An audit reveals inconsistencies in the retention period of data used for AI training. What is the BEST recommendation to mitigate this risk?
Answer(s): C
Implementing automated data cleansing tools to enforce retention policies is the best recommendation. This ensures consistent application of data retention requirements, reduces compliance risks, and minimizes the chance of outdated or noncompliant data being used for AI training.
An IS auditor reviewing an AI-based data governance program discovers that there is no formal data classification policy in place. Which of the following is the MOST likely consequence of this gap?
Answer(s): A
The most likely consequence of not having a formal data classification policy is inappropriate handling of sensitive data during AI model training. Without classification, sensitive information may be exposed, mishandled, or used in violation of compliance requirements.
To ensure stakeholders are adequately prepared to address workforce impacts, which of the following is an IS auditor’s BEST recommendation for an organization’s AI incident response plan?
Validating that regular cross-functional AI incident drills and skill gap assessments are performed is the best recommendation. This ensures stakeholders are prepared to handle workforce impacts by practicing coordinated responses and identifying areas requiring additional skills or training.
An organization seeks to sustain effective AI governance and risk management amid rapidly evolving AI technologies.Which of the following represents the MOST effective course of action?
Answer(s): D
Continuous AI training embedded into security awareness programs ensures that all stakeholders — technical, managerial, and operational — regularly update their knowledge as AI risks and technologies evolve. This supports sustained, organization-wide governance and risk management rather than limiting training to isolated groups or one-time events.
An AI tool is being implemented for a regional healthcare organization. Which of the following training methods BEST ensures the AI output does not reveal whether someone's personal data was used?
Differential privacy introduces controlled noise during model training, ensuring the model cannot reveal whether any specific individual's data was included in the training set. This provides strong protection against reidentification while maintaining model utility.
Post your Comments and Discuss ISACA AAIA exam prep with other Community members: