Isaca AAIA Practice Test 26
Question 250
An independent AI auditor reviews this case: A loan model's feature quality deteriorates while management measures only historical quarterly losses. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Track leading behavior, data-quality and control indicators with thresholds linked to risk appetite.
- Use incident count alone as proof that an AI implementation has no emerging risk.
- Inspect temporal validation, segment error, data drift, concept labels, release dates and retraining criteria.
- Inspect monitoring design, owners, thresholds, near-misses, drift and documented actions for breaches.
- Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
Explanation
Correct Answers
A:The reason it is necessary is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier. For this situation: A loan model's feature quality deteriorates while management measures only historical quarterly losses.
D:The reason it is necessary is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier. The acceptable verified outcome is: Early warning signals prompt accountable preventive actions before unacceptable impact.
Incorrect Answers
B:This attractive shortcut does not resolve the AI risk monitoring through leading KRIs weakness: Use incident count alone as proof that an AI implementation has no emerging risk. For this situation: A loan model's feature quality deteriorates while management measures only historical quarterly losses.
C:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. In this case: A loan model's feature quality deteriorates while management measures only historical quarterly losses.
E:This option concerns Model concentration and systemic vendor dependency, which is a related but different AI governance concern. The decisive principle here is: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier.
Question 251
A governance and assurance review uncovers the following: A loan model's feature quality deteriorates while management measures only historical quarterly losses. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect monitoring design, owners, thresholds, near-misses, drift and documented actions for breaches.
- Use incident count alone as proof that an AI implementation has no emerging risk.
- Review dependency map, provider incidents, contract exit clauses, portability tests and fallback workflows.
- Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
Explanation
Correct Answer
A:For this situation: A loan model's feature quality deteriorates while management measures only historical quarterly losses.
Incorrect Answers
B:It misses the key control principle: Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier.
C:This option concerns Model concentration and systemic vendor dependency, which is a related but different AI governance concern. For this situation: A loan model's feature quality deteriorates while management measures only historical quarterly losses.
D:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. It does not establish control effectiveness for AI risk monitoring through leading KRIs.
Question 252
A risk-based audit engagement examines this operating condition: A loan model's feature quality deteriorates while management measures only historical quarterly losses. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives.
- Drift alerts trigger timely review and validated model changes without uncontrolled retraining.
- Use incident count alone as proof that an AI implementation has no emerging risk.
- Early warning signals prompt accountable preventive actions before unacceptable impact.
Explanation
Correct Answer
D:This is an observable validation result for AI risk monitoring through leading KRIs, not just management assurance: Early warning signals prompt accountable preventive actions before unacceptable impact.
Incorrect Answers
A:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. For this situation: A loan model's feature quality deteriorates while management measures only historical quarterly losses.
B:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. For this situation: A loan model's feature quality deteriorates while management measures only historical quarterly losses.
C:The auditor should instead examine: Inspect monitoring design, owners, thresholds, near-misses, drift and documented actions for breaches.
Question 253
An audit committee asks for a defensible assessment of this situation: An insurer trains a marketing propensity model on records collected solely for claims settlement without analyzing reuse authority. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Match the model family to the task, retain deterministic calculations where appropriate and validate generative outputs against trusted data and human review.
- Validate intended secondary use against lawful basis, original purposes and documented governance before training.
- Assume internal ownership of raw data permits unrestricted model training for any unrelated objective.
- Conduct a documented impact assessment of purpose, necessity, proportionality, alternatives and safeguards before deployment.
Explanation
Correct Answer
B:The reason it is necessary is: Availability of data inside a company does not imply every new AI training purpose is authorized. The acceptable verified outcome is: Only permitted records enter the use case, with documented restrictions and review of new purposes.
Incorrect Answers
A:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. It does not establish control effectiveness for Purpose limitation in AI training data reuse.
C:This attractive shortcut does not resolve the Purpose limitation in AI training data reuse weakness: Assume internal ownership of raw data permits unrestricted model training for any unrelated objective.
D:This option concerns Privacy impact assessment for biometric AI, which is a related but different AI governance concern. It does not establish control effectiveness for Purpose limitation in AI training data reuse.
Question 254
During an AI controls assessment, the team learns that an insurer trains a marketing propensity model on records collected solely for claims settlement without analyzing reuse authority. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Assume internal ownership of raw data permits unrestricted model training for any unrelated objective.
