Isaca AAIA Practice Test 115
Question 1140
An independent AI auditor reviews this case: An internal auditor accepts an AI anomaly detector's score as evidence of financial misstatement. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Use context-aware segment and time analysis with corroboration, uncertainty and appropriate baseline comparisons.
- Review challenge samples, model changes, error rates, reviewer overrides and data privacy restrictions.
- Treat a high AI confidence score as a substitute for independent audit evidence.
- Validate audit-tool outputs against independent truth, monitor drift and use human judgment for material findings.
- Inspect row counts, independent totals, missing keys, excluded statuses and transformation logs.
Explanation
Correct Answers
B:The reason it is necessary is: AI in the audit process introduces its own reliability and confidentiality risks that must be controlled. For this situation: An internal auditor accepts an AI anomaly detector's score as evidence of financial misstatement.
D:The reason it is necessary is: AI in the audit process introduces its own reliability and confidentiality risks that must be controlled. This response fits the risk associated with Validation of AI-enabled audit analytics tools: Validate audit-tool outputs against independent truth, monitor drift and use human judgment for material findings.
Incorrect Answers
A:This option concerns Audit analytics drift and anomalous trend interpretation, which is a related but different AI governance concern. A proportionate response is: Validate audit-tool outputs against independent truth, monitor drift and use human judgment for material findings.
C:The auditor should instead examine: Review challenge samples, model changes, error rates, reviewer overrides and data privacy restrictions.
E:This option concerns Audit data completeness and reconciliation, which is a related but different AI governance concern. The audit must corroborate: Review challenge samples, model changes, error rates, reviewer overrides and data privacy restrictions.
Question 1141
A governance and assurance review uncovers the following: Two auditors obtain different fairness rates because each uses a different definition of a denied application. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Define the AI audit universe and scope using use-case impact, third parties, control reliance and key risk scenarios.
- Change data filters manually until reported metrics match management expectations without preserving steps.
- Define objective risk-based audit criteria from approved organizational policies, relevant standards and applicable law.
- Document reproducible extraction, definitions, feature joins, calculations and review of exceptions.
Explanation
Correct Answer
D:Independent audit evidence includes: Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence. In this case: Two auditors obtain different fairness rates because each uses a different definition of a denied application.
Incorrect Answers
A:This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. It does not establish control effectiveness for Reproducible audit data transformations.
B:This attractive shortcut does not resolve the Reproducible audit data transformations weakness: Change data filters manually until reported metrics match management expectations without preserving steps.
C:This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. It does not establish control effectiveness for Reproducible audit data transformations.
Question 1142
A risk-based audit engagement examines this operating condition: Two auditors obtain different fairness rates because each uses a different definition of a denied application. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Control operation is better evidenced by observed outcomes and reproducible test steps than management assertions.
- Reliable audit analytics depend on traceable transformations, not merely attractive final charts.
- Audit scope must follow enterprise AI exposure, not only visible software projects or infrastructure boundaries.
- Change data filters manually until reported metrics match management expectations without preserving steps.
Explanation
Correct Answer
B:Independent audit evidence includes: Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence. The corrective action is: Document reproducible extraction, definitions, feature joins, calculations and review of exceptions.
Incorrect Answers
A:This option concerns Reperformance and adversarial audit test cases, which is a related but different AI governance concern. It does not establish control effectiveness for Reproducible audit data transformations.
C:This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. For this situation: Two auditors obtain different fairness rates because each uses a different definition of a denied application.
D:This attractive shortcut does not resolve the Reproducible audit data transformations weakness: Change data filters manually until reported metrics match management expectations without preserving steps. For this situation: Two auditors obtain different fairness rates because each uses a different definition of a denied application.
Question 1143
An audit committee asks for a defensible assessment of this situation: Two auditors obtain different fairness rates because each uses a different definition of a denied application. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect audit program, control objectives, regulatory applicability, measurements and management agreement on criteria.
- Change data filters manually until reported metrics match management expectations without preserving steps.
- Inspect seasonality, cohort mix, outliers, confidence intervals, drift metrics and independent transactions.
- Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence.
Explanation
Correct Answer
D:The corrective action is: Document reproducible extraction, definitions, feature joins, calculations and review of exceptions. In this case: Two auditors obtain different fairness rates because each uses a different definition of a denied application.
Incorrect Answers
A:This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. For this situation: Two auditors obtain different fairness rates because each uses a different definition of a denied application.
