cert
cert-1
cert-2

Pass Isaca AAIA Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AAIA Exam - Verified By Experts
AAIA Premium Bundle
$14.99

AAIA Premium Bundle

$74.99
$89.98
  • Premium File 556 Questions & Answers. Last update: Nov 08, 2026
  • Training Course 110 Video Lectures
 
$89.98
$74.99
accept 22 downloads in last 7 days
block-screenshots
Purchase Isaca AAIA Exam Training Products Individually
Isaca AAIA Premium File
Premium File 556 Q&A
$76.99$69.99
Isaca AAIA Video Training Course
Training Course 110 Lectures
$21.99 $19.99
Isaca AAIA Practice Test 97

Question 960

An independent AI auditor reviews this case: An internal audit team audits a low-risk autocomplete project but overlooks a live medical triage model without independent review. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Reconcile AI inventory, data flows, business ownership, complaints, material incidents and risk appetite to audit plan.
  2. Audit only applications with AI in their product title and assume vendor features are out of scope.
  3. Define the AI audit universe and scope using use-case impact, third parties, control reliance and key risk scenarios.
  4. Inspect approved tool use, input sensitivity, model version, generated risk ranking and reviewer corrections.
  5. Reconcile source populations, failed records, joins and transformations before interpreting AI audit analytics.

Explanation

Correct Answers

A:

The reason it is necessary is: Audit scope must follow enterprise AI exposure, not only visible software projects or infrastructure boundaries. For this situation: An internal audit team audits a low-risk autocomplete project but overlooks a live medical triage model without independent review.

C:

The reason it is necessary is: Audit scope must follow enterprise AI exposure, not only visible software projects or infrastructure boundaries. This response fits the risk associated with Risk-based AI audit universe and scope: Define the AI audit universe and scope using use-case impact, third parties, control reliance and key risk scenarios.

Incorrect Answers

B:

It misses the key control principle: Audit scope must follow enterprise AI exposure, not only visible software projects or infrastructure boundaries.

D:

This option concerns Using AI during audit engagement planning, which is a related but different AI governance concern. For this situation: An internal audit team audits a low-risk autocomplete project but overlooks a live medical triage model without independent review.

E:

This option concerns Audit data completeness and reconciliation, which is a related but different AI governance concern. For this situation: An internal audit team audits a low-risk autocomplete project but overlooks a live medical triage model without independent review.

Question 961

A governance and assurance review uncovers the following: A reviewer labels a model unethical without specifying the approved policy or measurable criterion it violates. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Document reproducible extraction, definitions, feature joins, calculations and review of exceptions.
  2. Report criterion, observed condition, evidence, plausible cause, consequence and actionable recommendation.
  3. Use vague statements of best practice as universal legal requirements with no cited applicability.
  4. Define objective risk-based audit criteria from approved organizational policies, relevant standards and applicable law.

Explanation

Correct Answer

D:

The reason it is necessary is: Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference. In this case: A reviewer labels a model unethical without specifying the approved policy or measurable criterion it violates.

Incorrect Answers

A:

This option concerns Reproducible audit data transformations, which is a related but different AI governance concern. It does not establish control effectiveness for AI audit criteria and control objectives.

B:

This option concerns Clear AI audit finding criteria cause effect, which is a related but different AI governance concern. It does not establish control effectiveness for AI audit criteria and control objectives.

C:

This attractive shortcut does not resolve the AI audit criteria and control objectives weakness: Use vague statements of best practice as universal legal requirements with no cited applicability.

Question 962

A risk-based audit engagement examines this operating condition: A reviewer labels a model unethical without specifying the approved policy or measurable criterion it violates. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. AI-assisted audit planning can improve coverage but retains risks of confidentiality, bias and fabricated conclusions.
  2. Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference.
  3. Use vague statements of best practice as universal legal requirements with no cited applicability.
  4. Reliable audit analytics depend on traceable transformations, not merely attractive final charts.

Explanation

Correct Answer

B:

The corrective action is: Define objective risk-based audit criteria from approved organizational policies, relevant standards and applicable law. In this case: A reviewer labels a model unethical without specifying the approved policy or measurable criterion it violates.

Incorrect Answers

A:

This option concerns Using AI during audit engagement planning, which is a related but different AI governance concern. It does not establish control effectiveness for AI audit criteria and control objectives.

C:

This attractive shortcut does not resolve the AI audit criteria and control objectives weakness: Use vague statements of best practice as universal legal requirements with no cited applicability. For this situation: A reviewer labels a model unethical without specifying the approved policy or measurable criterion it violates.

D:

This option concerns Reproducible audit data transformations, which is a related but different AI governance concern. For this situation: A reviewer labels a model unethical without specifying the approved policy or measurable criterion it violates.

