cert
cert-1
cert-2

Pass Isaca AAIA Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AAIA Exam - Verified By Experts
AAIA Premium Bundle
$14.99

AAIA Premium Bundle

$74.99
$89.98
  • Premium File 556 Questions & Answers. Last update: Nov 08, 2026
  • Training Course 110 Video Lectures
 
$89.98
$74.99
accept 22 downloads in last 7 days
block-screenshots
Purchase Isaca AAIA Exam Training Products Individually
Isaca AAIA Premium File
Premium File 556 Q&A
$76.99$69.99
Isaca AAIA Video Training Course
Training Course 110 Lectures
$21.99 $19.99
Isaca AAIA Practice Test 12

Question 110

An independent AI auditor reviews this case: A product team bypasses an approved AI data classification rule by repeatedly filing indefinite informal exceptions. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Inspect approved exception register, justifications, expiry, control alternatives and follow-up evidence.
  2. Require time-bound exception approvals, explicit risk ownership, compensating measures and periodic review.
  3. Treat a verbal business sponsor request as permanent authorization to ignore AI controls.
  4. Maintain a current AI system inventory covering owned, procured and embedded capabilities, data flows, owners and criticality.
  5. Review classification methodology, autonomy and data sensitivity, impact scoring, approval records and reclassification triggers.

Explanation

Correct Answers

A:

The reason it is necessary is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements. The corrective action is: Require time-bound exception approvals, explicit risk ownership, compensating measures and periodic review.

B:

The reason it is necessary is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements. For this situation: A product team bypasses an approved AI data classification rule by repeatedly filing indefinite informal exceptions.

Incorrect Answers

C:

This attractive shortcut does not resolve the AI policy exception governance weakness: Treat a verbal business sponsor request as permanent authorization to ignore AI controls. For this situation: A product team bypasses an approved AI data classification rule by repeatedly filing indefinite informal exceptions.

D:

This option concerns Enterprise AI inventory and shadow-AI discovery, which is a related but different AI governance concern. The decisive principle here is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements.

E:

This option concerns Risk-tiering and proportional approval gates, which is a related but different AI governance concern. It does not establish control effectiveness for AI policy exception governance.

Question 111

A governance and assurance review uncovers the following: A product team bypasses an approved AI data classification rule by repeatedly filing indefinite informal exceptions. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Review RACI, committee charters, risk decisions, escalation records, owner acceptance and audit independence.
  2. Treat a verbal business sponsor request as permanent authorization to ignore AI controls.
  3. Review classification methodology, autonomy and data sensitivity, impact scoring, approval records and reclassification triggers.
  4. Inspect approved exception register, justifications, expiry, control alternatives and follow-up evidence.

Explanation

Correct Answer

D:

The reason it is necessary is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements. This evidence directly tests the asserted control for AI policy exception governance: Inspect approved exception register, justifications, expiry, control alternatives and follow-up evidence.

Incorrect Answers

A:

This option concerns Accountable ownership and three-lines roles, which is a related but different AI governance concern. It does not establish control effectiveness for AI policy exception governance.

B:

This attractive shortcut does not resolve the AI policy exception governance weakness: Treat a verbal business sponsor request as permanent authorization to ignore AI controls. The auditor should instead examine: Inspect approved exception register, justifications, expiry, control alternatives and follow-up evidence.

C:

This option concerns Risk-tiering and proportional approval gates, which is a related but different AI governance concern. The decisive principle here is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements.

Question 112

A risk-based audit engagement examines this operating condition: A product team bypasses an approved AI data classification rule by repeatedly filing indefinite informal exceptions. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. Expired or high-risk exceptions are renewed through accountable approval or removed with verified closure.
  2. Material AI uses are inventoried, risk-tiered and linked to approved business/data owners before production use.
  3. Treat a verbal business sponsor request as permanent authorization to ignore AI controls.
  4. Employees handle realistic AI exceptions and know approved tools, restricted data and escalation paths.

Explanation

Correct Answer

A:

The reason it is necessary is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements. This is an observable validation result for AI policy exception governance, not just management assurance: Expired or high-risk exceptions are renewed through accountable approval or removed with verified closure.

Incorrect Answers

B:

This option concerns Enterprise AI inventory and shadow-AI discovery, which is a related but different AI governance concern. For this situation: A product team bypasses an approved AI data classification rule by repeatedly filing indefinite informal exceptions.

C:

This attractive shortcut does not resolve the AI policy exception governance weakness: Treat a verbal business sponsor request as permanent authorization to ignore AI controls. Require time-bound exception approvals, explicit risk ownership, compensating measures and periodic review.