B:This attractive shortcut does not resolve the Reproducible audit data transformations weakness: Change data filters manually until reported metrics match management expectations without preserving steps. The auditor should instead examine: Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence.
C:This option concerns Audit analytics drift and anomalous trend interpretation, which is a related but different AI governance concern. It does not establish control effectiveness for Reproducible audit data transformations.
Question 1144
During an AI controls assessment, the team learns that two auditors obtain different fairness rates because each uses a different definition of a denied application. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Audit analytics identify defensible exceptions while avoiding unsupported causal and discriminatory conclusions.
- Validated tool results improve audit efficiency without unreviewed false conclusions or hidden omissions.
- Change data filters manually until reported metrics match management expectations without preserving steps.
- A second reviewer reproduces key findings from the recorded inputs and processing logic.
Explanation
Correct Answer
D:Independent audit evidence includes: Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence. This is an observable validation result for Reproducible audit data transformations, not just management assurance: A second reviewer reproduces key findings from the recorded inputs and processing logic.
Incorrect Answers
A:This option concerns Audit analytics drift and anomalous trend interpretation, which is a related but different AI governance concern. For this situation: Two auditors obtain different fairness rates because each uses a different definition of a denied application.
B:This option concerns Validation of AI-enabled audit analytics tools, which is a related but different AI governance concern. It does not establish control effectiveness for Reproducible audit data transformations.
C:This attractive shortcut does not resolve the Reproducible audit data transformations weakness: Change data filters manually until reported metrics match management expectations without preserving steps. Effective closure requires: A second reviewer reproduces key findings from the recorded inputs and processing logic.
Question 1145
An independent AI auditor reviews this case: An AI audit recalculates model accuracy using a changed label table with no version control. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Reperform representative positive and negative controls using independently selected inputs and authorized challenge procedures.
- Define the AI audit universe and scope using use-case impact, third parties, control reliance and key risk scenarios.
- Document reproducible extraction, definitions, feature joins, calculations and review of exceptions.
- Change data filters manually until reported metrics match management expectations without preserving steps.
Explanation
Correct Answer
C:Independent audit evidence includes: Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence. This is the proportionate control response to Reproducible audit data transformations: Document reproducible extraction, definitions, feature joins, calculations and review of exceptions.
Incorrect Answers
A:This option concerns Reperformance and adversarial audit test cases, which is a related but different AI governance concern. The audit must corroborate: Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence.
B:This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. The audit must corroborate: Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence.
D:This attractive shortcut does not resolve the Reproducible audit data transformations weakness: Change data filters manually until reported metrics match management expectations without preserving steps. In this case: An AI audit recalculates model accuracy using a changed label table with no version control.
Question 1146
A governance and assurance review uncovers the following: An AI audit recalculates model accuracy using a changed label table with no version control. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Incomplete populations and silent joins can bias control effectiveness conclusions.
- Change data filters manually until reported metrics match management expectations without preserving steps.
- Reliable audit analytics depend on traceable transformations, not merely attractive final charts.
- AI in the audit process introduces its own reliability and confidentiality risks that must be controlled.
Explanation
Correct Answer
C:Independent audit evidence includes: Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence. The acceptable verified outcome is: A second reviewer reproduces key findings from the recorded inputs and processing logic.
Incorrect Answers
A:This option concerns Audit data completeness and reconciliation, which is a related but different AI governance concern. It does not establish control effectiveness for Reproducible audit data transformations.
B:This attractive shortcut does not resolve the Reproducible audit data transformations weakness: Change data filters manually until reported metrics match management expectations without preserving steps. For this situation: An AI audit recalculates model accuracy using a changed label table with no version control.
D:This option concerns Validation of AI-enabled audit analytics tools, which is a related but different AI governance concern. The audit must corroborate: Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence.
Question 1147
A risk-based audit engagement examines this operating condition: An AI audit recalculates model accuracy using a changed label table with no version control. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect audit program, control objectives, regulatory applicability, measurements and management agreement on criteria.
- Change data filters manually until reported metrics match management expectations without preserving steps.
- Reconcile AI inventory, data flows, business ownership, complaints, material incidents and risk appetite to audit plan.
- Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence.
Explanation
Correct Answer
D:The corrective action is: Document reproducible extraction, definitions, feature joins, calculations and review of exceptions. This evidence directly tests the asserted control for Reproducible audit data transformations: Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence.
