain of custody for sensitive AI audit extracts: Inspect acquisition records, file hashes, access log, transfer receipts and approved retention/destruction.

Incorrect Answers

A:

This option concerns Immutable AI decision audit trail and provenance, which is a related but different AI governance concern. It does not establish control effectiveness for Chain of custody for sensitive AI audit extracts.

C:

This option concerns Evidence sufficiency when source model is inaccessible, which is a related but different AI governance concern. It does not establish control effectiveness for Chain of custody for sensitive AI audit extracts.

D:

This attractive shortcut does not resolve the Chain of custody for sensitive AI audit extracts weakness: Email unredacted extracts broadly and rely on filename similarity to establish forensic identity. The auditor should instead examine: Inspect acquisition records, file hashes, access log, transfer receipts and approved retention/destruction.

ISACA Advanced in AI Audit (AAIA) Practice Tests