An organization has developed an AI code of conduct outlining ethical use, data privacy, and transparency principles. Which of the following is the BEST approach to integrate the code of conduct into workforce training?
Answer(s): C
Effective ethics training must be relevant to the specific roles and responsibilities of each workforce segment, and must be reinforced over time as AI applications and ethical challenges evolve. Generic, one-time training produces shallow compliance rather than genuine ethical competence.Why C is Correct: The ISACA AAIR Study Guide emphasizes role-tailored, continuous education as the best approach for embedding ethical principles into workforce behavior. Different roles—developers, business users, risk practitioners, executives—interact with AI in fundamentally different ways and face different ethical challenges. Tailored content ensures relevance, while scheduled refreshers maintain awareness as the ethical landscape changes with new AI deployments and regulatory developments.Why A is Wrong: Onboarding incorporation is a starting point but insufficient alone. Ethics are not learned once at hire—they must be continuously reinforced as employees encounter new AI applications and ethical dilemmas in practice.Why B is Wrong: External providers can deliver quality content but may not understand the organization's specific AI applications, culture, or risk profile. External delivery also tends to be episodic rather than integrated into ongoing role responsibilities.Why D is Wrong: Focusing on legal compliance creates a rule-following culture rather than genuine ethical judgment. Compliance knowledge is necessary but insufficient for building the ethical reasoning skills needed for novel AI situations not covered by existing regulations.
An organization has deployed generative AI tools broadly but lacks a consistent method to refresh governance policies and controls. Which of the following is the risk practitioner's BEST recommendation?
Answer(s): A
Generative AI capabilities and the associated risk landscape evolve rapidly. Governance policies and controls must be refreshed through a structured, regular process rather than reactively or only when compliance requirements change.Why A is Correct: According to ISACA AAIR, establishing a regular review cadence with codified reassessment procedures is the most robust approach because it creates a systematic, predictable process for keeping governance current. By documenting when and how policies will be reviewed— including triggers for ad hoc review (new deployments, incidents, regulatory changes)—the organization ensures governance never stagnates regardless of external pressures.Why B is Wrong: Regulatory alignment is an important input to governance refresh but represents a reactive, external-trigger approach. Relying primarily on regulatory signals means governance lags behind organizational AI changes not covered by new regulations.Why C is Wrong: Centralizing authority in executive and technical leadership creates decision bottlenecks and reduces the operational agility needed to keep pace with rapidly evolving AI deployments. Distributed governance with clear escalation paths is more effective.Why D is Wrong: Annual reviews are too infrequent for generative AI tools, which may see significant capability changes and risk profile shifts multiple times per year. Annual compliance audits cannot keep governance current in a rapidly evolving AI environment.
An organization has deployed an AI system that initially performs well but whose outputs deteriorate over time despite stable input characteristics. Which of the following is the BEST course of action?
Answer(s): D
Output deterioration despite stable inputs is a classic indicator of model drift—specifically concept drift, where the underlying relationships between inputs and targets change over time even when the distribution of inputs appears stable. This requires ongoing monitoring and systematic recalibration.Why D is Correct: The ISACA AAIR life cycle management guidance identifies continuous performance monitoring and scheduled recalibration as the appropriate response to model drift.Monitoring provides early warning when performance degrades below thresholds, while scheduled recalibration ensures the model is periodically updated to reflect current real-world patterns. This systematic approach prevents continued deterioration and maintains model reliability.Why A is Wrong: Source code audits and peer reviews address development quality and code integrity, not model drift. Drift is a statistical phenomenon driven by changing data relationships, not code defects that code reviews can identify.Why B is Wrong: Replacing predictive AI with static rule-based systems eliminates the adaptive capabilities that make AI valuable. Static rules cannot respond to evolving patterns and typically perform worse in dynamic environments.Why C is Wrong: Dataset cleansing addresses data quality for model retraining but does not establish the ongoing monitoring mechanism needed to detect future drift. A one-time cleansing activity cannot prevent recurrent deterioration.
Which of the following would be of GREATEST concern to a risk practitioner reviewing the testing and validation of an AI-driven technical support system?
AI-driven technical support systems rely on accurate, current knowledge to resolve user issues. Model drift causes the system to diverge from real-world conditions, producing inaccurate outputs that erode user trust, increase escalations, and potentially cause harm if incorrect technical guidance is followed.Why A is Correct: According to ISACA AAIR validation guidance, inaccurate outputs from model drift represent the greatest risk in a technical support AI because they directly compromise the system's core function—providing correct technical guidance. Inaccurate outputs lead to unresolved issues, potential system damage from wrong instructions, and reputational harm. Unlike the other options, drift-driven inaccuracy affects every user interaction and cannot be remediated without model updates.Why B is Correct Context: Infrequent training dataset updates are a contributing cause of model drift and are a serious concern, but they are an input factor rather than the manifest risk itself. The concern is the resulting inaccuracy.Why C is Wrong: Encryption is a security control for data in storage and transit. While important for confidentiality, it does not affect the accuracy of AI outputs or the system's ability to provide correct technical guidance.Why D is Wrong: Excessive manual sampling is a testing methodology concern that may reduce testing coverage efficiency. However, it represents a process inefficiency rather than a direct risk to output quality—the model's accuracy is the greater concern.
