Isaca AAIA Practice Test 11
Question 100
An independent AI auditor reviews this case: A risk committee approves an AI claims engine but cannot name who can accept residual model risk or suspend it. Which THREE elements together provide a defensible AI audit conclusion: the corrective control, the evidence to test it, and a verified outcome? Select THREE answers.
- Review RACI, committee charters, risk decisions, escalation records, owner acceptance and audit independence.
- Assign decision rights and responsibilities for design, operation, risk acceptance, independent challenge and remediation.
- Review classification methodology, autonomy and data sensitivity, impact scoring, approval records and reclassification triggers.
- A significant AI issue has a named accountable owner, documented decision and independent audit challenge.
- Maintain a current AI system inventory covering owned, procured and embedded capabilities, data flows, owners and criticality.
- Assume assigning every AI issue to the IT department removes management responsibility for business outcomes.
Explanation
Correct Answers
A:The reason it is necessary is: Accountability requires named authorities with escalation and separation between control operation and independent assurance. For this situation: A risk committee approves an AI claims engine but cannot name who can accept residual model risk or suspend it.
B:The reason it is necessary is: Accountability requires named authorities with escalation and separation between control operation and independent assurance. This response fits the risk associated with Accountable ownership and three-lines roles: Assign decision rights and responsibilities for design, operation, risk acceptance, independent challenge and remediation.
D:The reason it is necessary is: Accountability requires named authorities with escalation and separation between control operation and independent assurance. This is an observable validation result for Accountable ownership and three-lines roles, not just management assurance: A significant AI issue has a named accountable owner, documented decision and independent audit challenge.
Incorrect Answers
C:This option concerns Risk-tiering and proportional approval gates, which is a related but different AI governance concern. For this situation: A risk committee approves an AI claims engine but cannot name who can accept residual model risk or suspend it.
E:This option concerns Enterprise AI inventory and shadow-AI discovery, which is a related but different AI governance concern. It does not establish control effectiveness for Accountable ownership and three-lines roles.
F:This attractive shortcut does not resolve the Accountable ownership and three-lines roles weakness: Assume assigning every AI issue to the IT department removes management responsibility for business outcomes. Assign decision rights and responsibilities for design, operation, risk acceptance, independent challenge and remediation.
Question 101
A governance and assurance review uncovers the following: Data scientists develop an underwriting model while operations and legal each assume the other owns customer remediation. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Deliver role-specific AI awareness, secure-use guidance and tested escalation exercises matched to real work.
- Assume assigning every AI issue to the IT department removes management responsibility for business outcomes.
- Align risk indicators, incidents and performance results to explicit appetite thresholds and accountable board decisions.
- Assign decision rights and responsibilities for design, operation, risk acceptance, independent challenge and remediation.
Explanation
Correct Answer
D:The reason it is necessary is: Accountability requires named authorities with escalation and separation between control operation and independent assurance. Independent audit evidence includes: Review RACI, committee charters, risk decisions, escalation records, owner acceptance and audit independence.
Incorrect Answers
A:This option concerns AI workforce literacy and policy awareness, which is a related but different AI governance concern. It does not establish control effectiveness for Accountable ownership and three-lines roles.
B:This attractive shortcut does not resolve the Accountable ownership and three-lines roles weakness: Assume assigning every AI issue to the IT department removes management responsibility for business outcomes. In this case: Data scientists develop an underwriting model while operations and legal each assume the other owns customer remediation.
C:This option concerns Board reporting of AI risk appetite and outcomes, which is a related but different AI governance concern. The decisive principle here is: Accountability requires named authorities with escalation and separation between control operation and independent assurance.
Question 102
A risk-based audit engagement examines this operating condition: Data scientists develop an underwriting model while operations and legal each assume the other owns customer remediation. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations.
- Accountability requires named authorities with escalation and separation between control operation and independent assurance.
- Assume assigning every AI issue to the IT department removes management responsibility for business outcomes.
- Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements.
Explanation
Correct Answer
B:Independent audit evidence includes: Review RACI, committee charters, risk decisions, escalation records, owner acceptance and audit independence. The corrective action is: Assign decision rights and responsibilities for design, operation, risk acceptance, independent challenge and remediation.
Incorrect Answers
A:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. The decisive principle here is: Accountability requires named authorities with escalation and separation between control operation and independent assurance.
C:This attractive shortcut does not resolve the Accountable ownership and three-lines roles weakness: Assume assigning every AI issue to the IT department removes management responsibility for business outcomes. For this situation: Data scientists develop an underwriting model while operations and legal each assume the other owns customer remediation.
D:This option concerns AI policy exception governance, which is a related but different AI governance concern. The decisive principle here is: Accountability requires named authorities with escalation and separation between control operation and independent assurance.
