Isaca AAIA Practice Test 7
Question 60
An independent AI auditor reviews this case: A school deploys student-risk classification that determines interventions without measuring harms from false positives. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Examine decision map, error costs, affected populations, human override authority, complaints and impact assessment.
- Equate higher average accuracy with evidence that no person can be harmed by an automated decision.
- Assess individual and group impact before deployment, require proportional human intervention and record appeal and remediation processes.
- Require traceable retrieved-source references, corpus version controls and answer checks that distinguish source evidence from inference.
- Review cluster validation, anomaly score distributions, seasonal control populations, downstream actions and analyst adjudications.
Explanation
Correct Answers
A:The reason it is necessary is: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance. For this situation: A school deploys student-risk classification that determines interventions without measuring harms from false positives.
C:The reason it is necessary is: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance. This response fits the risk associated with Automated decision impact on individuals: Assess individual and group impact before deployment, require proportional human intervention and record appeal and remediation processes.
Incorrect Answers
B:It misses the key control principle: A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance.
D:This option concerns Retrieval-augmented answer grounding, which is a related but different AI governance concern. In this case: A school deploys student-risk classification that determines interventions without measuring harms from false positives.
E:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. The outcome to verify is: Adverse outcomes, challenge rights and corrections are monitored with approved accountable decision owners.
Question 61
A governance and assurance review uncovers the following: A recruitment system auto-rejects candidates even when its human reviewer only receives a read-only score with no override option. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Design usable human review with understandable context, authority to intervene, escalation and traceable decisions.
- Assess individual and group impact before deployment, require proportional human intervention and record appeal and remediation processes.
- Match the model family to the task, retain deterministic calculations where appropriate and validate generative outputs against trusted data and human review.
- Label a fully automatic process human supervised simply because a person can view a dashboard.
Explanation
Correct Answer
A:The reason it is necessary is: A human rubber stamp without information or authority does not provide effective human oversight. Independent audit evidence includes: Sample user interface, override permissions, time pressure, rationale records and actual reviewer interventions.
Incorrect Answers
B:This option concerns Automated decision impact on individuals, which is a related but different AI governance concern. It does not establish control effectiveness for Human oversight design for high-impact AI.
C:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. It does not establish control effectiveness for Human oversight design for high-impact AI.
D:This attractive shortcut does not resolve the Human oversight design for high-impact AI weakness: Label a fully automatic process human supervised simply because a person can view a dashboard.
Question 62
A risk-based audit engagement examines this operating condition: A recruitment system auto-rejects candidates even when its human reviewer only receives a read-only score with no override option. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- An anomaly is a deviation from a learned baseline, not an independently verified fraud or misconduct conclusion.
- Label a fully automatic process human supervised simply because a person can view a dashboard.
- A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance.
- A human rubber stamp without information or authority does not provide effective human oversight.
Explanation
Correct Answer
D:Independent audit evidence includes: Sample user interface, override permissions, time pressure, rationale records and actual reviewer interventions. This is the applicable AI audit principle for Human oversight design for high-impact AI: A human rubber stamp without information or authority does not provide effective human oversight.
Incorrect Answers
A:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. It does not establish control effectiveness for Human oversight design for high-impact AI.
B:This attractive shortcut does not resolve the Human oversight design for high-impact AI weakness: Label a fully automatic process human supervised simply because a person can view a dashboard. For this situation: A recruitment system auto-rejects candidates even when its human reviewer only receives a read-only score with no override option.
C:This option concerns Automated decision impact on individuals, which is a related but different AI governance concern. For this situation: A recruitment system auto-rejects candidates even when its human reviewer only receives a read-only score with no override option.
Question 63
An audit committee asks for a defensible assessment of this situation: A recruitment system auto-rejects candidates even when its human reviewer only receives a read-only score with no override option. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
- Sample user interface, override permissions, time pressure, rationale records and actual reviewer interventions.
- Label a fully automatic process human supervised simply because a person can view a dashboard.
- Compare use-case requirements, deterministic baselines, quantitative error rates, grounded outputs and exception handling.
Explanation
Correct Answer
B:The reason it is necessary is: A human rubber stamp without information or authority does not provide effective human oversight. This evidence directly tests the asserted control for Human oversight design for high-impact AI: Sample user interface, override permissions, time pressure, rationale records and actual reviewer interventions.
Incorrect Answers
A:This option concerns Multi-model ensemble risk and failure correlation, which is a related but different AI governance concern. It does not establish control effectiveness for Human oversight design for high-impact AI.
