Isaca AAIA Practice Test 40
Question 390
An independent AI auditor reviews this case: An AI vendor reports permanent global compliance from one region's policy mapping and ignores changes to applicable rules. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Maintain jurisdiction-specific legal mapping with version dates, accountable counsel and periodic applicability reviews.
- Inspect subgroup and accessibility tests, documented stakeholder input, complaints and corrective actions.
- Examine governing texts, role assessment, applicability dates, legal signoff and evidence of controls.
- Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere.
- Assess AI management-system scope, documented processes, internal monitoring and continual improvement against applicable clauses.
Explanation
Correct Answers
A:This response fits the risk associated with Regulatory change tracking without overclaiming compliance: Maintain jurisdiction-specific legal mapping with version dates, accountable counsel and periodic applicability reviews.
C:The reason it is necessary is: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management. In this case: An AI vendor reports permanent global compliance from one region's policy mapping and ignores changes to applicable rules.
Incorrect Answers
B:This option concerns Fairness and accessibility ethical governance, which is a related but different AI governance concern. For this situation: An AI vendor reports permanent global compliance from one region's policy mapping and ignores changes to applicable rules.
D:This attractive shortcut does not resolve the Regulatory change tracking without overclaiming compliance weakness: Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere. For this situation: An AI vendor reports permanent global compliance from one region's policy mapping and ignores changes to applicable rules.
E:This option concerns ISO IEC 42001 AI management system controls, which is a related but different AI governance concern. The decisive principle here is: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management.
Question 391
A governance and assurance review uncovers the following: An AI vendor reports permanent global compliance from one region's policy mapping and ignores changes to applicable rules. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Compare use-case requirements, deterministic baselines, quantitative error rates, grounded outputs and exception handling.
- Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere.
- Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
- Examine governing texts, role assessment, applicability dates, legal signoff and evidence of controls.
Explanation
Correct Answer
D:The reason it is necessary is: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management. For this situation: An AI vendor reports permanent global compliance from one region's policy mapping and ignores changes to applicable rules.
Incorrect Answers
A:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. It does not establish control effectiveness for Regulatory change tracking without overclaiming compliance.
B:This attractive shortcut does not resolve the Regulatory change tracking without overclaiming compliance weakness: Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere. Maintain jurisdiction-specific legal mapping with version dates, accountable counsel and periodic applicability reviews.
C:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. For this situation: An AI vendor reports permanent global compliance from one region's policy mapping and ignores changes to applicable rules.
Question 392
A risk-based audit engagement examines this operating condition: An AI vendor reports permanent global compliance from one region's policy mapping and ignores changes to applicable rules. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere.
- Selected components meet task-specific accuracy, controllability and auditability tests on representative work.
- Material regulatory changes are recognized and implementation plans accurately reflect currently applicable provisions.
- Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives.
Explanation
Correct Answer
C:The reason it is necessary is: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management. Independent audit evidence includes: Examine governing texts, role assessment, applicability dates, legal signoff and evidence of controls.
Incorrect Answers
A:For this situation: An AI vendor reports permanent global compliance from one region's policy mapping and ignores changes to applicable rules.
B:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. For this situation: An AI vendor reports permanent global compliance from one region's policy mapping and ignores changes to applicable rules.
D:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. The decisive principle here is: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management.
Question 393
An audit committee asks for a defensible assessment of this situation: A bank stores a stale obligations spreadsheet while its new AI product enters additional jurisdictions. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Assess AI management-system scope, documented processes, internal monitoring and continual improvement against applicable clauses.
- Match the model family to the task, retain deterministic calculations where appropriate and validate generative outputs against trusted data and human review.
- Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere.
- Maintain jurisdiction-specific legal mapping with version dates, accountable counsel and periodic applicability reviews.
Explanation
Correct Answer
D:The reason it is necessary is: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management. In this case: A bank stores a stale obligations spreadsheet while its new AI product enters additional jurisdictions.
Incorrect Answers
A:This option concerns ISO IEC 42001 AI management system controls, which is a related but different AI governance concern. In this case: A bank stores a stale obligations spreadsheet while its new AI product enters additional jurisdictions.
B:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. The decisive principle here is: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management.
C:This attractive shortcut does not resolve the Regulatory change tracking without overclaiming compliance weakness: Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere. In this case: A bank stores a stale obligations spreadsheet while its new AI product enters additional jurisdictions.
Question 394
During an AI controls assessment, the team learns that a bank stores a stale obligations spreadsheet while its new AI product enters additional jurisdictions. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere.
- AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management.
- ISO/IEC 42001 describes requirements for an AI management system, not instant proof from a policy document.
- Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls.
Explanation
Correct Answer
B:The acceptable verified outcome is: Material regulatory changes are recognized and implementation plans accurately reflect currently applicable provisions. In this case: A bank stores a stale obligations spreadsheet while its new AI product enters additional jurisdictions.
Incorrect Answers
A:This attractive shortcut does not resolve the Regulatory change tracking without overclaiming compliance weakness: Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere. For this situation: A bank stores a stale obligations spreadsheet while its new AI product enters additional jurisdictions.
C:This option concerns ISO IEC 42001 AI management system controls, which is a related but different AI governance concern. For this situation: A bank stores a stale obligations spreadsheet while its new AI product enters additional jurisdictions.
D:This option concerns AI transparency and meaningful disclosure, which is a related but different AI governance concern. The decisive principle here is: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management.
Question 395
An independent AI auditor reviews this case: A bank stores a stale obligations spreadsheet while its new AI product enters additional jurisdictions. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Examine governing texts, role assessment, applicability dates, legal signoff and evidence of controls.
- Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
- Inspect AIMS scope, roles, risk treatment, audit outcomes, nonconformities and management reviews.
- Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere.
Explanation
Correct Answer
A:The reason it is necessary is: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management. The corrective action is: Maintain jurisdiction-specific legal mapping with version dates, accountable counsel and periodic applicability reviews.
Incorrect Answers
B:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. In this case: A bank stores a stale obligations spreadsheet while its new AI product enters additional jurisdictions.
C:This option concerns ISO IEC 42001 AI management system controls, which is a related but different AI governance concern. The audit must corroborate: Examine governing texts, role assessment, applicability dates, legal signoff and evidence of controls.
D:For this situation: A bank stores a stale obligations spreadsheet while its new AI product enters additional jurisdictions.
Question 396
A governance and assurance review uncovers the following: A bank stores a stale obligations spreadsheet while its new AI product enters additional jurisdictions. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Use a single outdated blog summary to claim every AI legal obligation has already taken effect everywhere.
- Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives.
- Material regulatory changes are recognized and implementation plans accurately reflect currently applicable provisions.
- Affected groups can access fair service and outcomes are reassessed after changes.
Explanation
Correct Answer
C:This is an observable validation result for Regulatory change tracking without overclaiming compliance, not just management assurance: Material regulatory changes are recognized and implementation plans accurately reflect currently applicable provisions.
Incorrect Answers
A:It misses the key control principle: AI regulation evolves and often applies by role, use, and effective date; one blanket statement can mislead management.
B:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. For this situation: A bank stores a stale obligations spreadsheet while its new AI product enters additional jurisdictions.
D:This option concerns Fairness and accessibility ethical governance, which is a related but different AI governance concern. In this case: A bank stores a stale obligations spreadsheet while its new AI product enters additional jurisdictions.
Question 397
A risk-based audit engagement examines this operating condition: A bank's fraud model changes after a retraining run but nobody can identify which customer data snapshot generated the weights. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Version and trace training, validation and inference datasets with accountable lineage, hashes and reproducible pipeline metadata.
- Treat the current live database as proof of what the model saw during a prior training run.
- Enforce point-in-time joins and temporal cutoffs for training and evaluation features.
- Validate provenance and anomaly patterns for incoming data, quarantine suspicious updates and approve retraining sources.
Explanation
Correct Answer
A:The reason it is necessary is: AI outputs cannot be audited reliably when their source records, transformations and model lineage cannot be reconstructed. The acceptable verified outcome is: An independent rerun can identify the exact source data and material transformation decisions for a sampled model version.
Incorrect Answers
B:This attractive shortcut does not resolve the AI training dataset lineage and reproducibility weakness: Treat the current live database as proof of what the model saw during a prior training run.
C:This option concerns Feature-store time leakage in model evaluation, which is a related but different AI governance concern. It does not establish control effectiveness for AI training dataset lineage and reproducibility.
D:This option concerns Data poisoning prevention in automated ingestion, which is a related but different AI governance concern. It does not establish control effectiveness for AI training dataset lineage and reproducibility.
Question 398
An audit committee asks for a defensible assessment of this situation: A bank's fraud model changes after a retraining run but nobody can identify which customer data snapshot generated the weights. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- AI outputs cannot be audited reliably when their source records, transformations and model lineage cannot be reconstructed.
- Private text can leak through retrieval even if the visible application screen enforces role-based access.
- Garbage or inconsistent ground-truth labels cap model validity even if the learning algorithm is sophisticated.
- Treat the current live database as proof of what the model saw during a prior training run.