- Availability of data inside a company does not imply every new AI training purpose is authorized.
- Privacy by design changes processing architecture rather than relying solely on downstream access policy.
- High-impact monitoring of people can cause harm even when encryption and access controls are sound.
Explanation
Correct Answer
B:The acceptable verified outcome is: Only permitted records enter the use case, with documented restrictions and review of new purposes. In this case: An insurer trains a marketing propensity model on records collected solely for claims settlement without analyzing reuse authority.
Incorrect Answers
A:This attractive shortcut does not resolve the Purpose limitation in AI training data reuse weakness: Assume internal ownership of raw data permits unrestricted model training for any unrelated objective. For this situation: An insurer trains a marketing propensity model on records collected solely for claims settlement without analyzing reuse authority.
C:This option concerns Privacy by design for model features, which is a related but different AI governance concern. It does not establish control effectiveness for Purpose limitation in AI training data reuse.
D:This option concerns Privacy impact assessment for biometric AI, which is a related but different AI governance concern. For this situation: An insurer trains a marketing propensity model on records collected solely for claims settlement without analyzing reuse authority.
Question 255
An independent AI auditor reviews this case: An insurer trains a marketing propensity model on records collected solely for claims settlement without analyzing reuse authority. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect notices, collection purposes, privacy review, access approvals, lineage and training-set membership.
- Assume internal ownership of raw data permits unrestricted model training for any unrelated objective.
- Inspect region endpoints, service architecture, contractual transfer mechanisms, subprocessor lists and logs.
- Compare use-case requirements, deterministic baselines, quantitative error rates, grounded outputs and exception handling.
Explanation
Correct Answer
A:The reason it is necessary is: Availability of data inside a company does not imply every new AI training purpose is authorized. In this case: An insurer trains a marketing propensity model on records collected solely for claims settlement without analyzing reuse authority.
Incorrect Answers
B:This attractive shortcut does not resolve the Purpose limitation in AI training data reuse weakness: Assume internal ownership of raw data permits unrestricted model training for any unrelated objective. The auditor should instead examine: Inspect notices, collection purposes, privacy review, access approvals, lineage and training-set membership.
C:This option concerns Cross-border AI data transfer mapping, which is a related but different AI governance concern. It does not establish control effectiveness for Purpose limitation in AI training data reuse.
D:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. For this situation: An insurer trains a marketing propensity model on records collected solely for claims settlement without analyzing reuse authority.
Question 256
A governance and assurance review uncovers the following: An insurer trains a marketing propensity model on records collected solely for claims settlement without analyzing reuse authority. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Only permitted records enter the use case, with documented restrictions and review of new purposes.
- Selected components meet task-specific accuracy, controllability and auditability tests on representative work.
- Assume internal ownership of raw data permits unrestricted model training for any unrelated objective.
- Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives.
Explanation
Correct Answer
A:The reason it is necessary is: Availability of data inside a company does not imply every new AI training purpose is authorized. Independent audit evidence includes: Inspect notices, collection purposes, privacy review, access approvals, lineage and training-set membership.
Incorrect Answers
B:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. The decisive principle here is: Availability of data inside a company does not imply every new AI training purpose is authorized.
C:This attractive shortcut does not resolve the Purpose limitation in AI training data reuse weakness: Assume internal ownership of raw data permits unrestricted model training for any unrelated objective. Effective closure requires: Only permitted records enter the use case, with documented restrictions and review of new purposes.
D:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. It does not establish control effectiveness for Purpose limitation in AI training data reuse.
Question 257
A risk-based audit engagement examines this operating condition: A hospital fine-tunes a general assistant on patient notes without checking approved purposes or access constraints. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Conduct a documented impact assessment of purpose, necessity, proportionality, alternatives and safeguards before deployment.
- Define defensible retention, deletion and downstream propagation processes with technical evidence of execution.
- Validate intended secondary use against lawful basis, original purposes and documented governance before training.
- Assume internal ownership of raw data permits unrestricted model training for any unrelated objective.
Explanation
Correct Answer
C:The reason it is necessary is: Availability of data inside a company does not imply every new AI training purpose is authorized. In this case: A hospital fine-tunes a general assistant on patient notes without checking approved purposes or access constraints.
Incorrect Answers
A:This option concerns Privacy impact assessment for biometric AI, which is a related but different AI governance concern. The decisive principle here is: Availability of data inside a company does not imply every new AI training purpose is authorized.
B:This option concerns AI inference retention and right-to-erasure handling, which is a related but different AI governance concern. It does not establish control effectiveness for Purpose limitation in AI training data reuse.
D:This attractive shortcut does not resolve the Purpose limitation in AI training data reuse weakness: Assume internal ownership of raw data permits unrestricted model training for any unrelated objective. In this case: A hospital fine-tunes a general assistant on patient notes without checking approved purposes or access constraints.
Question 258
An audit committee asks for a defensible assessment of this situation: A hospital fine-tunes a general assistant on patient notes without checking approved purposes or access constraints. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Availability of data inside a company does not imply every new AI training purpose is authorized.
- Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations.
- Data minimization reduces privacy exposure at input, storage, retrieval and telemetry stages.
- Assume internal ownership of raw data permits unrestricted model training for any unrelated objective.
Explanation
Correct Answer
A:The acceptable verified outcome is: Only permitted records enter the use case, with documented restrictions and review of new purposes. In this case: A hospital fine-tunes a general assistant on patient notes without checking approved purposes or access constraints.
Incorrect Answers
B:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. The decisive principle here is: Availability of data inside a company does not imply every new AI training purpose is authorized.
C:This option concerns Data minimization and PII in prompts, which is a related but different AI governance concern. It does not establish control effectiveness for Purpose limitation in AI training data reuse.
D:This attractive shortcut does not resolve the Purpose limitation in AI training data reuse weakness: Assume internal ownership of raw data permits unrestricted model training for any unrelated objective. For this situation: A hospital fine-tunes a general assistant on patient notes without checking approved purposes or access constraints.
Question 259
During an AI controls assessment, the team learns that a hospital fine-tunes a general assistant on patient notes without checking approved purposes or access constraints. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect region endpoints, service architecture, contractual transfer mechanisms, subprocessor lists and logs.
- Assume internal ownership of raw data permits unrestricted model training for any unrelated objective.
- Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
- Inspect notices, collection purposes, privacy review, access approvals, lineage and training-set membership.
Explanation
Correct Answer
D:The reason it is necessary is: Availability of data inside a company does not imply every new AI training purpose is authorized. This evidence directly tests the asserted control for Purpose limitation in AI training data reuse: Inspect notices, collection purposes, privacy review, access approvals, lineage and training-set membership.
Incorrect Answers
A:This option concerns Cross-border AI data transfer mapping, which is a related but different AI governance concern. The decisive principle here is: Availability of data inside a company does not imply every new AI training purpose is authorized.
B:This attractive shortcut does not resolve the Purpose limitation in AI training data reuse weakness: Assume internal ownership of raw data permits unrestricted model training for any unrelated objective. Validate intended secondary use against lawful basis, original purposes and documented governance before training.
C:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. For this situation: A hospital fine-tunes a general assistant on patient notes without checking approved purposes or access constraints.
Question 260
An independent AI auditor reviews this case: A hospital fine-tunes a general assistant on patient notes without checking approved purposes or access constraints. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Validate intended secondary use against lawful basis, original purposes and documented governance before training.
- Inspect region endpoints, service architecture, contractual transfer mechanisms, subprocessor lists and logs.
- Assume internal ownership of raw data permits unrestricted model training for any unrelated objective.
- Minimize exposed attributes, redact unnecessary personal data and enforce purpose-bound access before model calls.
- Inspect notices, collection purposes, privacy review, access approvals, lineage and training-set membership.
Explanation
Correct Answers
A:The reason it is necessary is: Availability of data inside a company does not imply every new AI training purpose is authorized. For this situation: A hospital fine-tunes a general assistant on patient notes without checking approved purposes or access constraints.
E:The reason it is necessary is: Availability of data inside a company does not imply every new AI training purpose is authorized. The corrective action is: Validate intended secondary use against lawful basis, original purposes and documented governance before training.
Incorrect Answers
B:This option concerns Cross-border AI data transfer mapping, which is a related but different AI governance concern. For this situation: A hospital fine-tunes a general assistant on patient notes without checking approved purposes or access constraints.
C:For this situation: A hospital fine-tunes a general assistant on patient notes without checking approved purposes or access constraints.
D:This option concerns Data minimization and PII in prompts, which is a related but different AI governance concern. For this situation: A hospital fine-tunes a general assistant on patient notes without checking approved purposes or access constraints.