D:

This option concerns AI workforce literacy and policy awareness, which is a related but different AI governance concern. It does not establish control effectiveness for AI policy exception governance.

Question 113

An audit committee asks for a defensible assessment of this situation: A bank allows experimental models on production customer data with no expiry or compensating controls for exception requests. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Maintain a current AI system inventory covering owned, procured and embedded capabilities, data flows, owners and criticality.
  2. Treat a verbal business sponsor request as permanent authorization to ignore AI controls.
  3. Require decision-level explanations proportionate to the use case, validated predictive benefit, documented limitations and a meaningful appeal path.
  4. Require time-bound exception approvals, explicit risk ownership, compensating measures and periodic review.

Explanation

Correct Answer

D:

The reason it is necessary is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements. In this case: A bank allows experimental models on production customer data with no expiry or compensating controls for exception requests.

Incorrect Answers

A:

This option concerns Enterprise AI inventory and shadow-AI discovery, which is a related but different AI governance concern. In this case: A bank allows experimental models on production customer data with no expiry or compensating controls for exception requests.

B:

This attractive shortcut does not resolve the AI policy exception governance weakness: Treat a verbal business sponsor request as permanent authorization to ignore AI controls. In this case: A bank allows experimental models on production customer data with no expiry or compensating controls for exception requests.

C:

This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. It does not establish control effectiveness for AI policy exception governance.

Question 114

During an AI controls assessment, the team learns that a bank allows experimental models on production customer data with no expiry or compensating controls for exception requests. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. Governance cannot assess or monitor AI risk if material use cases and external processors are unknown.
  2. Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements.
  3. Accountability requires named authorities with escalation and separation between control operation and independent assurance.
  4. Treat a verbal business sponsor request as permanent authorization to ignore AI controls.

Explanation

Correct Answer

B:

The corrective action is: Require time-bound exception approvals, explicit risk ownership, compensating measures and periodic review. The acceptable verified outcome is: Expired or high-risk exceptions are renewed through accountable approval or removed with verified closure.

Incorrect Answers

A:

This option concerns Enterprise AI inventory and shadow-AI discovery, which is a related but different AI governance concern. For this situation: A bank allows experimental models on production customer data with no expiry or compensating controls for exception requests.

C:

This option concerns Accountable ownership and three-lines roles, which is a related but different AI governance concern. The decisive principle here is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements.

D:

This attractive shortcut does not resolve the AI policy exception governance weakness: Treat a verbal business sponsor request as permanent authorization to ignore AI controls. For this situation: A bank allows experimental models on production customer data with no expiry or compensating controls for exception requests.

Question 115

An independent AI auditor reviews this case: A bank allows experimental models on production customer data with no expiry or compensating controls for exception requests. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Treat a verbal business sponsor request as permanent authorization to ignore AI controls.
  2. Inspect AI inventory, contextual risk register, model evaluations, management treatment and oversight minutes.
  3. Review classification methodology, autonomy and data sensitivity, impact scoring, approval records and reclassification triggers.
  4. Inspect approved exception register, justifications, expiry, control alternatives and follow-up evidence.

Explanation

Correct Answer

D:

The reason it is necessary is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements. Independent audit evidence includes: Inspect approved exception register, justifications, expiry, control alternatives and follow-up evidence.

Incorrect Answers

A:

This attractive shortcut does not resolve the AI policy exception governance weakness: Treat a verbal business sponsor request as permanent authorization to ignore AI controls. Effective closure requires: Expired or high-risk exceptions are renewed through accountable approval or removed with verified closure.

B:

This option concerns NIST AI RMF governance and measurement alignment, which is a related but different AI governance concern. The decisive principle here is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements.

C:

This option concerns Risk-tiering and proportional approval gates, which is a related but different AI governance concern. In this case: A bank allows experimental models on production customer data with no expiry or compensating controls for exception requests.

Question 116

A governance and assurance review uncovers the following: A bank allows experimental models on production customer data with no expiry or compensating controls for exception requests. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. Material AI uses are inventoried, risk-tiered and linked to approved business/data owners before production use.
  2. Expired or high-risk exceptions are renewed through accountable approval or removed with verified closure.
  3. Treat a verbal business sponsor request as permanent authorization to ignore AI controls.
  4. The documented risk cycle links context, measurement, ownership and treatment for sampled systems.

Explanation

Correct Answer

B:

This is an observable validation result for AI policy exception governance, not just management assurance: Expired or high-risk exceptions are renewed through accountable approval or removed with verified closure.

