Isaca AAIA Practice Test 25
Question 240
An independent AI auditor reviews this case: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Test whether less identifying features or on-premises transformations satisfy the business purpose.
- Count different application names as provider diversification while ignoring their common model backend.
- Review dependency map, provider incidents, contract exit clauses, portability tests and fallback workflows.
- Inspect monitoring design, owners, thresholds, near-misses, drift and documented actions for breaches.
- Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
Explanation
Correct Answers
C:The reason it is necessary is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency. For this situation: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats.
E:This response fits the risk associated with Model concentration and systemic vendor dependency: Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
Incorrect Answers
A:This option concerns Privacy by design for model features, which is a related but different AI governance concern. In this case: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats.
B:It misses the key control principle: Multiple applications do not diversify AI exposure when they share a single provider or data dependency.
D:This option concerns AI risk monitoring through leading KRIs, which is a related but different AI governance concern. For this situation: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats.
Question 241
A governance and assurance review uncovers the following: A board tracks only monthly AI incident totals although near-miss unsafe agent actions are increasing. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Develop use-case-specific scenarios covering people, business process, privacy, safety, security and model behavior.
- Track leading behavior, data-quality and control indicators with thresholds linked to risk appetite.
- Define drift indicators and use-case-specific revalidation triggers with approved mitigation decisions.
- Use incident count alone as proof that an AI implementation has no emerging risk.
Explanation
Correct Answer
B:The reason it is necessary is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier. In this case: A board tracks only monthly AI incident totals although near-miss unsafe agent actions are increasing.
Incorrect Answers
A:This option concerns AI use-case risk scenario identification, which is a related but different AI governance concern. It does not establish control effectiveness for AI risk monitoring through leading KRIs.
C:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. It does not establish control effectiveness for AI risk monitoring through leading KRIs.
D:This attractive shortcut does not resolve the AI risk monitoring through leading KRIs weakness: Use incident count alone as proof that an AI implementation has no emerging risk.
Question 242
A risk-based audit engagement examines this operating condition: A board tracks only monthly AI incident totals although near-miss unsafe agent actions are increasing. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier.
- Data and concept distributions evolve; model performance can decay even when code and infrastructure remain unchanged.
- Mitigation exists only when control performance reduces measured exposure; a planned action is not risk reduction.
- Use incident count alone as proof that an AI implementation has no emerging risk.
Explanation
Correct Answer
A:The corrective action is: Track leading behavior, data-quality and control indicators with thresholds linked to risk appetite. This is the applicable AI audit principle for AI risk monitoring through leading KRIs: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier.
Incorrect Answers
B:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. For this situation: A board tracks only monthly AI incident totals although near-miss unsafe agent actions are increasing.
C:This option concerns Residual AI risk acceptance and mitigation efficacy, which is a related but different AI governance concern. It does not establish control effectiveness for AI risk monitoring through leading KRIs.
D:This attractive shortcut does not resolve the AI risk monitoring through leading KRIs weakness: Use incident count alone as proof that an AI implementation has no emerging risk. For this situation: A board tracks only monthly AI incident totals although near-miss unsafe agent actions are increasing.
Question 243
An audit committee asks for a defensible assessment of this situation: A board tracks only monthly AI incident totals although near-miss unsafe agent actions are increasing. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect monitoring design, owners, thresholds, near-misses, drift and documented actions for breaches.
- Use incident count alone as proof that an AI implementation has no emerging risk.
- Review dependency map, provider incidents, contract exit clauses, portability tests and fallback workflows.
- Inspect temporal validation, segment error, data drift, concept labels, release dates and retraining criteria.
Explanation
Correct Answer
A:The reason it is necessary is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier. This evidence directly tests the asserted control for AI risk monitoring through leading KRIs: Inspect monitoring design, owners, thresholds, near-misses, drift and documented actions for breaches.
