Isaca AAIA Practice Test 20
Question 190
An independent AI auditor reviews this case: A fraud detector's control owner points to planned retraining but has no evidence that adverse false flags improved. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Document inherent versus residual risk using tested control effectiveness and authorized business acceptance.
- Close risk solely because a remediation ticket was opened or a broad values statement was issued.
- Define drift indicators and use-case-specific revalidation triggers with approved mitigation decisions.
- Inspect initial impact, treatment choice, operating tests, risk acceptance authority and current residual metrics.
- Inspect architecture data flows, attacker capabilities, attack trees, abuse test coverage and limiting controls.
Explanation
Correct Answers
A:The reason it is necessary is: Mitigation exists only when control performance reduces measured exposure; a planned action is not risk reduction. For this situation: A fraud detector's control owner points to planned retraining but has no evidence that adverse false flags improved.
D:This evidence directly tests the asserted control for Residual AI risk acceptance and mitigation efficacy: Inspect initial impact, treatment choice, operating tests, risk acceptance authority and current residual metrics.
Incorrect Answers
B:This attractive shortcut does not resolve the Residual AI risk acceptance and mitigation efficacy weakness: Close risk solely because a remediation ticket was opened or a broad values statement was issued. For this situation: A fraud detector's control owner points to planned retraining but has no evidence that adverse false flags improved.
C:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. For this situation: A fraud detector's control owner points to planned retraining but has no evidence that adverse false flags improved.
E:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. In this case: A fraud detector's control owner points to planned retraining but has no evidence that adverse false flags improved.
Question 191
A governance and assurance review uncovers the following: A fraud detector's control owner points to planned retraining but has no evidence that adverse false flags improved. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect architecture data flows, attacker capabilities, attack trees, abuse test coverage and limiting controls.
- Close risk solely because a remediation ticket was opened or a broad values statement was issued.
- Inspect initial impact, treatment choice, operating tests, risk acceptance authority and current residual metrics.
- Inspect temporal validation, segment error, data drift, concept labels, release dates and retraining criteria.
Explanation
Correct Answer
C:For this situation: A fraud detector's control owner points to planned retraining but has no evidence that adverse false flags improved.
Incorrect Answers
A:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. For this situation: A fraud detector's control owner points to planned retraining but has no evidence that adverse false flags improved.
B:It misses the key control principle: Mitigation exists only when control performance reduces measured exposure; a planned action is not risk reduction.
D:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. The audit must corroborate: Inspect initial impact, treatment choice, operating tests, risk acceptance authority and current residual metrics.
Question 192
A risk-based audit engagement examines this operating condition: A fraud detector's control owner points to planned retraining but has no evidence that adverse false flags improved. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Early warning signals prompt accountable preventive actions before unacceptable impact.
- Close risk solely because a remediation ticket was opened or a broad values statement was issued.
- Residual risk is accepted within appetite or escalated with validated control improvements.
- Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives.
Explanation
Correct Answer
C:This is an observable validation result for Residual AI risk acceptance and mitigation efficacy, not just management assurance: Residual risk is accepted within appetite or escalated with validated control improvements.
Incorrect Answers
A:This option concerns AI risk monitoring through leading KRIs, which is a related but different AI governance concern. In this case: A fraud detector's control owner points to planned retraining but has no evidence that adverse false flags improved.
B:The auditor should instead examine: Inspect initial impact, treatment choice, operating tests, risk acceptance authority and current residual metrics.
D:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. The decisive principle here is: Mitigation exists only when control performance reduces measured exposure; a planned action is not risk reduction.
Question 193
An audit committee asks for a defensible assessment of this situation: A lender excludes protected class from training but zip code and school features still correlate with historical unequal outcomes. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Claim discrimination is impossible because the feature table no longer contains a protected-class column.
- Define drift indicators and use-case-specific revalidation triggers with approved mitigation decisions.
- Assess subgroup outcomes, proxy variables, relevant legitimate factors and mitigations with lawful context.
- Conduct a documented impact assessment of purpose, necessity, proportionality, alternatives and safeguards before deployment.
Explanation
Correct Answer
C:The reason it is necessary is: Removing an explicit sensitive field does not guarantee fairness if correlated inputs and outcomes retain inequity. The acceptable verified outcome is: Fairness monitoring detects problematic disparities and remediation does not conceal residual performance impacts.
Incorrect Answers
A:This attractive shortcut does not resolve the Fairness assessment for proxy discrimination weakness: Claim discrimination is impossible because the feature table no longer contains a protected-class column.
B:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. It does not establish control effectiveness for Fairness assessment for proxy discrimination.
D:This option concerns Privacy impact assessment for biometric AI, which is a related but different AI governance concern. It does not establish control effectiveness for Fairness assessment for proxy discrimination.
Question 194
During an AI controls assessment, the team learns that a lender excludes protected class from training but zip code and school features still correlate with historical unequal outcomes. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Claim discrimination is impossible because the feature table no longer contains a protected-class column.
- Removing an explicit sensitive field does not guarantee fairness if correlated inputs and outcomes retain inequity.