Which of the following BEST helps to ensure a deep learning model with a large volume of relevant data meets an organization's needs?
Deep learning models have numerous hyperparameters—learning rate, batch size, regularization parameters, network architecture choices—that control how the model learns from data. Fine-tuning these parameters optimizes model performance for the specific dataset and task requirements.Why D is Correct: According to ISACA AAIR model development guidance, when a large volume of relevant data is already available, hyperparameter fine-tuning is the most effective technique for ensuring the model meets organizational needs. It systematically optimizes the learning process to maximize performance on the specific problem, calibrating accuracy, generalization, and efficiency to the organization's requirements.Why A is Wrong: A federated accountability model is a governance structure, not a technical method for optimizing AI performance. It addresses how responsibility is distributed, not how the model learns.Why B is Wrong: Unsupervised learning is a class of ML approaches used when labeled data is unavailable. It does not address optimization of a deep learning model where relevant data is already present.Why C is Wrong: Data augmentation artificially expands training datasets through transformations— useful when data is scarce. With a large volume of relevant data already available, augmentation provides minimal additional benefit and hyperparameter optimization becomes the more impactful intervention.
An organization deploys an AI credit scoring model trained on historical financial data that underrepresents certain demographic groups. Which of the following is the risk practitioner's BEST recommendation to mitigate this risk?
Answer(s): B
Bias in AI models often originates from training data that does not represent the full population the model will serve. Underrepresentation of demographic groups in training data causes the model to perform poorly for those groups, producing discriminatory outcomes in high-stakes decisions like credit scoring.Why B is Correct: The ISACA AAIR bias and fairness guidance identifies expanding training data coverage as the most effective mitigation for representation bias. Defining specific inclusivity goals ensures the data expansion targets the identified gaps, while broadening data sources introduces representative examples from underrepresented groups. This addresses the root cause—training data deficiency—rather than symptoms.Why A is Wrong: Model drift reporting detects changes in model behavior over time but does not address existing representational bias embedded in the current model. Monitoring an already-biased model cannot remediate the bias.Why C is Wrong: Notifying stakeholders of potential inaccuracy is a transparency measure but does not reduce harm to affected individuals. Disclosure of bias without remediation is insufficient under anti-discrimination regulations.Why D is Wrong: Unsupervised learning can identify hidden patterns but cannot introduce the missing representative data needed to train an unbiased model. Discovering discriminatory patterns in existing data does not resolve the underlying data coverage gap.
An organization is selecting an AI model for a solution that requires the creation of new content. It is MOST important to consider selecting:
Different AI model architectures are optimized for different tasks. Content creation requires a model that can generate novel outputs—text, images, audio, or code—rather than classify, cluster, or optimize decisions based on rules or rewards.Why A is Correct: According to ISACA AAIR AI technology selection guidance, generative models are specifically designed to synthesize new content by learning the underlying probability distributions of training data. They can produce novel, contextually appropriate outputs—exactly what content creation requires. Large language models (LLMs), diffusion models, and GANs are generative architectures designed for this purpose.Why B is Wrong: Unsupervised clustering groups existing data points by similarity but does not generate new content. It is used for pattern discovery and segmentation, not creative output generation.Why C is Wrong: Rule-based expert systems execute predefined logic trees and cannot produce novel content beyond the rules explicitly encoded. They are rigid, deterministic systems unsuitable for open-ended content creation.Why D is Wrong: Reinforcement learning optimizes decision sequences to maximize cumulative rewards. It is suited for sequential decision-making tasks (games, robotics, recommendation systems) but is not the appropriate architecture for direct content generation.
An organization integrates multiple AI services using APIs to enhance a customer support chatbot. Which of the following is the GREATEST risk?
API integration with external AI services creates data transmission pathways between the organization and external systems. Customer support contexts involve sensitive personal data— account information, contact details, inquiry content—that may be transmitted through these API connections.Why B is Correct: The ISACA AAIR security and privacy guidance identifies unauthorized disclosure of sensitive data through insecure API connections as the greatest risk in multi-service AI integration. APIs can be vulnerable to interception, inadequate authentication, or misconfiguration. In a customer support context, exposure of personal data via API vulnerabilities creates privacy violations, regulatory liability, and reputational harm—all more severe than the other listed concerns.Why A is Wrong: Bias and inaccuracy in chatbot responses are real quality risks but represent service quality issues rather than security or privacy breaches. Inaccurate responses are visible and correctable; data breaches may go undetected.Why C is Wrong: Customer dissatisfaction from operational delays is a service quality and business risk. It is a manageable consequence of performance issues rather than the greatest risk from API-based AI integration.Why D is Wrong: Insufficient training datasets affect model quality but are a development concern addressed during the model selection phase. They do not represent the primary operational risk of deploying multi-service API integrations in production.
Post your Comments and Discuss ISACA AAIR exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AAIR content, but please register or login to continue.