Isaca AAIA Practice Test 9
Question 80
An independent AI auditor reviews this case: An AI fraud platform uses multiple models sharing one upstream feature store whose outage corrupts all scores simultaneously. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Treat a three-model vote as independent validation without checking shared data and error patterns.
- Evaluate shared data, dependencies and failure modes of model components, rather than counting models as independent assurance.
- Design usable human review with understandable context, authority to intervene, escalation and traceable decisions.
- Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
- Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
Explanation
Correct Answers
B:The reason it is necessary is: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated. This response fits the risk associated with Multi-model ensemble risk and failure correlation: Evaluate shared data, dependencies and failure modes of model components, rather than counting models as independent assurance.
D:The reason it is necessary is: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated. For this situation: An AI fraud platform uses multiple models sharing one upstream feature store whose outage corrupts all scores simultaneously.
Incorrect Answers
A:For this situation: An AI fraud platform uses multiple models sharing one upstream feature store whose outage corrupts all scores simultaneously.
C:This option concerns Human oversight design for high-impact AI, which is a related but different AI governance concern. The decisive principle here is: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated.
E:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. The audit must corroborate: Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
Question 81
A governance and assurance review uncovers the following: An insurer accepts consensus between foundation models from a common source without testing correlated hallucinations. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Evaluate shared data, dependencies and failure modes of model components, rather than counting models as independent assurance.
- Match the model family to the task, retain deterministic calculations where appropriate and validate generative outputs against trusted data and human review.
- Treat a three-model vote as independent validation without checking shared data and error patterns.
- Design usable human review with understandable context, authority to intervene, escalation and traceable decisions.
Explanation
Correct Answer
A:The reason it is necessary is: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated. In this case: An insurer accepts consensus between foundation models from a common source without testing correlated hallucinations.
Incorrect Answers
B:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. The decisive principle here is: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated.
C:This attractive shortcut does not resolve the Multi-model ensemble risk and failure correlation weakness: Treat a three-model vote as independent validation without checking shared data and error patterns. In this case: An insurer accepts consensus between foundation models from a common source without testing correlated hallucinations.
D:This option concerns Human oversight design for high-impact AI, which is a related but different AI governance concern. In this case: An insurer accepts consensus between foundation models from a common source without testing correlated hallucinations.
Question 82
A risk-based audit engagement examines this operating condition: An insurer accepts consensus between foundation models from a common source without testing correlated hallucinations. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Treat a three-model vote as independent validation without checking shared data and error patterns.
- An anomaly is a deviation from a learned baseline, not an independently verified fraud or misconduct conclusion.
- Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated.
- Generative fluency and predictive statistical accuracy address different tasks; auditors must test fitness for a defined business decision.
Explanation
Correct Answer
C:The corrective action is: Evaluate shared data, dependencies and failure modes of model components, rather than counting models as independent assurance. In this case: An insurer accepts consensus between foundation models from a common source without testing correlated hallucinations.
Incorrect Answers
A:This attractive shortcut does not resolve the Multi-model ensemble risk and failure correlation weakness: Treat a three-model vote as independent validation without checking shared data and error patterns. For this situation: An insurer accepts consensus between foundation models from a common source without testing correlated hallucinations.
B:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. It does not establish control effectiveness for Multi-model ensemble risk and failure correlation.
D:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. For this situation: An insurer accepts consensus between foundation models from a common source without testing correlated hallucinations.
Question 83
An audit committee asks for a defensible assessment of this situation: An insurer accepts consensus between foundation models from a common source without testing correlated hallucinations. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Treat a three-model vote as independent validation without checking shared data and error patterns.
- Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
- Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
- Compare use-case requirements, deterministic baselines, quantitative error rates, grounded outputs and exception handling.
Explanation
Correct Answer
B:This evidence directly tests the asserted control for Multi-model ensemble risk and failure correlation: Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
Incorrect Answers
A:For this situation: An insurer accepts consensus between foundation models from a common source without testing correlated hallucinations.
C:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. In this case: An insurer accepts consensus between foundation models from a common source without testing correlated hallucinations.
D:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. The audit must corroborate: Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
Question 84
During an AI controls assessment, the team learns that an insurer accepts consensus between foundation models from a common source without testing correlated hallucinations. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Adverse outcomes, challenge rights and corrections are monitored with approved accountable decision owners.