- Multiple applications do not diversify AI exposure when they share a single provider or data dependency.
- High-impact monitoring of people can cause harm even when encryption and access controls are sound.
Explanation
Correct Answer
B:The acceptable verified outcome is: Fairness monitoring detects problematic disparities and remediation does not conceal residual performance impacts. This is the applicable AI audit principle for Fairness assessment for proxy discrimination: Removing an explicit sensitive field does not guarantee fairness if correlated inputs and outcomes retain inequity.
Incorrect Answers
A:This attractive shortcut does not resolve the Fairness assessment for proxy discrimination weakness: Claim discrimination is impossible because the feature table no longer contains a protected-class column. For this situation: A lender excludes protected class from training but zip code and school features still correlate with historical unequal outcomes.
C:This option concerns Model concentration and systemic vendor dependency, which is a related but different AI governance concern. It does not establish control effectiveness for Fairness assessment for proxy discrimination.
D:This option concerns Privacy impact assessment for biometric AI, which is a related but different AI governance concern. For this situation: A lender excludes protected class from training but zip code and school features still correlate with historical unequal outcomes.
Question 195
An independent AI auditor reviews this case: A lender excludes protected class from training but zip code and school features still correlate with historical unequal outcomes. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Claim discrimination is impossible because the feature table no longer contains a protected-class column.
- Inspect temporal validation, segment error, data drift, concept labels, release dates and retraining criteria.
- Inspect architecture data flows, attacker capabilities, attack trees, abuse test coverage and limiting controls.
- Compare justified subgroup metrics, candidate proxies, sampling context, error costs and approved fairness criteria.
Explanation
Correct Answer
D:The reason it is necessary is: Removing an explicit sensitive field does not guarantee fairness if correlated inputs and outcomes retain inequity. In this case: A lender excludes protected class from training but zip code and school features still correlate with historical unequal outcomes.
Incorrect Answers
A:This attractive shortcut does not resolve the Fairness assessment for proxy discrimination weakness: Claim discrimination is impossible because the feature table no longer contains a protected-class column. The auditor should instead examine: Compare justified subgroup metrics, candidate proxies, sampling context, error costs and approved fairness criteria.
B:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. For this situation: A lender excludes protected class from training but zip code and school features still correlate with historical unequal outcomes.
C:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. It does not establish control effectiveness for Fairness assessment for proxy discrimination.
Question 196
A governance and assurance review uncovers the following: A lender excludes protected class from training but zip code and school features still correlate with historical unequal outcomes. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Material plausible failure scenarios have accountable controls, measurements and response plans.
- Claim discrimination is impossible because the feature table no longer contains a protected-class column.
- Use case proceeds only with documented lawful purpose and proportionate risk treatment or is stopped.
- Fairness monitoring detects problematic disparities and remediation does not conceal residual performance impacts.
Explanation
Correct Answer
D:The reason it is necessary is: Removing an explicit sensitive field does not guarantee fairness if correlated inputs and outcomes retain inequity. This is an observable validation result for Fairness assessment for proxy discrimination, not just management assurance: Fairness monitoring detects problematic disparities and remediation does not conceal residual performance impacts.
Incorrect Answers
A:This option concerns AI use-case risk scenario identification, which is a related but different AI governance concern. It does not establish control effectiveness for Fairness assessment for proxy discrimination.
B:This attractive shortcut does not resolve the Fairness assessment for proxy discrimination weakness: Claim discrimination is impossible because the feature table no longer contains a protected-class column. Effective closure requires: Fairness monitoring detects problematic disparities and remediation does not conceal residual performance impacts.
C:This option concerns Privacy impact assessment for biometric AI, which is a related but different AI governance concern. The decisive principle here is: Removing an explicit sensitive field does not guarantee fairness if correlated inputs and outcomes retain inequity.
Question 197
A risk-based audit engagement examines this operating condition: An insurance algorithm passes aggregate accuracy but underprices claims for a vulnerable demographic subgroup. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Track leading behavior, data-quality and control indicators with thresholds linked to risk appetite.
- Document inherent versus residual risk using tested control effectiveness and authorized business acceptance.
- Claim discrimination is impossible because the feature table no longer contains a protected-class column.
- Assess subgroup outcomes, proxy variables, relevant legitimate factors and mitigations with lawful context.
Explanation
Correct Answer
D:The reason it is necessary is: Removing an explicit sensitive field does not guarantee fairness if correlated inputs and outcomes retain inequity. In this case: An insurance algorithm passes aggregate accuracy but underprices claims for a vulnerable demographic subgroup.
Incorrect Answers
A:This option concerns AI risk monitoring through leading KRIs, which is a related but different AI governance concern. It does not establish control effectiveness for Fairness assessment for proxy discrimination.
B:This option concerns Residual AI risk acceptance and mitigation efficacy, which is a related but different AI governance concern. It does not establish control effectiveness for Fairness assessment for proxy discrimination.
C:This attractive shortcut does not resolve the Fairness assessment for proxy discrimination weakness: Claim discrimination is impossible because the feature table no longer contains a protected-class column. In this case: An insurance algorithm passes aggregate accuracy but underprices claims for a vulnerable demographic subgroup.