Incorrect Answers

A:

This option concerns Enterprise AI inventory and shadow-AI discovery, which is a related but different AI governance concern. The audit must corroborate: Inspect approved exception register, justifications, expiry, control alternatives and follow-up evidence.

C:

For this situation: A bank allows experimental models on production customer data with no expiry or compensating controls for exception requests.

D:

This option concerns NIST AI RMF governance and measurement alignment, which is a related but different AI governance concern. For this situation: A bank allows experimental models on production customer data with no expiry or compensating controls for exception requests.

Question 117

A risk-based audit engagement examines this operating condition: A city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Deliver role-specific AI awareness, secure-use guidance and tested escalation exercises matched to real work.
  2. Treat a verbal business sponsor request as permanent authorization to ignore AI controls.
  3. Require time-bound exception approvals, explicit risk ownership, compensating measures and periodic review.
  4. Align risk indicators, incidents and performance results to explicit appetite thresholds and accountable board decisions.

Explanation

Correct Answer

C:

The reason it is necessary is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements. In this case: A city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review.

Incorrect Answers

A:

This option concerns AI workforce literacy and policy awareness, which is a related but different AI governance concern. The decisive principle here is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements.

B:

This attractive shortcut does not resolve the AI policy exception governance weakness: Treat a verbal business sponsor request as permanent authorization to ignore AI controls. In this case: A city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review.

D:

This option concerns Board reporting of AI risk appetite and outcomes, which is a related but different AI governance concern. It does not establish control effectiveness for AI policy exception governance.

Question 118

An audit committee asks for a defensible assessment of this situation: A city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements.
  2. Policy awareness is effective only when personnel understand and apply controls in actual AI workflows.
  3. Treat a verbal business sponsor request as permanent authorization to ignore AI controls.
  4. Governance cannot assess or monitor AI risk if material use cases and external processors are unknown.

Explanation

Correct Answer

A:

The corrective action is: Require time-bound exception approvals, explicit risk ownership, compensating measures and periodic review. In this case: A city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review.

Incorrect Answers

B:

This option concerns AI workforce literacy and policy awareness, which is a related but different AI governance concern. For this situation: A city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review.

C:

This attractive shortcut does not resolve the AI policy exception governance weakness: Treat a verbal business sponsor request as permanent authorization to ignore AI controls. For this situation: A city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review.

D:

This option concerns Enterprise AI inventory and shadow-AI discovery, which is a related but different AI governance concern. In this case: A city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review.

Question 119

During an AI controls assessment, the team learns that a city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Treat a verbal business sponsor request as permanent authorization to ignore AI controls.
  2. Inspect approved exception register, justifications, expiry, control alternatives and follow-up evidence.
  3. Reconcile software contracts, cloud billing, SSO logs, network egress, procurement and departmental attestations to inventory entries.
  4. Compare approved risk appetite, model-level KRIs, customer impact metrics, exceptions and board action minutes.

Explanation

Correct Answer

B:

The corrective action is: Require time-bound exception approvals, explicit risk ownership, compensating measures and periodic review.

Incorrect Answers

A:

For this situation: A city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review.

C:

This option concerns Enterprise AI inventory and shadow-AI discovery, which is a related but different AI governance concern. For this situation: A city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review.

D:

This option concerns Board reporting of AI risk appetite and outcomes, which is a related but different AI governance concern. For this situation: A city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review.

Question 120

An independent AI auditor reviews this case: A city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Inspect approved exception register, justifications, expiry, control alternatives and follow-up evidence.
  2. Assess vendor control evidence, data handling, change notification, subcontractors, portability and remedies before acceptance.
  3. Review RACI, committee charters, risk decisions, escalation records, owner acceptance and audit independence.
  4. Require time-bound exception approvals, explicit risk ownership, compensating measures and periodic review.
  5. Treat a verbal business sponsor request as permanent authorization to ignore AI controls.

Explanation

Correct Answers

A:

The reason it is necessary is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements. For this situation: A city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review.

D:

The reason it is necessary is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements. This response fits the risk associated with AI policy exception governance: Require time-bound exception approvals, explicit risk ownership, compensating measures and periodic review.

Incorrect Answers

B:

This option concerns Third-party foundation model procurement assurance, which is a related but different AI governance concern. It does not establish control effectiveness for AI policy exception governance.

C:

This option concerns Accountable ownership and three-lines roles, which is a related but different AI governance concern. In this case: A city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review.

E:

It misses the key control principle: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements.

ISACA Advanced in AI Audit (AAIA) Practice Tests