Isaca AAIA Practice Test 13
Question 120
An independent AI auditor reviews this case: A city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Inspect approved exception register, justifications, expiry, control alternatives and follow-up evidence.
- Assess vendor control evidence, data handling, change notification, subcontractors, portability and remedies before acceptance.
- Review RACI, committee charters, risk decisions, escalation records, owner acceptance and audit independence.
- Require time-bound exception approvals, explicit risk ownership, compensating measures and periodic review.
- Treat a verbal business sponsor request as permanent authorization to ignore AI controls.
Explanation
Correct Answers
A:The reason it is necessary is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements. For this situation: A city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review.
D:The reason it is necessary is: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements. This response fits the risk associated with AI policy exception governance: Require time-bound exception approvals, explicit risk ownership, compensating measures and periodic review.
Incorrect Answers
B:This option concerns Third-party foundation model procurement assurance, which is a related but different AI governance concern. It does not establish control effectiveness for AI policy exception governance.
C:This option concerns Accountable ownership and three-lines roles, which is a related but different AI governance concern. In this case: A city procurement office approves unrestricted model API access as a permanent emergency waiver without risk owner review.
E:It misses the key control principle: Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements.
Question 121
A governance and assurance review uncovers the following: A board report shows number of models deployed but omits severe privacy incidents and unresolved high-risk deployments. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Assess vendor control evidence, data handling, change notification, subcontractors, portability and remedies before acceptance.
- Align risk indicators, incidents and performance results to explicit appetite thresholds and accountable board decisions.
- Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered.
- Maintain a current AI system inventory covering owned, procured and embedded capabilities, data flows, owners and criticality.
Explanation
Correct Answer
B:The reason it is necessary is: Activity counts alone do not evidence acceptable risk or success against stated strategic objectives. Independent audit evidence includes: Compare approved risk appetite, model-level KRIs, customer impact metrics, exceptions and board action minutes.
Incorrect Answers
A:This option concerns Third-party foundation model procurement assurance, which is a related but different AI governance concern. It does not establish control effectiveness for Board reporting of AI risk appetite and outcomes.
C:This attractive shortcut does not resolve the Board reporting of AI risk appetite and outcomes weakness: Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered.
D:This option concerns Enterprise AI inventory and shadow-AI discovery, which is a related but different AI governance concern. It does not establish control effectiveness for Board reporting of AI risk appetite and outcomes.
Question 122
A risk-based audit engagement examines this operating condition: A board report shows number of models deployed but omits severe privacy incidents and unresolved high-risk deployments. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Policy awareness is effective only when personnel understand and apply controls in actual AI workflows.
- Risk-based governance calibrates scrutiny to potential consequences and does not equate every AI feature.
- Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered.
- Activity counts alone do not evidence acceptable risk or success against stated strategic objectives.
Explanation
Correct Answer
D:Independent audit evidence includes: Compare approved risk appetite, model-level KRIs, customer impact metrics, exceptions and board action minutes. This is the applicable AI audit principle for Board reporting of AI risk appetite and outcomes: Activity counts alone do not evidence acceptable risk or success against stated strategic objectives.
Incorrect Answers
A:This option concerns AI workforce literacy and policy awareness, which is a related but different AI governance concern. It does not establish control effectiveness for Board reporting of AI risk appetite and outcomes.
B:This option concerns Risk-tiering and proportional approval gates, which is a related but different AI governance concern. It does not establish control effectiveness for Board reporting of AI risk appetite and outcomes.
C:This attractive shortcut does not resolve the Board reporting of AI risk appetite and outcomes weakness: Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered. For this situation: A board report shows number of models deployed but omits severe privacy incidents and unresolved high-risk deployments.
Question 123
An audit committee asks for a defensible assessment of this situation: A board report shows number of models deployed but omits severe privacy incidents and unresolved high-risk deployments. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered.
- Reconcile software contracts, cloud billing, SSO logs, network egress, procurement and departmental attestations to inventory entries.
- Compare approved risk appetite, model-level KRIs, customer impact metrics, exceptions and board action minutes.
- Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
Explanation
Correct Answer
C:The reason it is necessary is: Activity counts alone do not evidence acceptable risk or success against stated strategic objectives. This evidence directly tests the asserted control for Board reporting of AI risk appetite and outcomes: Compare approved risk appetite, model-level KRIs, customer impact metrics, exceptions and board action minutes.
Incorrect Answers
A:This attractive shortcut does not resolve the Board reporting of AI risk appetite and outcomes weakness: Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered. The auditor should instead examine: Compare approved risk appetite, model-level KRIs, customer impact metrics, exceptions and board action minutes.
