Which of the following should an IS auditor consider to be the GREATEST risk if the AI model does not maintain logs of user interactions?
Answer(s): A
Without logs of user interactions, the organization lacks a reliable audit trail for reconstructing events, tracing misuse, identifying affected users or prompts, and determining the cause of AI-related incidents. This significantly weakens incident investigation and accountability.
Which of the following is MOST important to consider when first establishing data governance for AI systems?
Establishing data security and privacy policies provides the foundational governance framework for how AI data should be collected, accessed, protected, retained, and used. These policies define the rules and control expectations that guide subsequent data quality, ownership, and lifecycle practices.
Which of the following is MOST critical in assessing whether an AI model complies with regulatory requirements related to data privacy and ethical use?
Answer(s): C
The origin and licensing of training data are critical for determining whether the organization has lawful rights to use the data and whether privacy, consent, intellectual property, and ethical-use requirements have been satisfied. This provides direct evidence of compliance with regulatory obligations governing how AI training data is obtained and used.
A transit agency is using ridership data to train its AI model to provide enhanced customer service.Which of the following would be an IS auditor’s GREATEST concern?
Answer(s): B
Prioritizing transit coverage in high-income neighborhoods indicates a potential fairness and discrimination issue in how the AI model influences public-service decisions. For a transit agency, biased allocation of services can create significant ethical, social, and governance concerns.
Which of the following is the GREATEST risk associated with an organization’s deployment of an agentic AI system to support operational tasks?
Agentic AI systems can autonomously plan and execute actions across connected systems. If controls, permissions, or guardrails are insufficient, the agent may take unintended actions directly in production, creating immediate operational, security, and business impact.
Post your Comments and Discuss ISACA AAIA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AAIA content, but please register or login to continue.