An IS auditor is evaluating an organization’s retrieval-augmented generation (RAG) system.Which of the following presents the GREATEST risk of exposing confidential information?
Answer(s): B
Including retrieved internal context in external search queries can transmit confidential organizational information to third-party services outside the organization’s controlled environment. This creates a direct data leakage and privacy risk, particularly when sensitive RAG-retrieved content is incorporated into externally processed queries.
Which of the following provides the STRONGEST evidence that an organization has formally established ownership of AI-related risk?
Answer(s): C
A documented RACI matrix provides formal, auditable evidence that responsibility and accountability for AI risks and controls have been explicitly assigned. It establishes who is responsible, accountable, consulted, and informed for relevant AI governance activities.
Which of the following BEST enables an organization that uses AI for targeted marketing to maintain consumer confidence and trust?
Embedding controls and ethical considerations into AI development helps ensure targeted marketing is designed to respect privacy, fairness, transparency, and responsible data use from the outset. This proactive approach is most effective for sustaining consumer confidence and trust in how AI is used.
Which of the following MOST appropriately falls under the governance and oversight role in an enterprise AI program?
Answer(s): D
Governance and oversight should ensure that AI-related risks are incorporated into the organization’s overall enterprise risk management framework. This enables AI risks to be assessed, prioritized, monitored, and treated consistently with other strategic and operational risks across the enterprise.
https://www.isaca.org/resources/news-and-trends/isaca-now-blog/2026/responsible-ai-from-emerging-technology-to-executive-governance-imperative https://www.isaca.org/resources/ebook/artificial-intelligence-governance-brief
Which of the following is the MOST important consideration when auditing AI models in a health system?
Security against adversarial attacks is especially critical in health systems because manipulated inputs or model behavior can directly affect clinical decisions, patient safety, and the integrity of sensitive health information. Auditors should therefore give strong attention to whether the AI model is adequately protected against intentional attempts to deceive or compromise it.
Post your Comments and Discuss ISACA AAIA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AAIA content, but please register or login to continue.