Explanation
Correct Answer
A:The acceptable verified outcome is: An independent rerun can identify the exact source data and material transformation decisions for a sampled model version. This is the applicable AI audit principle for AI training dataset lineage and reproducibility: AI outputs cannot be audited reliably when their source records, transformations and model lineage cannot be reconstructed.
Incorrect Answers
B:This option concerns RAG corpus access controls and tenant segregation, which is a related but different AI governance concern. It does not establish control effectiveness for AI training dataset lineage and reproducibility.
C:This option concerns Label quality and human annotator agreement, which is a related but different AI governance concern. It does not establish control effectiveness for AI training dataset lineage and reproducibility.
D:This attractive shortcut does not resolve the AI training dataset lineage and reproducibility weakness: Treat the current live database as proof of what the model saw during a prior training run. For this situation: A bank's fraud model changes after a retraining run but nobody can identify which customer data snapshot generated the weights.
Question 399
During an AI controls assessment, the team learns that a bank's fraud model changes after a retraining run but nobody can identify which customer data snapshot generated the weights. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect dataset snapshots, feature pipeline commits, record counts, model registry links and training execution manifests.
- Inspect training/evaluation overlap, duplicate hashes, benchmark dates, partition strategy and blind results.
- Inspect feature timestamps, label windows, join keys, leakage tests and reconstructed historical decisions.
- Treat the current live database as proof of what the model saw during a prior training run.
Explanation
Correct Answer
A:The reason it is necessary is: AI outputs cannot be audited reliably when their source records, transformations and model lineage cannot be reconstructed. In this case: A bank's fraud model changes after a retraining run but nobody can identify which customer data snapshot generated the weights.
Incorrect Answers
B:This option concerns Training and evaluation benchmark contamination, which is a related but different AI governance concern. It does not establish control effectiveness for AI training dataset lineage and reproducibility.
C:This option concerns Feature-store time leakage in model evaluation, which is a related but different AI governance concern. For this situation: A bank's fraud model changes after a retraining run but nobody can identify which customer data snapshot generated the weights.
D:This attractive shortcut does not resolve the AI training dataset lineage and reproducibility weakness: Treat the current live database as proof of what the model saw during a prior training run. The auditor should instead examine: Inspect dataset snapshots, feature pipeline commits, record counts, model registry links and training execution manifests.
Question 400
An independent AI auditor reviews this case: A bank's fraud model changes after a retraining run but nobody can identify which customer data snapshot generated the weights. Which THREE elements together provide a defensible AI audit conclusion: the corrective control, the evidence to test it, and a verified outcome? Select THREE answers.
- Version and trace training, validation and inference datasets with accountable lineage, hashes and reproducible pipeline metadata.
- Compare ingestion source identities, sampling patterns, hash manifests, anomaly screens and approval records.
- Use independent held-out evaluations with leakage checks and repeatable challenge sets not tuned into training.
- Treat the current live database as proof of what the model saw during a prior training run.
- Inspect dataset snapshots, feature pipeline commits, record counts, model registry links and training execution manifests.
- An independent rerun can identify the exact source data and material transformation decisions for a sampled model version.
Explanation
Correct Answers
A:The reason it is necessary is: AI outputs cannot be audited reliably when their source records, transformations and model lineage cannot be reconstructed. For this situation: A bank's fraud model changes after a retraining run but nobody can identify which customer data snapshot generated the weights.
E:The reason it is necessary is: AI outputs cannot be audited reliably when their source records, transformations and model lineage cannot be reconstructed. This evidence directly tests the asserted control for AI training dataset lineage and reproducibility: Inspect dataset snapshots, feature pipeline commits, record counts, model registry links and training execution manifests.
F:The reason it is necessary is: AI outputs cannot be audited reliably when their source records, transformations and model lineage cannot be reconstructed. Independent audit evidence includes: Inspect dataset snapshots, feature pipeline commits, record counts, model registry links and training execution manifests.
Incorrect Answers
B:This option concerns Data poisoning prevention in automated ingestion, which is a related but different AI governance concern. For this situation: A bank's fraud model changes after a retraining run but nobody can identify which customer data snapshot generated the weights.
C:This option concerns Training and evaluation benchmark contamination, which is a related but different AI governance concern. For this situation: A bank's fraud model changes after a retraining run but nobody can identify which customer data snapshot generated the weights.
D:This attractive shortcut does not resolve the AI training dataset lineage and reproducibility weakness: Treat the current live database as proof of what the model saw during a prior training run. Effective closure requires: An independent rerun can identify the exact source data and material transformation decisions for a sampled model version.
