Which of the following BEST prepares an organization to respond appropriately to incidents involving the organization’s AI systems?
Answer(s): C
Understanding the potential impacts of AI incidents enables the organization to assess severity, prioritize response actions, allocate resources effectively, and make proportionate decisions, forming the foundation for structured, risk-based incident response for AI systems.
Which of the following is the MOST important element of a risk management strategy when implementing AI in a financial services organization?
Answer(s): D
A privacy impact assessment is foundational in financial services because AI systems inherently process sensitive personal and financial data, and early identification and mitigation of privacy risks is critical for regulatory compliance, legal exposure control, and trust preservation before operational and ethical controls can be effectively applied.
An AI solution is used to manage an organization’s social media and posted a message with an inappropriate tone.Which of the following would an IS auditor recommend to address the risk?
Human-in-the-loop control ensures that AI-generated content is reviewed and approved before publication, providing governance oversight, contextual judgment, and reputational risk protection when AI systems interact directly with external audiences.
An IS auditor learns that an organization has adopted vibe coding for product development.Which of the following is the GREATEST risk associated with this practice?
Vibe coding prioritizes rapid, intuition-driven development over structured engineering controls, which significantly increases the risk of introducing undetected security vulnerabilities into production systems due to the absence of rigorous design validation, secure coding practices, and formal control checkpoints.
When an organization outsources AI services to a third-party vendor it is MOST important to include contractual clauses requiring the vendor to:
Answer(s): A
Requiring adherence to the organization’s internal AI governance policies ensures consistent application of risk management, ethical standards, compliance obligations, and control frameworks, maintaining accountability and governance integrity despite outsourcing AI services to a third party.
Post your Comments and Discuss ISACA AAIA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AAIA content, but please register or login to continue.