Isaca AAIA Practice Test 6
Question 50
An independent AI auditor reviews this case: A hospital proposes an AI triage score that reallocates appointments without assessing delays for patients with disabilities. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Assess individual and group impact before deployment, require proportional human intervention and record appeal and remediation processes.
- Equate higher average accuracy with evidence that no person can be harmed by an automated decision.
- Design usable human review with understandable context, authority to intervene, escalation and traceable decisions.
- Review cluster validation, anomaly score distributions, seasonal control populations, downstream actions and analyst adjudications.
- Examine decision map, error costs, affected populations, human override authority, complaints and impact assessment.
Explanation
Correct Answers
A:The reason it is necessary is: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance. For this situation: A hospital proposes an AI triage score that reallocates appointments without assessing delays for patients with disabilities.
E:The reason it is necessary is: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance. This evidence directly tests the asserted control for Automated decision impact on individuals: Examine decision map, error costs, affected populations, human override authority, complaints and impact assessment.
Incorrect Answers
B:This attractive shortcut does not resolve the Automated decision impact on individuals weakness: Equate higher average accuracy with evidence that no person can be harmed by an automated decision. For this situation: A hospital proposes an AI triage score that reallocates appointments without assessing delays for patients with disabilities.
C:This option concerns Human oversight design for high-impact AI, which is a related but different AI governance concern. For this situation: A hospital proposes an AI triage score that reallocates appointments without assessing delays for patients with disabilities.
D:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. It does not establish control effectiveness for Automated decision impact on individuals.
Question 51
A governance and assurance review uncovers the following: A hospital proposes an AI triage score that reallocates appointments without assessing delays for patients with disabilities. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
- Sample user interface, override permissions, time pressure, rationale records and actual reviewer interventions.
- Equate higher average accuracy with evidence that no person can be harmed by an automated decision.
- Examine decision map, error costs, affected populations, human override authority, complaints and impact assessment.
Explanation
Correct Answer
D:The reason it is necessary is: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance. The corrective action is: Assess individual and group impact before deployment, require proportional human intervention and record appeal and remediation processes.
Incorrect Answers
A:This option concerns Multi-model ensemble risk and failure correlation, which is a related but different AI governance concern. It does not establish control effectiveness for Automated decision impact on individuals.
B:This option concerns Human oversight design for high-impact AI, which is a related but different AI governance concern. The decisive principle here is: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance.
C:This attractive shortcut does not resolve the Automated decision impact on individuals weakness: Equate higher average accuracy with evidence that no person can be harmed by an automated decision. It misses the key control principle: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance.
Question 52
A risk-based audit engagement examines this operating condition: A hospital proposes an AI triage score that reallocates appointments without assessing delays for patients with disabilities. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Adverse outcomes, challenge rights and corrections are monitored with approved accountable decision owners.
- Use case proceeds only with documented lawful purpose and proportionate risk treatment or is stopped.
- Selected components meet task-specific accuracy, controllability and auditability tests on representative work.
- Equate higher average accuracy with evidence that no person can be harmed by an automated decision.
Explanation
Correct Answer
A:The reason it is necessary is: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance. This is an observable validation result for Automated decision impact on individuals, not just management assurance: Adverse outcomes, challenge rights and corrections are monitored with approved accountable decision owners.
Incorrect Answers
B:This option concerns Privacy impact assessment for biometric AI, which is a related but different AI governance concern. It does not establish control effectiveness for Automated decision impact on individuals.
C:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. It does not establish control effectiveness for Automated decision impact on individuals.
D:This attractive shortcut does not resolve the Automated decision impact on individuals weakness: Equate higher average accuracy with evidence that no person can be harmed by an automated decision. The auditor should instead examine: Examine decision map, error costs, affected populations, human override authority, complaints and impact assessment.
Question 53
An audit committee asks for a defensible assessment of this situation: A municipality ranks housing-assistance applicants automatically although there is no documented appeals process. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Assess individual and group impact before deployment, require proportional human intervention and record appeal and remediation processes.
- Evaluate training distribution, drift, thresholds, false-positive harms and human triage before using unsupervised scores for consequential actions.
- Equate higher average accuracy with evidence that no person can be harmed by an automated decision.