- Reviewers demonstrate independent judgment and appropriate overturns with auditable documentation.
- Independent challenge tests detect correlated failure and evidence supports any reliability uplift claimed for the ensemble.
- Treat a three-model vote as independent validation without checking shared data and error patterns.
Explanation
Correct Answer
C:The reason it is necessary is: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated. This is an observable validation result for Multi-model ensemble risk and failure correlation, not just management assurance: Independent challenge tests detect correlated failure and evidence supports any reliability uplift claimed for the ensemble.
Incorrect Answers
A:This option concerns Automated decision impact on individuals, which is a related but different AI governance concern. In this case: An insurer accepts consensus between foundation models from a common source without testing correlated hallucinations.
B:This option concerns Human oversight design for high-impact AI, which is a related but different AI governance concern. For this situation: An insurer accepts consensus between foundation models from a common source without testing correlated hallucinations.
D:The auditor should instead examine: Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
Question 85
An independent AI auditor reviews this case: A large retailer has no record of business teams using outside generative AI services for customer complaint summaries. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Assign decision rights and responsibilities for design, operation, risk acceptance, independent challenge and remediation.
- Classify AI uses by impact and autonomy, then apply evidence and approval gates proportionate to the actual exposure.
- Maintain a current AI system inventory covering owned, procured and embedded capabilities, data flows, owners and criticality.
- Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation.
Explanation
Correct Answer
C:The reason it is necessary is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown. The acceptable verified outcome is: Material AI uses are inventoried, risk-tiered and linked to approved business/data owners before production use.
Incorrect Answers
A:This option concerns Accountable ownership and three-lines roles, which is a related but different AI governance concern. It does not establish control effectiveness for Enterprise AI inventory and shadow-AI discovery.
B:This option concerns Risk-tiering and proportional approval gates, which is a related but different AI governance concern. It does not establish control effectiveness for Enterprise AI inventory and shadow-AI discovery.
D:This attractive shortcut does not resolve the Enterprise AI inventory and shadow-AI discovery weakness: Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation.
Question 86
A governance and assurance review uncovers the following: A large retailer has no record of business teams using outside generative AI services for customer complaint summaries. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Accountability requires named authorities with escalation and separation between control operation and independent assurance.
- Governance cannot assess or monitor AI risk if material use cases and external processors are unknown.
- Third-party AI outsourcing transfers processing, not the organization's accountability for data and decisions.
- Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation.
Explanation
Correct Answer
B:The acceptable verified outcome is: Material AI uses are inventoried, risk-tiered and linked to approved business/data owners before production use. This is the applicable AI audit principle for Enterprise AI inventory and shadow-AI discovery: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown.
Incorrect Answers
A:This option concerns Accountable ownership and three-lines roles, which is a related but different AI governance concern. The decisive principle here is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown.
C:This option concerns Third-party foundation model procurement assurance, which is a related but different AI governance concern. It does not establish control effectiveness for Enterprise AI inventory and shadow-AI discovery.
D:This attractive shortcut does not resolve the Enterprise AI inventory and shadow-AI discovery weakness: Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation. For this situation: A large retailer has no record of business teams using outside generative AI services for customer complaint summaries.
Question 87
A risk-based audit engagement examines this operating condition: A large retailer has no record of business teams using outside generative AI services for customer complaint summaries. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Review RACI, committee charters, risk decisions, escalation records, owner acceptance and audit independence.
- Compare approved risk appetite, model-level KRIs, customer impact metrics, exceptions and board action minutes.
- Reconcile software contracts, cloud billing, SSO logs, network egress, procurement and departmental attestations to inventory entries.
- Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation.
Explanation
Correct Answer
C:The reason it is necessary is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown. This evidence directly tests the asserted control for Enterprise AI inventory and shadow-AI discovery: Reconcile software contracts, cloud billing, SSO logs, network egress, procurement and departmental attestations to inventory entries.
Incorrect Answers
A:This option concerns Accountable ownership and three-lines roles, which is a related but different AI governance concern. For this situation: A large retailer has no record of business teams using outside generative AI services for customer complaint summaries.
B:This option concerns Board reporting of AI risk appetite and outcomes, which is a related but different AI governance concern. It does not establish control effectiveness for Enterprise AI inventory and shadow-AI discovery.
