Isaca AAIA Practice Test 37
Question 360
An independent AI auditor reviews this case: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Identify relevant AI Act roles, use-case classifications, jurisdictions and applicable obligations with competent legal input.
- Assess contextual transparency duties, affected audiences and effective disclosure mechanisms appropriate to use.
- Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities.
- Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
- Review use-case map, stakeholders, failure modes, risk register, impact assumptions and challenge workshops.
Explanation
Correct Answers
A:The reason it is necessary is: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding. For this situation: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities.
D:The acceptable verified outcome is: Organization documents role-specific obligations and controls for its actual use and checks changes over time.
Incorrect Answers
B:This option concerns AI transparency and meaningful disclosure, which is a related but different AI governance concern. For this situation: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities.
C:It misses the key control principle: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding.
E:This option concerns AI use-case risk scenario identification, which is a related but different AI governance concern. For this situation: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities.
Question 361
A governance and assurance review uncovers the following: A customer-service agent impersonates a human without telling consumers that answers are AI-generated where disclosure applies. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Maintain jurisdiction-specific legal mapping with version dates, accountable counsel and periodic applicability reviews.
- Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph.
- Assess contextual transparency duties, affected audiences and effective disclosure mechanisms appropriate to use.
- Require decision-level explanations proportionate to the use case, validated predictive benefit, documented limitations and a meaningful appeal path.
Explanation
Correct Answer
C:The reason it is necessary is: Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls. The acceptable verified outcome is: Affected users receive meaningful notice where required and can distinguish AI outputs from human decisions.
Incorrect Answers
A:This option concerns Regulatory change tracking without overclaiming compliance, which is a related but different AI governance concern. It does not establish control effectiveness for AI transparency and meaningful disclosure.
B:This attractive shortcut does not resolve the AI transparency and meaningful disclosure weakness: Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph.
D:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. It does not establish control effectiveness for AI transparency and meaningful disclosure.
Question 362
A risk-based audit engagement examines this operating condition: A customer-service agent impersonates a human without telling consumers that answers are AI-generated where disclosure applies. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- NIST AI RMF 1.0 provides risk-management functions, not a universal legal compliance certificate.
- Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph.
- Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls.
- Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations.
Explanation
Correct Answer
C:The acceptable verified outcome is: Affected users receive meaningful notice where required and can distinguish AI outputs from human decisions. This is the applicable AI audit principle for AI transparency and meaningful disclosure: Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls.
Incorrect Answers
A:This option concerns NIST AI RMF governance and measurement alignment, which is a related but different AI governance concern. It does not establish control effectiveness for AI transparency and meaningful disclosure.
B:This attractive shortcut does not resolve the AI transparency and meaningful disclosure weakness: Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph. For this situation: A customer-service agent impersonates a human without telling consumers that answers are AI-generated where disclosure applies.
D:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. For this situation: A customer-service agent impersonates a human without telling consumers that answers are AI-generated where disclosure applies.
Question 363
An audit committee asks for a defensible assessment of this situation: A customer-service agent impersonates a human without telling consumers that answers are AI-generated where disclosure applies. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect UI disclosures, synthesized content labels, user testing, jurisdiction analysis and change approvals.
- Inspect subgroup and accessibility tests, documented stakeholder input, complaints and corrective actions.
- Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
- Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph.
Explanation
Correct Answer
A:The reason it is necessary is: Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls. In this case: A customer-service agent impersonates a human without telling consumers that answers are AI-generated where disclosure applies.
Incorrect Answers
B:This option concerns Fairness and accessibility ethical governance, which is a related but different AI governance concern. It does not establish control effectiveness for AI transparency and meaningful disclosure.
C:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. The decisive principle here is: Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls.
D:This attractive shortcut does not resolve the AI transparency and meaningful disclosure weakness: Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph. The auditor should instead examine: Inspect UI disclosures, synthesized content labels, user testing, jurisdiction analysis and change approvals.
Question 364
During an AI controls assessment, the team learns that a customer-service agent impersonates a human without telling consumers that answers are AI-generated where disclosure applies. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Sampled AI processes show implemented controls and closed corrective actions, with any certification claims substantiated.
- Affected users receive meaningful notice where required and can distinguish AI outputs from human decisions.
- Material regulatory changes are recognized and implementation plans accurately reflect currently applicable provisions.
- Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph.
Explanation
Correct Answer
B:The reason it is necessary is: Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls. This is an observable validation result for AI transparency and meaningful disclosure, not just management assurance: Affected users receive meaningful notice where required and can distinguish AI outputs from human decisions.
Incorrect Answers
A:This option concerns ISO IEC 42001 AI management system controls, which is a related but different AI governance concern. It does not establish control effectiveness for AI transparency and meaningful disclosure.
C:This option concerns Regulatory change tracking without overclaiming compliance, which is a related but different AI governance concern. For this situation: A customer-service agent impersonates a human without telling consumers that answers are AI-generated where disclosure applies.
D:This attractive shortcut does not resolve the AI transparency and meaningful disclosure weakness: Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph. Effective closure requires: Affected users receive meaningful notice where required and can distinguish AI outputs from human decisions.
Question 365
An independent AI auditor reviews this case: A loan assistant makes recommendations while users cannot distinguish automated findings from human approval. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph.
- Assess AI management-system scope, documented processes, internal monitoring and continual improvement against applicable clauses.
- Maintain jurisdiction-specific legal mapping with version dates, accountable counsel and periodic applicability reviews.
- Assess contextual transparency duties, affected audiences and effective disclosure mechanisms appropriate to use.
Explanation
Correct Answer
D:The reason it is necessary is: Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls. In this case: A loan assistant makes recommendations while users cannot distinguish automated findings from human approval.
Incorrect Answers
A:This attractive shortcut does not resolve the AI transparency and meaningful disclosure weakness: Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph. In this case: A loan assistant makes recommendations while users cannot distinguish automated findings from human approval.
B:This option concerns ISO IEC 42001 AI management system controls, which is a related but different AI governance concern. The decisive principle here is: Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls.
C:This option concerns Regulatory change tracking without overclaiming compliance, which is a related but different AI governance concern. The decisive principle here is: Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls.
Question 366
A governance and assurance review uncovers the following: A loan assistant makes recommendations while users cannot distinguish automated findings from human approval. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph.
- Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls.
- Generative fluency and predictive statistical accuracy address different tasks; auditors must test fitness for a defined business decision.
- AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management.
Explanation
Correct Answer
B:The acceptable verified outcome is: Affected users receive meaningful notice where required and can distinguish AI outputs from human decisions. In this case: A loan assistant makes recommendations while users cannot distinguish automated findings from human approval.
Incorrect Answers
A:This attractive shortcut does not resolve the AI transparency and meaningful disclosure weakness: Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph. For this situation: A loan assistant makes recommendations while users cannot distinguish automated findings from human approval.
C:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. It does not establish control effectiveness for AI transparency and meaningful disclosure.
D:This option concerns Regulatory change tracking without overclaiming compliance, which is a related but different AI governance concern. For this situation: A loan assistant makes recommendations while users cannot distinguish automated findings from human approval.
Question 367
A risk-based audit engagement examines this operating condition: A loan assistant makes recommendations while users cannot distinguish automated findings from human approval. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Examine governing texts, role assessment, applicability dates, legal signoff and evidence of controls.
- Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
- Inspect UI disclosures, synthesized content labels, user testing, jurisdiction analysis and change approvals.
- Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph.
Explanation
Correct Answer
C:The reason it is necessary is: Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls. This evidence directly tests the asserted control for AI transparency and meaningful disclosure: Inspect UI disclosures, synthesized content labels, user testing, jurisdiction analysis and change approvals.