- Require traceable retrieved-source references, corpus version controls and answer checks that distinguish source evidence from inference.
Explanation
Correct Answer
A:The reason it is necessary is: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance. Independent audit evidence includes: Examine decision map, error costs, affected populations, human override authority, complaints and impact assessment.
Incorrect Answers
B:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. The decisive principle here is: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance.
C:This attractive shortcut does not resolve the Automated decision impact on individuals weakness: Equate higher average accuracy with evidence that no person can be harmed by an automated decision. Effective closure requires: Adverse outcomes, challenge rights and corrections are monitored with approved accountable decision owners.
D:This option concerns Retrieval-augmented answer grounding, which is a related but different AI governance concern. It does not establish control effectiveness for Automated decision impact on individuals.
Question 54
During an AI controls assessment, the team learns that a municipality ranks housing-assistance applicants automatically although there is no documented appeals process. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance.
- Equate higher average accuracy with evidence that no person can be harmed by an automated decision.
- An anomaly is a deviation from a learned baseline, not an independently verified fraud or misconduct conclusion.
- A human rubber stamp without information or authority does not provide effective human oversight.
Explanation
Correct Answer
A:Independent audit evidence includes: Examine decision map, error costs, affected populations, human override authority, complaints and impact assessment. This is the applicable AI audit principle for Automated decision impact on individuals: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance.
Incorrect Answers
B:This attractive shortcut does not resolve the Automated decision impact on individuals weakness: Equate higher average accuracy with evidence that no person can be harmed by an automated decision. For this situation: A municipality ranks housing-assistance applicants automatically although there is no documented appeals process.
C:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. For this situation: A municipality ranks housing-assistance applicants automatically although there is no documented appeals process.
D:This option concerns Human oversight design for high-impact AI, which is a related but different AI governance concern. The audit must corroborate: Examine decision map, error costs, affected populations, human override authority, complaints and impact assessment.
Question 55
An independent AI auditor reviews this case: A municipality ranks housing-assistance applicants automatically although there is no documented appeals process. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Review cluster validation, anomaly score distributions, seasonal control populations, downstream actions and analyst adjudications.
- Equate higher average accuracy with evidence that no person can be harmed by an automated decision.
- Examine decision map, error costs, affected populations, human override authority, complaints and impact assessment.
- Compare use-case requirements, deterministic baselines, quantitative error rates, grounded outputs and exception handling.
Explanation
Correct Answer
C:The reason it is necessary is: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance. The acceptable verified outcome is: Adverse outcomes, challenge rights and corrections are monitored with approved accountable decision owners.
Incorrect Answers
A:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. The audit must corroborate: Examine decision map, error costs, affected populations, human override authority, complaints and impact assessment.
B:This attractive shortcut does not resolve the Automated decision impact on individuals weakness: Equate higher average accuracy with evidence that no person can be harmed by an automated decision. Assess individual and group impact before deployment, require proportional human intervention and record appeal and remediation processes.
D:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. The decisive principle here is: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance.
Question 56
A governance and assurance review uncovers the following: A municipality ranks housing-assistance applicants automatically although there is no documented appeals process. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Equate higher average accuracy with evidence that no person can be harmed by an automated decision.
- A stratified answer test shows supported citations, correct version use and safe abstention when evidence is absent.
- Selected components meet task-specific accuracy, controllability and auditability tests on representative work.
- Adverse outcomes, challenge rights and corrections are monitored with approved accountable decision owners.
Explanation
Correct Answer
D:The reason it is necessary is: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance. In this case: A municipality ranks housing-assistance applicants automatically although there is no documented appeals process.
Incorrect Answers
A:For this situation: A municipality ranks housing-assistance applicants automatically although there is no documented appeals process.
B:This option concerns Retrieval-augmented answer grounding, which is a related but different AI governance concern. For this situation: A municipality ranks housing-assistance applicants automatically although there is no documented appeals process.
C:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. For this situation: A municipality ranks housing-assistance applicants automatically although there is no documented appeals process.
Question 57
A risk-based audit engagement examines this operating condition: A school deploys student-risk classification that determines interventions without measuring harms from false positives. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Design usable human review with understandable context, authority to intervene, escalation and traceable decisions.
