Isaca AAIA Practice Test 39
Question 380
An independent AI auditor reviews this case: A visual AI kiosk provides no accessible channel to challenge automated denial for disabled visitors. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Evaluate foreseeable disparate impacts, accessibility needs, stakeholder participation and proportional mitigation.
- Declare an AI system ethical because average test accuracy is high even when underserved groups cannot use it.
- Assess subgroup outcomes, proxy variables, relevant legitimate factors and mitigations with lawful context.
- Inspect AI inventory, contextual risk register, model evaluations, management treatment and oversight minutes.
- Inspect subgroup and accessibility tests, documented stakeholder input, complaints and corrective actions.
Explanation
Correct Answers
A:The acceptable verified outcome is: Affected groups can access fair service and outcomes are reassessed after changes. This response fits the risk associated with Fairness and accessibility ethical governance: Evaluate foreseeable disparate impacts, accessibility needs, stakeholder participation and proportional mitigation.
E:The corrective action is: Evaluate foreseeable disparate impacts, accessibility needs, stakeholder participation and proportional mitigation. For this situation: A visual AI kiosk provides no accessible channel to challenge automated denial for disabled visitors.
Incorrect Answers
B:For this situation: A visual AI kiosk provides no accessible channel to challenge automated denial for disabled visitors.
C:This option concerns Fairness assessment for proxy discrimination, which is a related but different AI governance concern. For this situation: A visual AI kiosk provides no accessible channel to challenge automated denial for disabled visitors.
D:This option concerns NIST AI RMF governance and measurement alignment, which is a related but different AI governance concern. The decisive principle here is: Responsible AI assessment includes human and social outcomes beyond aggregate technical model accuracy.
Question 381
A governance and assurance review uncovers the following: An employment model performs well for full-time employees but poorly for part-time caregivers. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Declare an AI system ethical because average test accuracy is high even when underserved groups cannot use it.
- Assess contextual transparency duties, affected audiences and effective disclosure mechanisms appropriate to use.
- Assess subgroup outcomes, proxy variables, relevant legitimate factors and mitigations with lawful context.
- Evaluate foreseeable disparate impacts, accessibility needs, stakeholder participation and proportional mitigation.
Explanation
Correct Answer
D:The acceptable verified outcome is: Affected groups can access fair service and outcomes are reassessed after changes. In this case: An employment model performs well for full-time employees but poorly for part-time caregivers.
Incorrect Answers
A:This attractive shortcut does not resolve the Fairness and accessibility ethical governance weakness: Declare an AI system ethical because average test accuracy is high even when underserved groups cannot use it. In this case: An employment model performs well for full-time employees but poorly for part-time caregivers.
B:This option concerns AI transparency and meaningful disclosure, which is a related but different AI governance concern. It does not establish control effectiveness for Fairness and accessibility ethical governance.
C:This option concerns Fairness assessment for proxy discrimination, which is a related but different AI governance concern. In this case: An employment model performs well for full-time employees but poorly for part-time caregivers.
Question 382
A risk-based audit engagement examines this operating condition: An employment model performs well for full-time employees but poorly for part-time caregivers. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Declare an AI system ethical because average test accuracy is high even when underserved groups cannot use it.
- Governance exceptions are controlled risk decisions rather than silent removal of mandated requirements.
- Responsible AI assessment includes human and social outcomes beyond aggregate technical model accuracy.
- ISO/IEC 42001 describes requirements for an AI management system, not instant proof from a policy document.
Explanation
Correct Answer
C:The corrective action is: Evaluate foreseeable disparate impacts, accessibility needs, stakeholder participation and proportional mitigation. In this case: An employment model performs well for full-time employees but poorly for part-time caregivers.
Incorrect Answers
A:This attractive shortcut does not resolve the Fairness and accessibility ethical governance weakness: Declare an AI system ethical because average test accuracy is high even when underserved groups cannot use it. For this situation: An employment model performs well for full-time employees but poorly for part-time caregivers.
B:This option concerns AI policy exception governance, which is a related but different AI governance concern. In this case: An employment model performs well for full-time employees but poorly for part-time caregivers.
D:This option concerns ISO IEC 42001 AI management system controls, which is a related but different AI governance concern. In this case: An employment model performs well for full-time employees but poorly for part-time caregivers.
Question 383
An audit committee asks for a defensible assessment of this situation: An employment model performs well for full-time employees but poorly for part-time caregivers. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect approved exception register, justifications, expiry, control alternatives and follow-up evidence.
- Inspect AI inventory, contextual risk register, model evaluations, management treatment and oversight minutes.
- Declare an AI system ethical because average test accuracy is high even when underserved groups cannot use it.
