A financial services firm received a regulatory fine after a vendor switched its chatbot's AI model without due diligence resulting in unethical investment advice to the firm's clients. Which of the following controls should be implemented by the firm to BEST prevent recurrence of this scenario?
Answer(s): B
Change management ensures that any modifications to AI models, including vendor-initiated model changes, are formally reviewed, assessed for risk, approved, and tested before deployment, preventing unethical or noncompliant behavior.
Which of the following is the BEST way to ensure an organization remains compliant with industry regulations when decommissioning an AI system used to record patient data?
Answer(s): D
Ensuring the certificate of destruction is received and archived provides verifiable evidence that patient data was properly disposed of in accordance with regulatory and data retention requirements, which is essential for demonstrating compliance during audits and regulatory reviews.
A newly hired programmer suspects that the organization's AI solution is inferring users' sensitive information and using it to advise future decisions. Which of the following is the programmer's BEST course of action?
Answer(s): A
Informing the governance panel is the best course of action because it triggers formal oversight, investigation, and corrective measures through established AI governance processes when potential misuse or ethical issues are identified.
When robust input controls are not practical on a large language model (LLM) to prevent prompt injection attacks from external threats, which of the following would be the BEST compensating control to address the risk?
Reviewing and annotating the AI system’s outputs is the best compensating control when robust input controls are impractical because it allows detection and mitigation of harmful or manipulated responses caused by prompt injection before the outputs are acted upon or relied on.
An AI system that supports critical processes has deviated from its expected performance, resulting in biased outcomes. Which of the following is the BEST course of action?
Answer(s): C
Performing a root cause analysis is the best course of action because it identifies why the AI system deviated from expected performance and produced biased outcomes, enabling targeted and effective mitigation before taking disruptive actions such as retraining or disabling the model.
Post your Comments and Discuss ISACA AAISM exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AAISM content, but please register or login to continue.