Incorrect Answers
B:This attractive shortcut does not resolve the AI risk monitoring through leading KRIs weakness: Use incident count alone as proof that an AI implementation has no emerging risk. The auditor should instead examine: Inspect monitoring design, owners, thresholds, near-misses, drift and documented actions for breaches.
C:This option concerns Model concentration and systemic vendor dependency, which is a related but different AI governance concern. It does not establish control effectiveness for AI risk monitoring through leading KRIs.
D:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. The decisive principle here is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier.
Question 244
During an AI controls assessment, the team learns that a board tracks only monthly AI incident totals although near-miss unsafe agent actions are increasing. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Early warning signals prompt accountable preventive actions before unacceptable impact.
- Use incident count alone as proof that an AI implementation has no emerging risk.
- Risk register and tests cover plausible exploitation paths, and high-impact gaps are prioritized.
- Drift alerts trigger timely review and validated model changes without uncontrolled retraining.
Explanation
Correct Answer
A:The reason it is necessary is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier. This is an observable validation result for AI risk monitoring through leading KRIs, not just management assurance: Early warning signals prompt accountable preventive actions before unacceptable impact.
Incorrect Answers
B:This attractive shortcut does not resolve the AI risk monitoring through leading KRIs weakness: Use incident count alone as proof that an AI implementation has no emerging risk. Track leading behavior, data-quality and control indicators with thresholds linked to risk appetite.
C:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. It does not establish control effectiveness for AI risk monitoring through leading KRIs.
D:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. The audit must corroborate: Inspect monitoring design, owners, thresholds, near-misses, drift and documented actions for breaches.
Question 245
An independent AI auditor reviews this case: A customer-support bot's unresolved complaints rise but the risk dashboard records only model availability. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Identify relevant AI Act roles, use-case classifications, jurisdictions and applicable obligations with competent legal input.
- Define drift indicators and use-case-specific revalidation triggers with approved mitigation decisions.
- Use incident count alone as proof that an AI implementation has no emerging risk.
- Track leading behavior, data-quality and control indicators with thresholds linked to risk appetite.
Explanation
Correct Answer
D:The reason it is necessary is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier. In this case: A customer-support bot's unresolved complaints rise but the risk dashboard records only model availability.
Incorrect Answers
A:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. It does not establish control effectiveness for AI risk monitoring through leading KRIs.
B:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. In this case: A customer-support bot's unresolved complaints rise but the risk dashboard records only model availability.
C:This attractive shortcut does not resolve the AI risk monitoring through leading KRIs weakness: Use incident count alone as proof that an AI implementation has no emerging risk. In this case: A customer-support bot's unresolved complaints rise but the risk dashboard records only model availability.
Question 246
A governance and assurance review uncovers the following: A customer-support bot's unresolved complaints rise but the risk dashboard records only model availability. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- AI attack surfaces include data, models, prompts, output use and agent capabilities beyond traditional network endpoints.
- Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier.
- Use incident count alone as proof that an AI implementation has no emerging risk.
- Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding.
Explanation
Correct Answer
B:The corrective action is: Track leading behavior, data-quality and control indicators with thresholds linked to risk appetite. In this case: A customer-support bot's unresolved complaints rise but the risk dashboard records only model availability.
Incorrect Answers
A:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. The decisive principle here is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier.
C:This attractive shortcut does not resolve the AI risk monitoring through leading KRIs weakness: Use incident count alone as proof that an AI implementation has no emerging risk. For this situation: A customer-support bot's unresolved complaints rise but the risk dashboard records only model availability.
D:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. For this situation: A customer-support bot's unresolved complaints rise but the risk dashboard records only model availability.
Question 247
A risk-based audit engagement examines this operating condition: A customer-support bot's unresolved complaints rise but the risk dashboard records only model availability. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Use incident count alone as proof that an AI implementation has no emerging risk.
- Review use-case map, stakeholders, failure modes, risk register, impact assumptions and challenge workshops.
- Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
- Inspect monitoring design, owners, thresholds, near-misses, drift and documented actions for breaches.