- Inspect subgroup and accessibility tests, documented stakeholder input, complaints and corrective actions.
Explanation
Correct Answer
D:The corrective action is: Evaluate foreseeable disparate impacts, accessibility needs, stakeholder participation and proportional mitigation. The reason it is necessary is: Responsible AI assessment includes human and social outcomes beyond aggregate technical model accuracy.
Incorrect Answers
A:This option concerns AI policy exception governance, which is a related but different AI governance concern. For this situation: An employment model performs well for full-time employees but poorly for part-time caregivers.
B:This option concerns NIST AI RMF governance and measurement alignment, which is a related but different AI governance concern. In this case: An employment model performs well for full-time employees but poorly for part-time caregivers.
C:For this situation: An employment model performs well for full-time employees but poorly for part-time caregivers.
Question 384
During an AI controls assessment, the team learns that an employment model performs well for full-time employees but poorly for part-time caregivers. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Fairness monitoring detects problematic disparities and remediation does not conceal residual performance impacts.
- Declare an AI system ethical because average test accuracy is high even when underserved groups cannot use it.
- Affected users receive meaningful notice where required and can distinguish AI outputs from human decisions.
- Affected groups can access fair service and outcomes are reassessed after changes.
Explanation
Correct Answer
D:The corrective action is: Evaluate foreseeable disparate impacts, accessibility needs, stakeholder participation and proportional mitigation. Independent audit evidence includes: Inspect subgroup and accessibility tests, documented stakeholder input, complaints and corrective actions.
Incorrect Answers
A:This option concerns Fairness assessment for proxy discrimination, which is a related but different AI governance concern. For this situation: An employment model performs well for full-time employees but poorly for part-time caregivers.
B:It misses the key control principle: Responsible AI assessment includes human and social outcomes beyond aggregate technical model accuracy.
C:This option concerns AI transparency and meaningful disclosure, which is a related but different AI governance concern. For this situation: An employment model performs well for full-time employees but poorly for part-time caregivers.
Question 385
An independent AI auditor reviews this case: A compliance memo states all EU AI Act high-risk duties applied to every system on 2 August 2026 despite phased provisions. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Assess AI management-system scope, documented processes, internal monitoring and continual improvement against applicable clauses.
- Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere.
- Assess contextual transparency duties, affected audiences and effective disclosure mechanisms appropriate to use.
- Maintain jurisdiction-specific legal mapping with version dates, accountable counsel and periodic applicability reviews.
Explanation
Correct Answer
D:The reason it is necessary is: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management. This is the proportionate control response to Regulatory change tracking without overclaiming compliance: Maintain jurisdiction-specific legal mapping with version dates, accountable counsel and periodic applicability reviews.
Incorrect Answers
A:This option concerns ISO IEC 42001 AI management system controls, which is a related but different AI governance concern. It does not establish control effectiveness for Regulatory change tracking without overclaiming compliance.
B:This attractive shortcut does not resolve the Regulatory change tracking without overclaiming compliance weakness: Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere.
C:This option concerns AI transparency and meaningful disclosure, which is a related but different AI governance concern. It does not establish control effectiveness for Regulatory change tracking without overclaiming compliance.
Question 386
A governance and assurance review uncovers the following: A compliance memo states all EU AI Act high-risk duties applied to every system on 2 August 2026 despite phased provisions. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Responsible AI assessment includes human and social outcomes beyond aggregate technical model accuracy.
- AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management.
- Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere.
- Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls.
Explanation
Correct Answer
B:The acceptable verified outcome is: Material regulatory changes are recognized and implementation plans accurately reflect currently applicable provisions. This is the applicable AI audit principle for Regulatory change tracking without overclaiming compliance: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management.
Incorrect Answers
A:This option concerns Fairness and accessibility ethical governance, which is a related but different AI governance concern. It does not establish control effectiveness for Regulatory change tracking without overclaiming compliance.
C:This attractive shortcut does not resolve the Regulatory change tracking without overclaiming compliance weakness: Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere. For this situation: A compliance memo states all EU AI Act high-risk duties applied to every system on 2 August 2026 despite phased provisions.
D:This option concerns AI transparency and meaningful disclosure, which is a related but different AI governance concern. For this situation: A compliance memo states all EU AI Act high-risk duties applied to every system on 2 August 2026 despite phased provisions.
Question 387
A risk-based audit engagement examines this operating condition: A compliance memo states all EU AI Act high-risk duties applied to every system on 2 August 2026 despite phased provisions. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect subgroup and accessibility tests, documented stakeholder input, complaints and corrective actions.
- Examine governing texts, role assessment, applicability dates, legal signoff and evidence of controls.
- Inspect AIMS scope, roles, risk treatment, audit outcomes, nonconformities and management reviews.
- Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere.
Explanation
Correct Answer
B:The reason it is necessary is: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management. This evidence directly tests the asserted control for Regulatory change tracking without overclaiming compliance: Examine governing texts, role assessment, applicability dates, legal signoff and evidence of controls.
Incorrect Answers
A:This option concerns Fairness and accessibility ethical governance, which is a related but different AI governance concern. For this situation: A compliance memo states all EU AI Act high-risk duties applied to every system on 2 August 2026 despite phased provisions.
C:This option concerns ISO IEC 42001 AI management system controls, which is a related but different AI governance concern. For this situation: A compliance memo states all EU AI Act high-risk duties applied to every system on 2 August 2026 despite phased provisions.
D:This attractive shortcut does not resolve the Regulatory change tracking without overclaiming compliance weakness: Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere. The auditor should instead examine: Examine governing texts, role assessment, applicability dates, legal signoff and evidence of controls.
Question 388
An audit committee asks for a defensible assessment of this situation: A compliance memo states all EU AI Act high-risk duties applied to every system on 2 August 2026 despite phased provisions. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Material regulatory changes are recognized and implementation plans accurately reflect currently applicable provisions.
- The documented risk cycle links context, measurement, ownership and treatment for sampled systems.
- Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere.
- Organization documents role-specific obligations and controls for its actual use and checks changes over time.
Explanation
Correct Answer
A:The reason it is necessary is: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management. This is an observable validation result for Regulatory change tracking without overclaiming compliance, not just management assurance: Material regulatory changes are recognized and implementation plans accurately reflect currently applicable provisions.
Incorrect Answers
B:This option concerns NIST AI RMF governance and measurement alignment, which is a related but different AI governance concern. It does not establish control effectiveness for Regulatory change tracking without overclaiming compliance.
C:This attractive shortcut does not resolve the Regulatory change tracking without overclaiming compliance weakness: Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere. Effective closure requires: Material regulatory changes are recognized and implementation plans accurately reflect currently applicable provisions.
D:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. It does not establish control effectiveness for Regulatory change tracking without overclaiming compliance.
Question 389
During an AI controls assessment, the team learns that an AI vendor reports permanent global compliance from one region's policy mapping and ignores changes to applicable rules. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Maintain jurisdiction-specific legal mapping with version dates, accountable counsel and periodic applicability reviews.
- Require decision-level explanations proportionate to the use case, validated predictive benefit, documented limitations and a meaningful appeal path.
- Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere.
- Evaluate foreseeable disparate impacts, accessibility needs, stakeholder participation and proportional mitigation.
Explanation
Correct Answer
A:The reason it is necessary is: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management. The acceptable verified outcome is: Material regulatory changes are recognized and implementation plans accurately reflect currently applicable provisions.
Incorrect Answers
B:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. It does not establish control effectiveness for Regulatory change tracking without overclaiming compliance.
C:This attractive shortcut does not resolve the Regulatory change tracking without overclaiming compliance weakness: Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere. In this case: An AI vendor reports permanent global compliance from one region's policy mapping and ignores changes to applicable rules.
D:This option concerns Fairness and accessibility ethical governance, which is a related but different AI governance concern. The decisive principle here is: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management.
Question 390
An independent AI auditor reviews this case: An AI vendor reports permanent global compliance from one region's policy mapping and ignores changes to applicable rules. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Maintain jurisdiction-specific legal mapping with version dates, accountable counsel and periodic applicability reviews.
- Inspect subgroup and accessibility tests, documented stakeholder input, complaints and corrective actions.
- Examine governing texts, role assessment, applicability dates, legal signoff and evidence of controls.
- Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere.
- Assess AI management-system scope, documented processes, internal monitoring and continual improvement against applicable clauses.
Explanation
Correct Answers
A:This response fits the risk associated with Regulatory change tracking without overclaiming compliance: Maintain jurisdiction-specific legal mapping with version dates, accountable counsel and periodic applicability reviews.
C:The reason it is necessary is: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management. In this case: An AI vendor reports permanent global compliance from one region's policy mapping and ignores changes to applicable rules.
Incorrect Answers
B:This option concerns Fairness and accessibility ethical governance, which is a related but different AI governance concern. For this situation: An AI vendor reports permanent global compliance from one region's policy mapping and ignores changes to applicable rules.
D:This attractive shortcut does not resolve the Regulatory change tracking without overclaiming compliance weakness: Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere. For this situation: An AI vendor reports permanent global compliance from one region's policy mapping and ignores changes to applicable rules.
E:This option concerns ISO IEC 42001 AI management system controls, which is a related but different AI governance concern. The decisive principle here is: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management.