Question 963

An audit committee asks for a defensible assessment of this situation: A reviewer labels a model unethical without specifying the approved policy or measurable criterion it violates. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Inspect approved tool use, input sensitivity, model version, generated risk ranking and reviewer corrections.
  2. Inspect audit program, control objectives, regulatory applicability, measurements and management agreement on criteria.
  3. Reconcile AI inventory, data flows, business ownership, complaints, material incidents and risk appetite to audit plan.
  4. Use vague statements of best practice as universal legal requirements with no cited applicability.

Explanation

Correct Answer

B:

The reason it is necessary is: Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference. The corrective action is: Define objective risk-based audit criteria from approved organizational policies, relevant standards and applicable law.

Incorrect Answers

A:

This option concerns Using AI during audit engagement planning, which is a related but different AI governance concern. For this situation: A reviewer labels a model unethical without specifying the approved policy or measurable criterion it violates.

C:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. It does not establish control effectiveness for AI audit criteria and control objectives.

D:

This attractive shortcut does not resolve the AI audit criteria and control objectives weakness: Use vague statements of best practice as universal legal requirements with no cited applicability. The auditor should instead examine: Inspect audit program, control objectives, regulatory applicability, measurements and management agreement on criteria.

Question 964

During an AI controls assessment, the team learns that a reviewer labels a model unethical without specifying the approved policy or measurable criterion it violates. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. Each material finding is independently traceable to evidence, severity and an owned improvement.
  2. Use vague statements of best practice as universal legal requirements with no cited applicability.
  3. Workpapers map each issue to an explicit criterion, condition, cause, consequence and evidence.
  4. The audit reaches a defensible scoped conclusion or clearly reports evidence restrictions and residual risk.

Explanation

Correct Answer

C:

The reason it is necessary is: Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference. This is an observable validation result for AI audit criteria and control objectives, not just management assurance: Workpapers map each issue to an explicit criterion, condition, cause, consequence and evidence.

Incorrect Answers

A:

This option concerns Clear AI audit finding criteria cause effect, which is a related but different AI governance concern. For this situation: A reviewer labels a model unethical without specifying the approved policy or measurable criterion it violates.

B:

This attractive shortcut does not resolve the AI audit criteria and control objectives weakness: Use vague statements of best practice as universal legal requirements with no cited applicability. Define objective risk-based audit criteria from approved organizational policies, relevant standards and applicable law.

D:

This option concerns Third-party AI assurance boundary and audit rights, which is a related but different AI governance concern. It does not establish control effectiveness for AI audit criteria and control objectives.

Question 965

An independent AI auditor reviews this case: An AI audit tests general model quality but has no agreed benchmarks or risk appetite threshold. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Use vague statements of best practice as universal legal requirements with no cited applicability.
  2. Define the AI audit universe and scope using use-case impact, third parties, control reliance and key risk scenarios.
  3. Use approved AI tools for planning with data safeguards, transparent criteria, independent review and reproducible output.
  4. Define objective risk-based audit criteria from approved organizational policies, relevant standards and applicable law.

Explanation

Correct Answer

D:

The reason it is necessary is: Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference. In this case: An AI audit tests general model quality but has no agreed benchmarks or risk appetite threshold.

Incorrect Answers

A:

This attractive shortcut does not resolve the AI audit criteria and control objectives weakness: Use vague statements of best practice as universal legal requirements with no cited applicability. In this case: An AI audit tests general model quality but has no agreed benchmarks or risk appetite threshold.

B:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. The decisive principle here is: Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference.

C:

This option concerns Using AI during audit engagement planning, which is a related but different AI governance concern. The decisive principle here is: Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference.

Question 966

A governance and assurance review uncovers the following: An AI audit tests general model quality but has no agreed benchmarks or risk appetite threshold. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference.
  2. Reliable audit analytics depend on traceable transformations, not merely attractive final charts.
  3. Audit independence extends to automated methods and relationships that could bias scope or findings.
  4. Use vague statements of best practice as universal legal requirements with no cited applicability.

Explanation

Correct Answer

A:

The corrective action is: Define objective risk-based audit criteria from approved organizational policies, relevant standards and applicable law. In this case: An AI audit tests general model quality but has no agreed benchmarks or risk appetite threshold.

Incorrect Answers

B:

This option concerns Reproducible audit data transformations, which is a related but different AI governance concern. The decisive principle here is: Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference.

C:

This option concerns Auditor independence with AI-enabled workpapers, which is a related but different AI governance concern. It does not establish control effectiveness for AI audit criteria and control objectives.

D:

This attractive shortcut does not resolve the AI audit criteria and control objectives weakness: Use vague statements of best practice as universal legal requirements with no cited applicability. For this situation: An AI audit tests general model quality but has no agreed benchmarks or risk appetite threshold.

Question 967

A risk-based audit engagement examines this operating condition: An AI audit tests general model quality but has no agreed benchmarks or risk appetite threshold. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Inspect approved tool use, input sensitivity, model version, generated risk ranking and reviewer corrections.
  2. Inspect audit program, control objectives, regulatory applicability, measurements and management agreement on criteria.
  3. Use vague statements of best practice as universal legal requirements with no cited applicability.
  4. Inspect service organization reports, contract rights, complementary controls, model monitoring and exception records.