- Assess individual and group impact before deployment, require proportional human intervention and record appeal and remediation processes.
- Evaluate training distribution, drift, thresholds, false-positive harms and human triage before using unsupervised scores for consequential actions.
- Equate higher average accuracy with evidence that no person can be harmed by an automated decision.
Explanation
Correct Answer
B:The reason it is necessary is: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance. In this case: A school deploys student-risk classification that determines interventions without measuring harms from false positives.
Incorrect Answers
A:This option concerns Human oversight design for high-impact AI, which is a related but different AI governance concern. In this case: A school deploys student-risk classification that determines interventions without measuring harms from false positives.
C:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. In this case: A school deploys student-risk classification that determines interventions without measuring harms from false positives.
D:This attractive shortcut does not resolve the Automated decision impact on individuals weakness: Equate higher average accuracy with evidence that no person can be harmed by an automated decision. In this case: A school deploys student-risk classification that determines interventions without measuring harms from false positives.
Question 58
An audit committee asks for a defensible assessment of this situation: A school deploys student-risk classification that determines interventions without measuring harms from false positives. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- An anomaly is a deviation from a learned baseline, not an independently verified fraud or misconduct conclusion.
- Equate higher average accuracy with evidence that no person can be harmed by an automated decision.
- A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance.
- Model suitability depends on performance, explainability and consequences of errors; a marginal metric gain does not remove oversight obligations.
Explanation
Correct Answer
C:Independent audit evidence includes: Examine decision map, error costs, affected populations, human override authority, complaints and impact assessment. In this case: A school deploys student-risk classification that determines interventions without measuring harms from false positives.
Incorrect Answers
A:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. For this situation: A school deploys student-risk classification that determines interventions without measuring harms from false positives.
B:This attractive shortcut does not resolve the Automated decision impact on individuals weakness: Equate higher average accuracy with evidence that no person can be harmed by an automated decision. For this situation: A school deploys student-risk classification that determines interventions without measuring harms from false positives.
D:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. In this case: A school deploys student-risk classification that determines interventions without measuring harms from false positives.
Question 59
During an AI controls assessment, the team learns that a school deploys student-risk classification that determines interventions without measuring harms from false positives. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Examine decision map, error costs, affected populations, human override authority, complaints and impact assessment.
- Equate higher average accuracy with evidence that no person can be harmed by an automated decision.
- Review cluster validation, anomaly score distributions, seasonal control populations, downstream actions and analyst adjudications.
- Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
Explanation
Correct Answer
A:In this case: A school deploys student-risk classification that determines interventions without measuring harms from false positives.
Incorrect Answers
B:For this situation: A school deploys student-risk classification that determines interventions without measuring harms from false positives.
C:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. A proportionate response is: Assess individual and group impact before deployment, require proportional human intervention and record appeal and remediation processes.
D:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. For this situation: A school deploys student-risk classification that determines interventions without measuring harms from false positives.
Question 60
An independent AI auditor reviews this case: A school deploys student-risk classification that determines interventions without measuring harms from false positives. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Examine decision map, error costs, affected populations, human override authority, complaints and impact assessment.
- Equate higher average accuracy with evidence that no person can be harmed by an automated decision.
- Assess individual and group impact before deployment, require proportional human intervention and record appeal and remediation processes.
- Require traceable retrieved-source references, corpus version controls and answer checks that distinguish source evidence from inference.
- Review cluster validation, anomaly score distributions, seasonal control populations, downstream actions and analyst adjudications.
Explanation
Correct Answers
A:The reason it is necessary is: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance. For this situation: A school deploys student-risk classification that determines interventions without measuring harms from false positives.
C:The reason it is necessary is: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance. This response fits the risk associated with Automated decision impact on individuals: Assess individual and group impact before deployment, require proportional human intervention and record appeal and remediation processes.
Incorrect Answers
B:It misses the key control principle: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance.
D:This option concerns Retrieval-augmented answer grounding, which is a related but different AI governance concern. In this case: A school deploys student-risk classification that determines interventions without measuring harms from false positives.
E:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. The outcome to verify is: Adverse outcomes, challenge rights and corrections are monitored with approved accountable decision owners.
