Which of the following is a risk practitioner's BEST justification for embedding AI risk considerations into acceptable use policies?
Answer(s): C
Acceptable use policies (AUPs) govern how employees interact with organizational systems and tools. Embedding AI risk considerations into AUPs ensures that AI-related behaviors align with the organization's risk appetite and tolerance thresholds.Why C is Correct: According to ISACA AAIR governance principles, the best justification for embedding AI risk in AUPs is maintaining consistent enterprise risk tolerance across all AI-driven decision-making. When risk tolerances are codified in AUPs, employees understand what AI behaviors are permissible, and deviation from these boundaries triggers escalation. This enterprise-wide alignment prevents individual business units from accepting risks that exceed organizational thresholds.Why A is Wrong: Shadow AI mitigation through allow lists is a specific technical control mechanism, not the primary governance justification for AUP integration. It addresses unauthorized tool use rather than risk tolerance alignment.Why B is Wrong: Applying uniform risk controls across diverse business functions is a compliance approach that may not be appropriate—different functions may legitimately have different risk profiles. The goal is tolerance alignment, not control uniformity.Why D is Wrong: Assigning accountability to business unit leadership is a governance structure decision. AUPs define behavioral expectations, not organizational accountability assignments, which are addressed through RACI frameworks and policy governance.
An organization adopts a third-party AI service under a shared responsibility model. Which of the following is the MOST important area of focus for the risk practitioner?
Answer(s): D
The shared responsibility model creates complexity in AI governance because control obligations are distributed between the organization and the vendor. The most critical risk is ambiguity about who owns specific controls and who makes decisions when issues arise.Why D is Correct: The ISACA AAIR framework identifies documented assignment of control ownership as the cornerstone of shared responsibility governance. Without explicit documentation of which controls the organization owns versus which the vendor owns, and who has decision authority in each scenario, gaps and overlaps emerge that allow risks to go unmanaged. Named ownership ensures accountability persists across the shared boundary.Why A is Wrong: Staff training on procedures is important but addresses operational readiness rather than the fundamental governance challenge of shared responsibility. Training supports a well-structured model but cannot substitute for defined ownership.Why B is Wrong: Contractual liability clauses are legal protections that determine financial recourse after incidents. While essential, they do not prevent governance gaps from forming during normal operations.Why C is Wrong: Data pathway testing is a security assurance activity addressing technical controls. It verifies control function but does not establish who owns those controls or what authority they have in the shared model.
A risk practitioner is evaluating AI model cards and documentation prior to deployment. Which of the following represents the GREATEST risk to enterprise AI governance?
Answer(s): B
AI governance depends on the ability of stakeholders to understand, audit, and oversee AI model decisions. Explainability is the technical and documentation property that enables this oversight. When model cards fail to adequately document explainability, the entire governance chain is compromised.Why B is Correct: According to ISACA AAIR, inadequate explainability in model documentation is the greatest governance risk because it prevents risk practitioners, auditors, regulators, and business owners from understanding why a model produces its outputs. Without explainability, discriminatory or erroneous decisions cannot be identified, challenged, or corrected. This undermines accountability, compliance, and responsible AI governance at the enterprise level.Why A is Wrong: Regulatory filing delays represent a compliance timing issue that can be remediated. While risky, they do not fundamentally compromise the governance capability of understanding and overseeing AI behavior.Why C is Wrong: Decentralized version control creates configuration management challenges and audit trail gaps. These are significant but can be remediated through governance process improvements. Explainability gaps affect the underlying ability to govern the model itself.Why D is Wrong: Overly detailed technical specifications represent a documentation quality issue that may reduce usability but does not create a governance risk. Excessive detail is easily distilled; absent explainability cannot be reconstructed after the fact.
Which of the following is the PRIMARY benefit of aligning AI risk management with existing organizational governance frameworks?
Organizational governance frameworks provide the structures, processes, and oversight mechanisms through which enterprises manage their activities and risks. Aligning AI risk management with these frameworks ensures AI activities receive the same level of strategic oversight as other organizational functions.Why C is Correct: The ISACA AAIR curriculum identifies enterprise-level oversight and strategic alignment as the primary benefit of governance framework integration. When AI risk management operates within established governance structures, AI decisions are subject to the same approval authorities, risk escalation pathways, and strategic alignment checks that govern all major organizational decisions. This produces coherent, enterprise-aware AI governance.Why A is Wrong: Role development and responsibility clarification are governance activities that may result from alignment, but they represent structural outputs rather than the primary benefit. The benefit is the oversight quality, not the organizational structure itself.Why B is Wrong: Expediting compliance approvals is an efficiency benefit that may arise from better-organized governance. However, speed of approval is not the primary purpose of framework alignment—the purpose is quality and consistency of oversight.Why D is Wrong: Standardizing acquisition processes is a procurement function benefit. While governance alignment may improve procurement consistency, standardization is a narrow operational benefit compared to the strategic oversight value of full governance integration.