B:This option concerns Enterprise AI inventory and shadow-AI discovery, which is a related but different AI governance concern. For this situation: A board report shows number of models deployed but omits severe privacy incidents and unresolved high-risk deployments.
D:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. It does not establish control effectiveness for Board reporting of AI risk appetite and outcomes.
Question 124
During an AI controls assessment, the team learns that a board report shows number of models deployed but omits severe privacy incidents and unresolved high-risk deployments. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered.
- Oversight triggers corrective decisions when measurable thresholds are breached and tracks closure.
- Expired or high-risk exceptions are renewed through accountable approval or removed with verified closure.
- Organization documents role-specific obligations and controls for its actual use and checks changes over time.
Explanation
Correct Answer
B:The reason it is necessary is: Activity counts alone do not evidence acceptable risk or success against stated strategic objectives. This is an observable validation result for Board reporting of AI risk appetite and outcomes, not just management assurance: Oversight triggers corrective decisions when measurable thresholds are breached and tracks closure.
Incorrect Answers
A:This attractive shortcut does not resolve the Board reporting of AI risk appetite and outcomes weakness: Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered. Align risk indicators, incidents and performance results to explicit appetite thresholds and accountable board decisions.
C:This option concerns AI policy exception governance, which is a related but different AI governance concern. It does not establish control effectiveness for Board reporting of AI risk appetite and outcomes.
D:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. For this situation: A board report shows number of models deployed but omits severe privacy incidents and unresolved high-risk deployments.
Question 125
An independent AI auditor reviews this case: A credit organization defines a low tolerance for discriminatory decisions but dashboards include only uptime and average accuracy. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered.
- Deliver role-specific AI awareness, secure-use guidance and tested escalation exercises matched to real work.
- Classify AI uses by impact and autonomy, then apply evidence and approval gates proportionate to the actual exposure.
- Align risk indicators, incidents and performance results to explicit appetite thresholds and accountable board decisions.
Explanation
Correct Answer
D:The reason it is necessary is: Activity counts alone do not evidence acceptable risk or success against stated strategic objectives. The acceptable verified outcome is: Oversight triggers corrective decisions when measurable thresholds are breached and tracks closure.
Incorrect Answers
A:This attractive shortcut does not resolve the Board reporting of AI risk appetite and outcomes weakness: Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered. In this case: A credit organization defines a low tolerance for discriminatory decisions but dashboards include only uptime and average accuracy.
B:This option concerns AI workforce literacy and policy awareness, which is a related but different AI governance concern. The decisive principle here is: Activity counts alone do not evidence acceptable risk or success against stated strategic objectives.
C:This option concerns Risk-tiering and proportional approval gates, which is a related but different AI governance concern. The decisive principle here is: Activity counts alone do not evidence acceptable risk or success against stated strategic objectives.
Question 126
A governance and assurance review uncovers the following: A credit organization defines a low tolerance for discriminatory decisions but dashboards include only uptime and average accuracy. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements.
- Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered.
- Activity counts alone do not evidence acceptable risk or success against stated strategic objectives.
- Accountability requires named authorities with escalation and separation between control operation and independent assurance.
Explanation
Correct Answer
C:Independent audit evidence includes: Compare approved risk appetite, model-level KRIs, customer impact metrics, exceptions and board action minutes. The corrective action is: Align risk indicators, incidents and performance results to explicit appetite thresholds and accountable board decisions.
Incorrect Answers
A:This option concerns AI policy exception governance, which is a related but different AI governance concern. The decisive principle here is: Activity counts alone do not evidence acceptable risk or success against stated strategic objectives.
B:This attractive shortcut does not resolve the Board reporting of AI risk appetite and outcomes weakness: Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered. For this situation: A credit organization defines a low tolerance for discriminatory decisions but dashboards include only uptime and average accuracy.
D:This option concerns Accountable ownership and three-lines roles, which is a related but different AI governance concern. It does not establish control effectiveness for Board reporting of AI risk appetite and outcomes.
Question 127
A risk-based audit engagement examines this operating condition: A credit organization defines a low tolerance for discriminatory decisions but dashboards include only uptime and average accuracy. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered.
- Inspect SOC reports where relevant, model cards, contracts, retention terms, subprocessor lists, SLAs and exit tests.
- Compare approved risk appetite, model-level KRIs, customer impact metrics, exceptions and board action minutes.
- Inspect training role coverage, job-specific examples, scenario test scores and observed policy violations.
Explanation
Correct Answer
C:The reason it is necessary is: Activity counts alone do not evidence acceptable risk or success against stated strategic objectives. The corrective action is: Align risk indicators, incidents and performance results to explicit appetite thresholds and accountable board decisions.
Incorrect Answers
A:This attractive shortcut does not resolve the Board reporting of AI risk appetite and outcomes weakness: Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered. Effective closure requires: Oversight triggers corrective decisions when measurable thresholds are breached and tracks closure.
B:This option concerns Third-party foundation model procurement assurance, which is a related but different AI governance concern. The decisive principle here is: Activity counts alone do not evidence acceptable risk or success against stated strategic objectives.
D:This option concerns AI workforce literacy and policy awareness, which is a related but different AI governance concern. For this situation: A credit organization defines a low tolerance for discriminatory decisions but dashboards include only uptime and average accuracy.
Question 128
An audit committee asks for a defensible assessment of this situation: A credit organization defines a low tolerance for discriminatory decisions but dashboards include only uptime and average accuracy. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Material AI uses are inventoried, risk-tiered and linked to approved business/data owners before production use.
- The supplier's controls and obligations meet use-case requirements with tested contingency and monitoring.
- Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered.
- Oversight triggers corrective decisions when measurable thresholds are breached and tracks closure.
Explanation
Correct Answer
D:The reason it is necessary is: Activity counts alone do not evidence acceptable risk or success against stated strategic objectives. In this case: A credit organization defines a low tolerance for discriminatory decisions but dashboards include only uptime and average accuracy.
Incorrect Answers
A:This option concerns Enterprise AI inventory and shadow-AI discovery, which is a related but different AI governance concern. The decisive principle here is: Activity counts alone do not evidence acceptable risk or success against stated strategic objectives.
B:This option concerns Third-party foundation model procurement assurance, which is a related but different AI governance concern. For this situation: A credit organization defines a low tolerance for discriminatory decisions but dashboards include only uptime and average accuracy.
C:For this situation: A credit organization defines a low tolerance for discriminatory decisions but dashboards include only uptime and average accuracy.
Question 129
During an AI controls assessment, the team learns that a utility executive committee receives AI adoption forecasts but no link to operational safety controls or known exceptions. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Assign decision rights and responsibilities for design, operation, risk acceptance, independent challenge and remediation.
- Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered.
- Assess vendor control evidence, data handling, change notification, subcontractors, portability and remedies before acceptance.
- Align risk indicators, incidents and performance results to explicit appetite thresholds and accountable board decisions.
Explanation
Correct Answer
D:The reason it is necessary is: Activity counts alone do not evidence acceptable risk or success against stated strategic objectives. In this case: A utility executive committee receives AI adoption forecasts but no link to operational safety controls or known exceptions.
Incorrect Answers
A:This option concerns Accountable ownership and three-lines roles, which is a related but different AI governance concern. The decisive principle here is: Activity counts alone do not evidence acceptable risk or success against stated strategic objectives.
B:This attractive shortcut does not resolve the Board reporting of AI risk appetite and outcomes weakness: Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered. In this case: A utility executive committee receives AI adoption forecasts but no link to operational safety controls or known exceptions.
C:This option concerns Third-party foundation model procurement assurance, which is a related but different AI governance concern. In this case: A utility executive committee receives AI adoption forecasts but no link to operational safety controls or known exceptions.
Question 130
An independent AI auditor reviews this case: A utility executive committee receives AI adoption forecasts but no link to operational safety controls or known exceptions. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Compare approved risk appetite, model-level KRIs, customer impact metrics, exceptions and board action minutes.
- Deliver role-specific AI awareness, secure-use guidance and tested escalation exercises matched to real work.
- Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered.
- Review RACI, committee charters, risk decisions, escalation records, owner acceptance and audit independence.
- Align risk indicators, incidents and performance results to explicit appetite thresholds and accountable board decisions.
Explanation
Correct Answers
A:This evidence directly tests the asserted control for Board reporting of AI risk appetite and outcomes: Compare approved risk appetite, model-level KRIs, customer impact metrics, exceptions and board action minutes.
E:The reason it is necessary is: Activity counts alone do not evidence acceptable risk or success against stated strategic objectives. For this situation: A utility executive committee receives AI adoption forecasts but no link to operational safety controls or known exceptions.
Incorrect Answers
B:This option concerns AI workforce literacy and policy awareness, which is a related but different AI governance concern. In this case: A utility executive committee receives AI adoption forecasts but no link to operational safety controls or known exceptions.
C:This attractive shortcut does not resolve the Board reporting of AI risk appetite and outcomes weakness: Declare AI governance effective because deployment counts rise and a quarterly presentation was delivered. For this situation: A utility executive committee receives AI adoption forecasts but no link to operational safety controls or known exceptions.
D:This option concerns Accountable ownership and three-lines roles, which is a related but different AI governance concern. For this situation: A utility executive committee receives AI adoption forecasts but no link to operational safety controls or known exceptions.