Explanation

Correct Answer

B:

The reason it is necessary is: Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference. This evidence directly tests the asserted control for AI audit criteria and control objectives: Inspect audit program, control objectives, regulatory applicability, measurements and management agreement on criteria.

Incorrect Answers

A:

This option concerns Using AI during audit engagement planning, which is a related but different AI governance concern. For this situation: An AI audit tests general model quality but has no agreed benchmarks or risk appetite threshold.

C:

This attractive shortcut does not resolve the AI audit criteria and control objectives weakness: Use vague statements of best practice as universal legal requirements with no cited applicability. Effective closure requires: Workpapers map each issue to an explicit criterion, condition, cause, consequence and evidence.

D:

This option concerns Third-party AI assurance boundary and audit rights, which is a related but different AI governance concern. The decisive principle here is: Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference.

Question 968

An audit committee asks for a defensible assessment of this situation: An AI audit tests general model quality but has no agreed benchmarks or risk appetite threshold. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. Workpapers map each issue to an explicit criterion, condition, cause, consequence and evidence.
  2. Use vague statements of best practice as universal legal requirements with no cited applicability.
  3. Independent auditors retain final conclusions and conflicts are mitigated with transparent quality review.
  4. The audit reaches a defensible scoped conclusion or clearly reports evidence restrictions and residual risk.

Explanation

Correct Answer

A:

The reason it is necessary is: Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference. Independent audit evidence includes: Inspect audit program, control objectives, regulatory applicability, measurements and management agreement on criteria.

Incorrect Answers

B:

For this situation: An AI audit tests general model quality but has no agreed benchmarks or risk appetite threshold.

C:

This option concerns Auditor independence with AI-enabled workpapers, which is a related but different AI governance concern. For this situation: An AI audit tests general model quality but has no agreed benchmarks or risk appetite threshold.

D:

This option concerns Third-party AI assurance boundary and audit rights, which is a related but different AI governance concern. For this situation: An AI audit tests general model quality but has no agreed benchmarks or risk appetite threshold.

Question 969

During an AI controls assessment, the team learns that a multi-country audit uses a single legal standard for all AI activities without a jurisdiction and role map. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Preserve professional objectivity, disclose conflicts and independently validate AI-assisted audit decisions.
  2. Define objective risk-based audit criteria from approved organizational policies, relevant standards and applicable law.
  3. Use vague statements of best practice as universal legal requirements with no cited applicability.
  4. Use approved AI tools for planning with data safeguards, transparent criteria, independent review and reproducible output.

Explanation

Correct Answer

B:

The reason it is necessary is: Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference. In this case: A multi-country audit uses a single legal standard for all AI activities without a jurisdiction and role map.

Incorrect Answers

A:

This option concerns Auditor independence with AI-enabled workpapers, which is a related but different AI governance concern. The decisive principle here is: Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference.

C:

This attractive shortcut does not resolve the AI audit criteria and control objectives weakness: Use vague statements of best practice as universal legal requirements with no cited applicability. In this case: A multi-country audit uses a single legal standard for all AI activities without a jurisdiction and role map.

D:

This option concerns Using AI during audit engagement planning, which is a related but different AI governance concern. In this case: A multi-country audit uses a single legal standard for all AI activities without a jurisdiction and role map.

Question 970

An independent AI auditor reviews this case: A multi-country audit uses a single legal standard for all AI activities without a jurisdiction and role map. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Use vague statements of best practice as universal legal requirements with no cited applicability.
  2. Reconcile source populations, failed records, joins and transformations before interpreting AI audit analytics.
  3. Inspect approved tool use, input sensitivity, model version, generated risk ranking and reviewer corrections.
  4. Define objective risk-based audit criteria from approved organizational policies, relevant standards and applicable law.
  5. Inspect audit program, control objectives, regulatory applicability, measurements and management agreement on criteria.

Explanation

Correct Answers

D:

The reason it is necessary is: Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference. For this situation: A multi-country audit uses a single legal standard for all AI activities without a jurisdiction and role map.

E:

The reason it is necessary is: Findings must be based on traceable and testable criteria rather than a reviewer's undefined preference. The acceptable verified outcome is: Workpapers map each issue to an explicit criterion, condition, cause, consequence and evidence.

Incorrect Answers

A:

This attractive shortcut does not resolve the AI audit criteria and control objectives weakness: Use vague statements of best practice as universal legal requirements with no cited applicability. For this situation: A multi-country audit uses a single legal standard for all AI activities without a jurisdiction and role map.

B:

This option concerns Audit data completeness and reconciliation, which is a related but different AI governance concern. It does not establish control effectiveness for AI audit criteria and control objectives.

C:

This option concerns Using AI during audit engagement planning, which is a related but different AI governance concern. For this situation: A multi-country audit uses a single legal standard for all AI activities without a jurisdiction and role map.

ISACA Advanced in AI Audit (AAIA) Practice Tests