Incorrect Answers
A:This option concerns Regulatory change tracking without overclaiming compliance, which is a related but different AI governance concern. The audit must corroborate: Inspect UI disclosures, synthesized content labels, user testing, jurisdiction analysis and change approvals.
B:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. In this case: A loan assistant makes recommendations while users cannot distinguish automated findings from human approval.
D:This attractive shortcut does not resolve the AI transparency and meaningful disclosure weakness: Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph. Assess contextual transparency duties, affected audiences and effective disclosure mechanisms appropriate to use.
Question 368
An audit committee asks for a defensible assessment of this situation: A loan assistant makes recommendations while users cannot distinguish automated findings from human approval. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Affected users receive meaningful notice where required and can distinguish AI outputs from human decisions.
- Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives.
- Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph.
- Sampled AI processes show implemented controls and closed corrective actions, with any certification claims substantiated.
Explanation
Correct Answer
A:The reason it is necessary is: Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls. Independent audit evidence includes: Inspect UI disclosures, synthesized content labels, user testing, jurisdiction analysis and change approvals.
Incorrect Answers
B:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. For this situation: A loan assistant makes recommendations while users cannot distinguish automated findings from human approval.
C:For this situation: A loan assistant makes recommendations while users cannot distinguish automated findings from human approval.
D:This option concerns ISO IEC 42001 AI management system controls, which is a related but different AI governance concern. For this situation: A loan assistant makes recommendations while users cannot distinguish automated findings from human approval.
Question 369
During an AI controls assessment, the team learns that an organization publishes manipulated promotional footage without evaluating relevant content-labeling obligations. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Assess AI management-system scope, documented processes, internal monitoring and continual improvement against applicable clauses.
- Require decision-level explanations proportionate to the use case, validated predictive benefit, documented limitations and a meaningful appeal path.
- Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph.
- Assess contextual transparency duties, affected audiences and effective disclosure mechanisms appropriate to use.
Explanation
Correct Answer
D:The reason it is necessary is: Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls. In this case: An organization publishes manipulated promotional footage without evaluating relevant content-labeling obligations.
Incorrect Answers
A:This option concerns ISO IEC 42001 AI management system controls, which is a related but different AI governance concern. In this case: An organization publishes manipulated promotional footage without evaluating relevant content-labeling obligations.
B:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. In this case: An organization publishes manipulated promotional footage without evaluating relevant content-labeling obligations.
C:This attractive shortcut does not resolve the AI transparency and meaningful disclosure weakness: Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph. In this case: An organization publishes manipulated promotional footage without evaluating relevant content-labeling obligations.
Question 370
An independent AI auditor reviews this case: An organization publishes manipulated promotional footage without evaluating relevant content-labeling obligations. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Inspect AIMS scope, roles, risk treatment, audit outcomes, nonconformities and management reviews.
- Match the model family to the task, retain deterministic calculations where appropriate and validate generative outputs against trusted data and human review.
- Assess contextual transparency duties, affected audiences and effective disclosure mechanisms appropriate to use.
- Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph.
- Inspect UI disclosures, synthesized content labels, user testing, jurisdiction analysis and change approvals.
Explanation
Correct Answers
C:The reason it is necessary is: Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls. For this situation: An organization publishes manipulated promotional footage without evaluating relevant content-labeling obligations.
E:The reason it is necessary is: Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls. The corrective action is: Assess contextual transparency duties, affected audiences and effective disclosure mechanisms appropriate to use.
Incorrect Answers
A:This option concerns ISO IEC 42001 AI management system controls, which is a related but different AI governance concern. For this situation: An organization publishes manipulated promotional footage without evaluating relevant content-labeling obligations.
B:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. The decisive principle here is: Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls.
D:This attractive shortcut does not resolve the AI transparency and meaningful disclosure weakness: Hide AI-generated content origin entirely and rely on a buried terms-of-service paragraph. For this situation: An organization publishes manipulated promotional footage without evaluating relevant content-labeling obligations.