Question 103
An audit committee asks for a defensible assessment of this situation: Data scientists develop an underwriting model while operations and legal each assume the other owns customer remediation. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Review RACI, committee charters, risk decisions, escalation records, owner acceptance and audit independence.
- Reconcile software contracts, cloud billing, SSO logs, network egress, procurement and departmental attestations to inventory entries.
- Assume assigning every AI issue to the IT department removes management responsibility for business outcomes.
- Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
Explanation
Correct Answer
A:The reason it is necessary is: Accountability requires named authorities with escalation and separation between control operation and independent assurance. The corrective action is: Assign decision rights and responsibilities for design, operation, risk acceptance, independent challenge and remediation.
Incorrect Answers
B:This option concerns Enterprise AI inventory and shadow-AI discovery, which is a related but different AI governance concern. The decisive principle here is: Accountability requires named authorities with escalation and separation between control operation and independent assurance.
C:This attractive shortcut does not resolve the Accountable ownership and three-lines roles weakness: Assume assigning every AI issue to the IT department removes management responsibility for business outcomes. Effective closure requires: A significant AI issue has a named accountable owner, documented decision and independent audit challenge.
D:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. For this situation: Data scientists develop an underwriting model while operations and legal each assume the other owns customer remediation.
Question 104
During an AI controls assessment, the team learns that data scientists develop an underwriting model while operations and legal each assume the other owns customer remediation. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- A significant AI issue has a named accountable owner, documented decision and independent audit challenge.
- Material AI uses are inventoried, risk-tiered and linked to approved business/data owners before production use.
- Assume assigning every AI issue to the IT department removes management responsibility for business outcomes.
- The supplier's controls and obligations meet use-case requirements with tested contingency and monitoring.
Explanation
Correct Answer
A:The reason it is necessary is: Accountability requires named authorities with escalation and separation between control operation and independent assurance. In this case: Data scientists develop an underwriting model while operations and legal each assume the other owns customer remediation.
Incorrect Answers
B:This option concerns Enterprise AI inventory and shadow-AI discovery, which is a related but different AI governance concern. For this situation: Data scientists develop an underwriting model while operations and legal each assume the other owns customer remediation.
C:For this situation: Data scientists develop an underwriting model while operations and legal each assume the other owns customer remediation.
D:This option concerns Third-party foundation model procurement assurance, which is a related but different AI governance concern. It does not establish control effectiveness for Accountable ownership and three-lines roles.
Question 105
An independent AI auditor reviews this case: A board receives AI dashboards without a defined management process for translating red flags into control decisions. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Assign decision rights and responsibilities for design, operation, risk acceptance, independent challenge and remediation.
- Maintain a current AI system inventory covering owned, procured and embedded capabilities, data flows, owners and criticality.
- Assume assigning every AI issue to the IT department removes management responsibility for business outcomes.
- Assess vendor control evidence, data handling, change notification, subcontractors, portability and remedies before acceptance.
Explanation
Correct Answer
A:The reason it is necessary is: Accountability requires named authorities with escalation and separation between control operation and independent assurance. In this case: A board receives AI dashboards without a defined management process for translating red flags into control decisions.
Incorrect Answers
B:This option concerns Enterprise AI inventory and shadow-AI discovery, which is a related but different AI governance concern. In this case: A board receives AI dashboards without a defined management process for translating red flags into control decisions.
C:This attractive shortcut does not resolve the Accountable ownership and three-lines roles weakness: Assume assigning every AI issue to the IT department removes management responsibility for business outcomes. In this case: A board receives AI dashboards without a defined management process for translating red flags into control decisions.
D:This option concerns Third-party foundation model procurement assurance, which is a related but different AI governance concern. The decisive principle here is: Accountability requires named authorities with escalation and separation between control operation and independent assurance.
Question 106
A governance and assurance review uncovers the following: A board receives AI dashboards without a defined management process for translating red flags into control decisions. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Risk-based governance calibrates scrutiny to potential consequences and does not equate every AI feature.
- Assume assigning every AI issue to the IT department removes management responsibility for business outcomes.
- Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations.
- Accountability requires named authorities with escalation and separation between control operation and independent assurance.
Explanation
Correct Answer
D:Independent audit evidence includes: Review RACI, committee charters, risk decisions, escalation records, owner acceptance and audit independence. In this case: A board receives AI dashboards without a defined management process for translating red flags into control decisions.
Incorrect Answers
A:This option concerns Risk-tiering and proportional approval gates, which is a related but different AI governance concern. The decisive principle here is: Accountability requires named authorities with escalation and separation between control operation and independent assurance.
B:This attractive shortcut does not resolve the Accountable ownership and three-lines roles weakness: Assume assigning every AI issue to the IT department removes management responsibility for business outcomes. For this situation: A board receives AI dashboards without a defined management process for translating red flags into control decisions.
C:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. In this case: A board receives AI dashboards without a defined management process for translating red flags into control decisions.
Question 107
A risk-based audit engagement examines this operating condition: A board receives AI dashboards without a defined management process for translating red flags into control decisions. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect training role coverage, job-specific examples, scenario test scores and observed policy violations.
- Assume assigning every AI issue to the IT department removes management responsibility for business outcomes.
- Compare approved risk appetite, model-level KRIs, customer impact metrics, exceptions and board action minutes.
- Review RACI, committee charters, risk decisions, escalation records, owner acceptance and audit independence.
Explanation
Correct Answer
D:The reason it is necessary is: Accountability requires named authorities with escalation and separation between control operation and independent assurance. The acceptable verified outcome is: A significant AI issue has a named accountable owner, documented decision and independent audit challenge.
Incorrect Answers
A:This option concerns AI workforce literacy and policy awareness, which is a related but different AI governance concern. The decisive principle here is: Accountability requires named authorities with escalation and separation between control operation and independent assurance.
B:For this situation: A board receives AI dashboards without a defined management process for translating red flags into control decisions.
C:This option concerns Board reporting of AI risk appetite and outcomes, which is a related but different AI governance concern. In this case: A board receives AI dashboards without a defined management process for translating red flags into control decisions.
Question 108
An audit committee asks for a defensible assessment of this situation: A board receives AI dashboards without a defined management process for translating red flags into control decisions. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Assume assigning every AI issue to the IT department removes management responsibility for business outcomes.
- Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives.
- The supplier's controls and obligations meet use-case requirements with tested contingency and monitoring.
- A significant AI issue has a named accountable owner, documented decision and independent audit challenge.
Explanation
Correct Answer
D:This is an observable validation result for Accountable ownership and three-lines roles, not just management assurance: A significant AI issue has a named accountable owner, documented decision and independent audit challenge.
Incorrect Answers
A:It misses the key control principle: Accountability requires named authorities with escalation and separation between control operation and independent assurance.
B:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. For this situation: A board receives AI dashboards without a defined management process for translating red flags into control decisions.
C:This option concerns Third-party foundation model procurement assurance, which is a related but different AI governance concern. For this situation: A board receives AI dashboards without a defined management process for translating red flags into control decisions.
Question 109
During an AI controls assessment, the team learns that a product team bypasses an approved AI data classification rule by repeatedly filing indefinite informal exceptions. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Require time-bound exception approvals, explicit risk ownership, compensating measures and periodic review.
- Maintain a current AI system inventory covering owned, procured and embedded capabilities, data flows, owners and criticality.
- Map accountable GOVERN processes, context under MAP, evidence-based MEASURE and decisions under MANAGE without mischaracterizing voluntary guidance.
- Treat a verbal business sponsor request as permanent authorization to ignore AI controls.
Explanation
Correct Answer
A:The reason it is necessary is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements. The acceptable verified outcome is: Expired or high-risk exceptions are renewed through accountable approval or removed with verified closure.
Incorrect Answers
B:This option concerns Enterprise AI inventory and shadow-AI discovery, which is a related but different AI governance concern. It does not establish control effectiveness for AI policy exception governance.
C:This option concerns NIST AI RMF governance and measurement alignment, which is a related but different AI governance concern. It does not establish control effectiveness for AI policy exception governance.
D:This attractive shortcut does not resolve the AI policy exception governance weakness: Treat a verbal business sponsor request as permanent authorization to ignore AI controls.
Question 110
An independent AI auditor reviews this case: A product team bypasses an approved AI data classification rule by repeatedly filing indefinite informal exceptions. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Inspect approved exception register, justifications, expiry, control alternatives and follow-up evidence.
- Require time-bound exception approvals, explicit risk ownership, compensating measures and periodic review.
- Treat a verbal business sponsor request as permanent authorization to ignore AI controls.
- Maintain a current AI system inventory covering owned, procured and embedded capabilities, data flows, owners and criticality.
- Review classification methodology, autonomy and data sensitivity, impact scoring, approval records and reclassification triggers.
Explanation
Correct Answers
A:The reason it is necessary is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements. The corrective action is: Require time-bound exception approvals, explicit risk ownership, compensating measures and periodic review.
B:The reason it is necessary is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements. For this situation: A product team bypasses an approved AI data classification rule by repeatedly filing indefinite informal exceptions.
Incorrect Answers
C:This attractive shortcut does not resolve the AI policy exception governance weakness: Treat a verbal business sponsor request as permanent authorization to ignore AI controls. For this situation: A product team bypasses an approved AI data classification rule by repeatedly filing indefinite informal exceptions.
D:This option concerns Enterprise AI inventory and shadow-AI discovery, which is a related but different AI governance concern. The decisive principle here is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements.
E:This option concerns Risk-tiering and proportional approval gates, which is a related but different AI governance concern. It does not establish control effectiveness for AI policy exception governance.