D:This attractive shortcut does not resolve the Enterprise AI inventory and shadow-AI discovery weakness: Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation. The auditor should instead examine: Reconcile software contracts, cloud billing, SSO logs, network egress, procurement and departmental attestations to inventory entries.
Question 88
An audit committee asks for a defensible assessment of this situation: A large retailer has no record of business teams using outside generative AI services for customer complaint summaries. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Expired or high-risk exceptions are renewed through accountable approval or removed with verified closure.
- A significant AI issue has a named accountable owner, documented decision and independent audit challenge.
- Material AI uses are inventoried, risk-tiered and linked to approved business/data owners before production use.
- Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation.
Explanation
Correct Answer
C:The reason it is necessary is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown. This is an observable validation result for Enterprise AI inventory and shadow-AI discovery, not just management assurance: Material AI uses are inventoried, risk-tiered and linked to approved business/data owners before production use.
Incorrect Answers
A:This option concerns AI policy exception governance, which is a related but different AI governance concern. It does not establish control effectiveness for Enterprise AI inventory and shadow-AI discovery.
B:This option concerns Accountable ownership and three-lines roles, which is a related but different AI governance concern. The audit must corroborate: Reconcile software contracts, cloud billing, SSO logs, network egress, procurement and departmental attestations to inventory entries.
D:This attractive shortcut does not resolve the Enterprise AI inventory and shadow-AI discovery weakness: Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation. Effective closure requires: Material AI uses are inventoried, risk-tiered and linked to approved business/data owners before production use.
Question 89
During an AI controls assessment, the team learns that a financial firm inventories only centrally hosted AI while embedded SaaS AI features make employee decisions. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Maintain a current AI system inventory covering owned, procured and embedded capabilities, data flows, owners and criticality.
- Assess vendor control evidence, data handling, change notification, subcontractors, portability and remedies before acceptance.
- Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation.
- Classify AI uses by impact and autonomy, then apply evidence and approval gates proportionate to the actual exposure.
Explanation
Correct Answer
A:The reason it is necessary is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown. In this case: A financial firm inventories only centrally hosted AI while embedded SaaS AI features make employee decisions.
Incorrect Answers
B:This option concerns Third-party foundation model procurement assurance, which is a related but different AI governance concern. The decisive principle here is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown.
C:This attractive shortcut does not resolve the Enterprise AI inventory and shadow-AI discovery weakness: Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation. In this case: A financial firm inventories only centrally hosted AI while embedded SaaS AI features make employee decisions.
D:This option concerns Risk-tiering and proportional approval gates, which is a related but different AI governance concern. The decisive principle here is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown.
Question 90
An independent AI auditor reviews this case: A financial firm inventories only centrally hosted AI while embedded SaaS AI features make employee decisions. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Assign decision rights and responsibilities for design, operation, risk acceptance, independent challenge and remediation.
- Maintain a current AI system inventory covering owned, procured and embedded capabilities, data flows, owners and criticality.
- Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation.
- Reconcile software contracts, cloud billing, SSO logs, network egress, procurement and departmental attestations to inventory entries.
- Compare approved risk appetite, model-level KRIs, customer impact metrics, exceptions and board action minutes.
Explanation
Correct Answers
B:The reason it is necessary is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown. For this situation: A financial firm inventories only centrally hosted AI while embedded SaaS AI features make employee decisions.
D:The reason it is necessary is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown. The corrective action is: Maintain a current AI system inventory covering owned, procured and embedded capabilities, data flows, owners and criticality.
Incorrect Answers
A:This option concerns Accountable ownership and three-lines roles, which is a related but different AI governance concern. In this case: A financial firm inventories only centrally hosted AI while embedded SaaS AI features make employee decisions.
C:This attractive shortcut does not resolve the Enterprise AI inventory and shadow-AI discovery weakness: Limit the AI register to projects whose name literally includes artificial intelligence and ignore embedded SaaS automation. For this situation: A financial firm inventories only centrally hosted AI while embedded SaaS AI features make employee decisions.
E:This option concerns Board reporting of AI risk appetite and outcomes, which is a related but different AI governance concern. The decisive principle here is: Governance cannot assess or monitor AI risk if material use cases and external processors are unknown.