C:This attractive shortcut does not resolve the Human oversight design for high-impact AI weakness: Label a fully automatic process human supervised simply because a person can view a dashboard. The auditor should instead examine: Sample user interface, override permissions, time pressure, rationale records and actual reviewer interventions.
D:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. For this situation: A recruitment system auto-rejects candidates even when its human reviewer only receives a read-only score with no override option.
Question 64
During an AI controls assessment, the team learns that a recruitment system auto-rejects candidates even when its human reviewer only receives a read-only score with no override option. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- A stratified answer test shows supported citations, correct version use and safe abstention when evidence is absent.
- Independent challenge tests detect correlated failure and evidence supports any reliability uplift claimed for the ensemble.
- Label a fully automatic process human supervised simply because a person can view a dashboard.
- Reviewers demonstrate independent judgment and appropriate overturns with auditable documentation.
Explanation
Correct Answer
D:The reason it is necessary is: A human rubber stamp without information or authority does not provide effective human oversight. This is an observable validation result for Human oversight design for high-impact AI, not just management assurance: Reviewers demonstrate independent judgment and appropriate overturns with auditable documentation.
Incorrect Answers
A:This option concerns Retrieval-augmented answer grounding, which is a related but different AI governance concern. It does not establish control effectiveness for Human oversight design for high-impact AI.
B:This option concerns Multi-model ensemble risk and failure correlation, which is a related but different AI governance concern. For this situation: A recruitment system auto-rejects candidates even when its human reviewer only receives a read-only score with no override option.
C:This attractive shortcut does not resolve the Human oversight design for high-impact AI weakness: Label a fully automatic process human supervised simply because a person can view a dashboard. Effective closure requires: Reviewers demonstrate independent judgment and appropriate overturns with auditable documentation.
Question 65
An independent AI auditor reviews this case: A clinical recommendation engine provides confidence values but clinicians cannot see what inputs influenced its suggestion. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Design usable human review with understandable context, authority to intervene, escalation and traceable decisions.
- Assess individual and group impact before deployment, require proportional human intervention and record appeal and remediation processes.
- Label a fully automatic process human supervised simply because a person can view a dashboard.
- Evaluate training distribution, drift, thresholds, false-positive harms and human triage before using unsupervised scores for consequential actions.
Explanation
Correct Answer
A:The reason it is necessary is: A human rubber stamp without information or authority does not provide effective human oversight. In this case: A clinical recommendation engine provides confidence values but clinicians cannot see what inputs influenced its suggestion.
Incorrect Answers
B:This option concerns Automated decision impact on individuals, which is a related but different AI governance concern. The decisive principle here is: A human rubber stamp without information or authority does not provide effective human oversight.
C:This attractive shortcut does not resolve the Human oversight design for high-impact AI weakness: Label a fully automatic process human supervised simply because a person can view a dashboard. In this case: A clinical recommendation engine provides confidence values but clinicians cannot see what inputs influenced its suggestion.
D:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. The decisive principle here is: A human rubber stamp without information or authority does not provide effective human oversight.
Question 66
A governance and assurance review uncovers the following: A clinical recommendation engine provides confidence values but clinicians cannot see what inputs influenced its suggestion. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Generative fluency and predictive statistical accuracy address different tasks; auditors must test fitness for a defined business decision.
- An anomaly is a deviation from a learned baseline, not an independently verified fraud or misconduct conclusion.
- Label a fully automatic process human supervised simply because a person can view a dashboard.
- A human rubber stamp without information or authority does not provide effective human oversight.
Explanation
Correct Answer
D:Independent audit evidence includes: Sample user interface, override permissions, time pressure, rationale records and actual reviewer interventions. In this case: A clinical recommendation engine provides confidence values but clinicians cannot see what inputs influenced its suggestion.
Incorrect Answers
A:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. The decisive principle here is: A human rubber stamp without information or authority does not provide effective human oversight.
B:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. For this situation: A clinical recommendation engine provides confidence values but clinicians cannot see what inputs influenced its suggestion.
C:This attractive shortcut does not resolve the Human oversight design for high-impact AI weakness: Label a fully automatic process human supervised simply because a person can view a dashboard. For this situation: A clinical recommendation engine provides confidence values but clinicians cannot see what inputs influenced its suggestion.
Question 67
A risk-based audit engagement examines this operating condition: A clinical recommendation engine provides confidence values but clinicians cannot see what inputs influenced its suggestion. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Sample user interface, override permissions, time pressure, rationale records and actual reviewer interventions.
- Inspect retrieval traces, passage IDs, document dates, authorization filters, answer citation fidelity and no-answer cases.
- Review data categories, stakeholder impacts, alternatives, lawful basis, accuracy and mitigation decisions.
- Label a fully automatic process human supervised simply because a person can view a dashboard.
Explanation
Correct Answer
A:The reason it is necessary is: A human rubber stamp without information or authority does not provide effective human oversight. The corrective action is: Design usable human review with understandable context, authority to intervene, escalation and traceable decisions.
Incorrect Answers
B:This option concerns Retrieval-augmented answer grounding, which is a related but different AI governance concern. The decisive principle here is: A human rubber stamp without information or authority does not provide effective human oversight.
C:This option concerns Privacy impact assessment for biometric AI, which is a related but different AI governance concern. It does not establish control effectiveness for Human oversight design for high-impact AI.
D:This attractive shortcut does not resolve the Human oversight design for high-impact AI weakness: Label a fully automatic process human supervised simply because a person can view a dashboard. Design usable human review with understandable context, authority to intervene, escalation and traceable decisions.
Question 68
An audit committee asks for a defensible assessment of this situation: A clinical recommendation engine provides confidence values but clinicians cannot see what inputs influenced its suggestion. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Reviewers demonstrate independent judgment and appropriate overturns with auditable documentation.
- Label a fully automatic process human supervised simply because a person can view a dashboard.
- Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives.
- Independent challenge tests detect correlated failure and evidence supports any reliability uplift claimed for the ensemble.
Explanation
Correct Answer
A:The reason it is necessary is: A human rubber stamp without information or authority does not provide effective human oversight. The acceptable verified outcome is: Reviewers demonstrate independent judgment and appropriate overturns with auditable documentation.
Incorrect Answers
B:For this situation: A clinical recommendation engine provides confidence values but clinicians cannot see what inputs influenced its suggestion.
C:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. It does not establish control effectiveness for Human oversight design for high-impact AI.
D:This option concerns Multi-model ensemble risk and failure correlation, which is a related but different AI governance concern. The decisive principle here is: A human rubber stamp without information or authority does not provide effective human oversight.
Question 69
During an AI controls assessment, the team learns that a social benefits model permits staff to override outcomes but never records the reason or who changed the result. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Design usable human review with understandable context, authority to intervene, escalation and traceable decisions.
- Conduct a documented impact assessment of purpose, necessity, proportionality, alternatives and safeguards before deployment.
- Require traceable retrieved-source references, corpus version controls and answer checks that distinguish source evidence from inference.
- Label a fully automatic process human supervised simply because a person can view a dashboard.
Explanation
Correct Answer
A:The reason it is necessary is: A human rubber stamp without information or authority does not provide effective human oversight. In this case: A social benefits model permits staff to override outcomes but never records the reason or who changed the result.
Incorrect Answers
B:This option concerns Privacy impact assessment for biometric AI, which is a related but different AI governance concern. The decisive principle here is: A human rubber stamp without information or authority does not provide effective human oversight.
C:This option concerns Retrieval-augmented answer grounding, which is a related but different AI governance concern. In this case: A social benefits model permits staff to override outcomes but never records the reason or who changed the result.
D:This attractive shortcut does not resolve the Human oversight design for high-impact AI weakness: Label a fully automatic process human supervised simply because a person can view a dashboard. In this case: A social benefits model permits staff to override outcomes but never records the reason or who changed the result.
Question 70
An independent AI auditor reviews this case: A social benefits model permits staff to override outcomes but never records the reason or who changed the result. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Label a fully automatic process human supervised simply because a person can view a dashboard.
- Design usable human review with understandable context, authority to intervene, escalation and traceable decisions.
- Conduct a documented impact assessment of purpose, necessity, proportionality, alternatives and safeguards before deployment.
- Sample user interface, override permissions, time pressure, rationale records and actual reviewer interventions.
- Review cluster validation, anomaly score distributions, seasonal control populations, downstream actions and analyst adjudications.
Explanation
Correct Answers
B:The reason it is necessary is: A human rubber stamp without information or authority does not provide effective human oversight. For this situation: A social benefits model permits staff to override outcomes but never records the reason or who changed the result.
D:This evidence directly tests the asserted control for Human oversight design for high-impact AI: Sample user interface, override permissions, time pressure, rationale records and actual reviewer interventions.
Incorrect Answers
A:This attractive shortcut does not resolve the Human oversight design for high-impact AI weakness: Label a fully automatic process human supervised simply because a person can view a dashboard. For this situation: A social benefits model permits staff to override outcomes but never records the reason or who changed the result.
C:This option concerns Privacy impact assessment for biometric AI, which is a related but different AI governance concern. For this situation: A social benefits model permits staff to override outcomes but never records the reason or who changed the result.
E:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. In this case: A social benefits model permits staff to override outcomes but never records the reason or who changed the result.