Incorrect Answers
A:This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. The audit must corroborate: Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence.
B:This attractive shortcut does not resolve the Reproducible audit data transformations weakness: Change data filters manually until reported metrics match management expectations without preserving steps. It misses the key control principle: Reliable audit analytics depend on traceable transformations, not merely attractive final charts.
C:This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. For this situation: An AI audit recalculates model accuracy using a changed label table with no version control.
Question 1148
An audit committee asks for a defensible assessment of this situation: An AI audit recalculates model accuracy using a changed label table with no version control. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- A second reviewer reproduces key findings from the recorded inputs and processing logic.
- Workpapers map each issue to an explicit criterion, condition, cause, consequence and evidence.
- Change data filters manually until reported metrics match management expectations without preserving steps.
- Independent repeat tests reproduce control behavior and deviations generate substantiated findings.
Explanation
Correct Answer
A:Independent audit evidence includes: Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence. In this case: An AI audit recalculates model accuracy using a changed label table with no version control.
Incorrect Answers
B:This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. For this situation: An AI audit recalculates model accuracy using a changed label table with no version control.
C:This attractive shortcut does not resolve the Reproducible audit data transformations weakness: Change data filters manually until reported metrics match management expectations without preserving steps. Document reproducible extraction, definitions, feature joins, calculations and review of exceptions.
D:This option concerns Reperformance and adversarial audit test cases, which is a related but different AI governance concern. For this situation: An AI audit recalculates model accuracy using a changed label table with no version control.
Question 1149
During an AI controls assessment, the team learns that an analysis spreadsheet silently filters out null values and the reviewer cannot replicate the reported KPI. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Document reproducible extraction, definitions, feature joins, calculations and review of exceptions.
- Change data filters manually until reported metrics match management expectations without preserving steps.
- Validate audit-tool outputs against independent truth, monitor drift and use human judgment for material findings.
- Use approved AI tools for planning with data safeguards, transparent criteria, independent review and reproducible output.
Explanation
Correct Answer
A:Independent audit evidence includes: Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence. In this case: An analysis spreadsheet silently filters out null values and the reviewer cannot replicate the reported KPI.
Incorrect Answers
B:This attractive shortcut does not resolve the Reproducible audit data transformations weakness: Change data filters manually until reported metrics match management expectations without preserving steps. In this case: An analysis spreadsheet silently filters out null values and the reviewer cannot replicate the reported KPI.
C:This option concerns Validation of AI-enabled audit analytics tools, which is a related but different AI governance concern. In this case: An analysis spreadsheet silently filters out null values and the reviewer cannot replicate the reported KPI.
D:This option concerns Using AI during audit engagement planning, which is a related but different AI governance concern. It does not establish control effectiveness for Reproducible audit data transformations.
Question 1150
An independent AI auditor reviews this case: An analysis spreadsheet silently filters out null values and the reviewer cannot replicate the reported KPI. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Inspect approved tool use, input sensitivity, model version, generated risk ranking and reviewer corrections.
- Reperform representative positive and negative controls using independently selected inputs and authorized challenge procedures.
- Document reproducible extraction, definitions, feature joins, calculations and review of exceptions.
- Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence.
- Change data filters manually until reported metrics match management expectations without preserving steps.
Explanation
Correct Answers
C:Independent audit evidence includes: Inspect query code, data hashes, metric definitions, source versions, filters and rerun evidence. For this situation: An analysis spreadsheet silently filters out null values and the reviewer cannot replicate the reported KPI.
D:The corrective action is: Document reproducible extraction, definitions, feature joins, calculations and review of exceptions. In this case: An analysis spreadsheet silently filters out null values and the reviewer cannot replicate the reported KPI.
Incorrect Answers
A:This option concerns Using AI during audit engagement planning, which is a related but different AI governance concern. For this situation: An analysis spreadsheet silently filters out null values and the reviewer cannot replicate the reported KPI.
B:This option concerns Reperformance and adversarial audit test cases, which is a related but different AI governance concern. In this case: An analysis spreadsheet silently filters out null values and the reviewer cannot replicate the reported KPI.
E:This attractive shortcut does not resolve the Reproducible audit data transformations weakness: Change data filters manually until reported metrics match management expectations without preserving steps. For this situation: An analysis spreadsheet silently filters out null values and the reviewer cannot replicate the reported KPI.