Which of the following is the GREATEST concern when an organization cannot clearly explain an AI system's decision-making process and the origin of its inputs?
Explainability and input transparency are foundational requirements for responsible AI governance. When these are absent, organizations lose the ability to identify when AI systems produce harmful, biased, or inaccurate results—leaving those harms undetected and unaddressed.Why C is Correct: According to ISACA AAIR, the inability to explain AI decisions is most dangerous because it creates an environment where discriminatory or inaccurate outputs can persist undetected. This exposes the organization to regulatory penalties (particularly under anti-discrimination, financial services, and privacy laws), reputational damage, and harm to affected individuals. The detection gap—not knowing what the system is doing wrong—is the core governance failure.Why A is Wrong: External provider dependence is a third-party risk management concern. While relevant, it is a structural risk that can be addressed through contract management, not an immediate consequence of lacking explainability.Why B is Wrong: Declining adoption rates represent a change management and trust concern. Business unit reluctance to adopt AI is a cultural and operational issue, not the primary risk from unexplainable AI decisions.Why D is Wrong: Manual review bottlenecks represent operational inefficiency. They may result from lack of confidence in AI outputs but do not represent the primary organizational harm from unexplainability.
An organization deploys an autonomous system that makes decisions affecting compliance with regulations. If those decisions could potentially produce regulatory breaches, which of the following BEST helps to manage associated liability exposures?
Liability from autonomous AI decisions affecting regulatory compliance requires organizations to demonstrate accountability, oversight, and control. Documentation of decision rationale and embedded oversight controls are the primary mechanisms for demonstrating responsible governance to regulators.Why B is Correct: The ISACA AAIR framework identifies explainability documentation and embedded oversight controls as the key liability management tools for autonomous AI systems. When the organization can demonstrate that each AI decision was explainable, that controls were in place to detect violations, and that human oversight was embedded in the process, this demonstrates due diligence—which is the legal and regulatory standard for managing liability from automated decisions.Why A is Wrong: Separate compliance programs fragment governance and may increase rather than reduce liability by suggesting AI compliance is siloed from the enterprise compliance program. Regulators expect integrated governance.Why C is Wrong: Restricting deployment represents risk avoidance, not liability management for already-deployed systems. If the system is already in production, deployment restriction does not address existing liability.Why D is Wrong: Single-point escalation and non-disclosure create governance bottlenecks and conflict with regulatory transparency requirements. Restricting disclosure cannot be used to shield the organization from regulatory accountability for automated decisions.
Which of the following is MOST important when defining responsible roles for integrating third-party AI services into an organization's supply chain?
Answer(s): A
Third-party AI service integration introduces distributed accountability challenges. When external services are incorporated into organizational supply chains, clearly designated ownership of AI governance and risk is essential to ensure responsibilities do not fall into gaps between internal and external parties.Why A is Correct: According to ISACA AAIR third-party risk principles, designating AI governance and risk ownership is the foundational requirement for supply chain integration. Without clear internal ownership, third-party AI risks cannot be effectively monitored, escalated, or managed. The designated owner ensures vendor performance is assessed against risk criteria, contractual obligations are enforced, and emerging risks are addressed.Why B is Wrong: Standardizing data transfer protocols is a technical integration concern. While important for security and operations, it does not address who is responsible for managing the ongoing governance and risk of the integrated service.Why C is Wrong: Training third-party staff on internal AI policies is a vendor management activity that may be contractually required but does not substitute for internal governance ownership. Third-party training does not remove the organization's responsibility for oversight.Why D is Wrong: Security policy alignment is important for consistent security posture but represents one dimension of third-party risk management. Governance and risk ownership encompasses security policy alignment as well as broader risk management responsibilities.
Which of the following is the BEST governance approach for balancing risk management and operational flexibility across diverse AI applications?
AI governance across diverse applications requires frameworks flexible enough to accommodate varying risk profiles, regulatory environments, and operational contexts while maintaining consistent governance standards. Rigid or overly centralized approaches reduce operational effectiveness.Why B is Correct: The ISACA AAIR framework advocates for adaptable governance frameworks that can be scaled and tailored to specific AI use cases. A risk-based, adaptable framework applies more rigorous controls to high-risk applications while allowing operational flexibility for lower-risk uses. This balance enables innovation while maintaining appropriate risk oversight—a core principle of proportionate AI governance.Why A is Wrong: Single-regulation compliance focus creates compliance tunnel vision that may miss material risks not covered by that regulation. AI governance must address the full risk landscape, not just one regulatory framework.Why C is Wrong: External consultants provide periodic independent assurance, not governance. Relying on external reviews for governance would be episodic rather than continuous, creating governance gaps between review cycles.Why D is Wrong: Centralized decision-making creates operational bottlenecks and slows AI deployment. Effective governance delegates decision authority appropriately while maintaining oversight, rather than centralizing all decisions in a single function.
Post your Comments and Discuss ISACA AAIR exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AAIR content, but please register or login to continue.