Question 198
An audit committee asks for a defensible assessment of this situation: An insurance algorithm passes aggregate accuracy but underprices claims for a vulnerable demographic subgroup. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier.
- Removing an explicit sensitive field does not guarantee fairness if correlated inputs and outcomes retain inequity.
- Data and concept distributions evolve; model performance can decay even when code and infrastructure remain unchanged.
- Claim discrimination is impossible because the feature table no longer contains a protected-class column.
Explanation
Correct Answer
B:The acceptable verified outcome is: Fairness monitoring detects problematic disparities and remediation does not conceal residual performance impacts. In this case: An insurance algorithm passes aggregate accuracy but underprices claims for a vulnerable demographic subgroup.
Incorrect Answers
A:This option concerns AI risk monitoring through leading KRIs, which is a related but different AI governance concern. For this situation: An insurance algorithm passes aggregate accuracy but underprices claims for a vulnerable demographic subgroup.
C:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. The decisive principle here is: Removing an explicit sensitive field does not guarantee fairness if correlated inputs and outcomes retain inequity.
D:This attractive shortcut does not resolve the Fairness assessment for proxy discrimination weakness: Claim discrimination is impossible because the feature table no longer contains a protected-class column. For this situation: An insurance algorithm passes aggregate accuracy but underprices claims for a vulnerable demographic subgroup.
Question 199
During an AI controls assessment, the team learns that an insurance algorithm passes aggregate accuracy but underprices claims for a vulnerable demographic subgroup. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Review data categories, stakeholder impacts, alternatives, lawful basis, accuracy and mitigation decisions.
- Claim discrimination is impossible because the feature table no longer contains a protected-class column.
- Inspect monitoring design, owners, thresholds, near-misses, drift and documented actions for breaches.
- Compare justified subgroup metrics, candidate proxies, sampling context, error costs and approved fairness criteria.
Explanation
Correct Answer
D:The reason it is necessary is: Removing an explicit sensitive field does not guarantee fairness if correlated inputs and outcomes retain inequity. This evidence directly tests the asserted control for Fairness assessment for proxy discrimination: Compare justified subgroup metrics, candidate proxies, sampling context, error costs and approved fairness criteria.
Incorrect Answers
A:This option concerns Privacy impact assessment for biometric AI, which is a related but different AI governance concern. In this case: An insurance algorithm passes aggregate accuracy but underprices claims for a vulnerable demographic subgroup.
B:This attractive shortcut does not resolve the Fairness assessment for proxy discrimination weakness: Claim discrimination is impossible because the feature table no longer contains a protected-class column. Assess subgroup outcomes, proxy variables, relevant legitimate factors and mitigations with lawful context.
C:This option concerns AI risk monitoring through leading KRIs, which is a related but different AI governance concern. The decisive principle here is: Removing an explicit sensitive field does not guarantee fairness if correlated inputs and outcomes retain inequity.
Question 200
An independent AI auditor reviews this case: An insurance algorithm passes aggregate accuracy but underprices claims for a vulnerable demographic subgroup. Which THREE elements together provide a defensible AI audit conclusion: the corrective control, the evidence to test it, and a verified outcome? Select THREE answers.
- Assess subgroup outcomes, proxy variables, relevant legitimate factors and mitigations with lawful context.
- Claim discrimination is impossible because the feature table no longer contains a protected-class column.
- Fairness monitoring detects problematic disparities and remediation does not conceal residual performance impacts.
- Document inherent versus residual risk using tested control effectiveness and authorized business acceptance.
- Inspect architecture data flows, attacker capabilities, attack trees, abuse test coverage and limiting controls.
- Compare justified subgroup metrics, candidate proxies, sampling context, error costs and approved fairness criteria.
Explanation
Correct Answers
A:The reason it is necessary is: Removing an explicit sensitive field does not guarantee fairness if correlated inputs and outcomes retain inequity. For this situation: An insurance algorithm passes aggregate accuracy but underprices claims for a vulnerable demographic subgroup.
C:The reason it is necessary is: Removing an explicit sensitive field does not guarantee fairness if correlated inputs and outcomes retain inequity. Independent audit evidence includes: Compare justified subgroup metrics, candidate proxies, sampling context, error costs and approved fairness criteria.
F:The reason it is necessary is: Removing an explicit sensitive field does not guarantee fairness if correlated inputs and outcomes retain inequity. The corrective action is: Assess subgroup outcomes, proxy variables, relevant legitimate factors and mitigations with lawful context.
Incorrect Answers
B:For this situation: An insurance algorithm passes aggregate accuracy but underprices claims for a vulnerable demographic subgroup.
D:This option concerns Residual AI risk acceptance and mitigation efficacy, which is a related but different AI governance concern. For this situation: An insurance algorithm passes aggregate accuracy but underprices claims for a vulnerable demographic subgroup.
E:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. The decisive principle here is: Removing an explicit sensitive field does not guarantee fairness if correlated inputs and outcomes retain inequity.