Explanation
Correct Answer
D:The reason it is necessary is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier. The corrective action is: Track leading behavior, data-quality and control indicators with thresholds linked to risk appetite.
Incorrect Answers
A:This attractive shortcut does not resolve the AI risk monitoring through leading KRIs weakness: Use incident count alone as proof that an AI implementation has no emerging risk. Effective closure requires: Early warning signals prompt accountable preventive actions before unacceptable impact.
B:This option concerns AI use-case risk scenario identification, which is a related but different AI governance concern. The decisive principle here is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier.
C:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. The decisive principle here is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier.
Question 248
An audit committee asks for a defensible assessment of this situation: A customer-support bot's unresolved complaints rise but the risk dashboard records only model availability. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Early warning signals prompt accountable preventive actions before unacceptable impact.
- Drift alerts trigger timely review and validated model changes without uncontrolled retraining.
- Residual risk is accepted within appetite or escalated with validated control improvements.
- Use incident count alone as proof that an AI implementation has no emerging risk.
Explanation
Correct Answer
A:The reason it is necessary is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier. Independent audit evidence includes: Inspect monitoring design, owners, thresholds, near-misses, drift and documented actions for breaches.
Incorrect Answers
B:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. For this situation: A customer-support bot's unresolved complaints rise but the risk dashboard records only model availability.
C:This option concerns Residual AI risk acceptance and mitigation efficacy, which is a related but different AI governance concern. The decisive principle here is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier.
D:For this situation: A customer-support bot's unresolved complaints rise but the risk dashboard records only model availability.
Question 249
During an AI controls assessment, the team learns that a loan model's feature quality deteriorates while management measures only historical quarterly losses. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Track leading behavior, data-quality and control indicators with thresholds linked to risk appetite.
- Document inherent versus residual risk using tested control effectiveness and authorized business acceptance.
- Use incident count alone as proof that an AI implementation has no emerging risk.
- Threat-model model-specific abuse paths, adversary access, safeguards and residual exposure.
Explanation
Correct Answer
A:The reason it is necessary is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier. In this case: A loan model's feature quality deteriorates while management measures only historical quarterly losses.
Incorrect Answers
B:This option concerns Residual AI risk acceptance and mitigation efficacy, which is a related but different AI governance concern. In this case: A loan model's feature quality deteriorates while management measures only historical quarterly losses.
C:This attractive shortcut does not resolve the AI risk monitoring through leading KRIs weakness: Use incident count alone as proof that an AI implementation has no emerging risk. In this case: A loan model's feature quality deteriorates while management measures only historical quarterly losses.
D:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. In this case: A loan model's feature quality deteriorates while management measures only historical quarterly losses.
Question 250
An independent AI auditor reviews this case: A loan model's feature quality deteriorates while management measures only historical quarterly losses. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Track leading behavior, data-quality and control indicators with thresholds linked to risk appetite.
- Use incident count alone as proof that an AI implementation has no emerging risk.
- Inspect temporal validation, segment error, data drift, concept labels, release dates and retraining criteria.
- Inspect monitoring design, owners, thresholds, near-misses, drift and documented actions for breaches.
- Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
Explanation
Correct Answers
A:The reason it is necessary is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier. For this situation: A loan model's feature quality deteriorates while management measures only historical quarterly losses.
D:The reason it is necessary is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier. The acceptable verified outcome is: Early warning signals prompt accountable preventive actions before unacceptable impact.
Incorrect Answers
B:This attractive shortcut does not resolve the AI risk monitoring through leading KRIs weakness: Use incident count alone as proof that an AI implementation has no emerging risk. For this situation: A loan model's feature quality deteriorates while management measures only historical quarterly losses.
C:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. In this case: A loan model's feature quality deteriorates while management measures only historical quarterly losses.
E:This option concerns Model concentration and systemic vendor dependency, which is a related but different AI governance concern. The decisive principle here is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier.
