During a pre-implementation risk assessment, an AI model is determined to present a significant risk of bias and potential harm in excess of the organization’s risk tolerance. Which of the following is the MOST appropriate response?
Answer(s): D
The most appropriate response is to postpone deployment until the risk can be safely managed. Deploying an AI model that exceeds the organization's risk tolerance — especially with known bias and potential harm — would be irresponsible and non-compliant with governance principles. Risk must be mitigated before moving forward.
An organization is adopting AI for its procurement and inventory teams, raising concern from stakeholders that they will lose their jobs due to AI. Which of the following is the BEST way for the IS auditor to assess whether the potential negative impacts were minimized?
Answer(s): A
The best way for the IS auditor to assess whether potential negative impacts were minimized is to review human-centered design practices. This approach ensures that AI adoption considered the needs, roles, and well-being of human stakeholders, helping to reduce resistance, mitigate job displacement concerns, and foster ethical implementation.
A healthcare organization uses data clustering to group patients by medical history for personalized treatment recommendations. Which of the following is the GREATEST privacy risk associated with this practice?
The greatest privacy risk is that clusters can reveal sensitive personal information depending on how the information is presented. Even when data is grouped or anonymized, patterns in clusters may inadvertently expose identifiable or sensitive attributes, leading to privacy violations.
Which of the following is the GREATEST risk associated with using AI in audit planning?
The greatest risk associated with using AI in audit planning is incomplete data. AI relies heavily on the quality and completeness of input data. If the data used during planning is incomplete, it can lead to flawed risk assessments, poor resource allocation, and an ineffective audit scope, ultimately compromising audit quality.
When using off-the-shelf AI models, which of the following is the MOST appropriate way for organizations to approach vendor management?
The most appropriate approach to vendor management when using off-the-shelf AI models is to establish responsibility and clear terms for model updates and support. This ensures ongoing accountability, proper maintenance, and alignment with evolving business and compliance requirements throughout the model’s lifecycle.
Post your Comments and Discuss ISACA AAIA exam prep with other Community members: