In healthcare AI applications, protecting patient data is critical. The AAIA™ Study Guide identifies anonymization as one of the most effective strategies to preserve privacy and maintain data integrity. When combined with quality checks, it ensures data accuracy and compliance with health data protection regulations (e.g., HIPAA, GDPR).
"Anonymizing sensitive data removes identifying attributes, significantly reducing risk if data is accessed or leaked. Ongoing data quality checks ensure the integrity and utility of the anonymized dataset." While encryption (A) and access controls (C) are necessary technical safeguards, D provides the strongest dual assurance of privacy and accuracy. Option B focuses on model management rather than data security.
Reference: ISACA Advanced in AI Audit™ (AAIA™) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Privacy and Security of Sensitive AI Data"

Ineffective anomaly detection means the system fails to recognize abnormal patterns in data or model behavior. The GREATEST risk isundetected data poisoning(B), which jeopardizesdata integrityand leads to corrupted, biased, or unsafe AI decisions. AAIA emphasizes that anomaly detection is critical for identifying tampering, data drift, or malicious manipulation.
Configuration inconsistencies (A) are operational issues but far less damaging. Slower drift response (C) can cause performance degradation but is not as severe as undetected poisoning. Reporting standard failures (D) are compliance risks-not as critical as compromised decision integrity.
Thus, undetected poisoning poses thehighest riskdue to its direct impact on model trustworthiness and safety.
References:
ISACA,AAIA Exam Content Outline- Domain 2: AI Operations; Threats and Vulnerabilities in AI.

Ensuring that input data is appropriate and relevant (option D) is the most critical factor in preventing hallucinations-where generative models produce fabricated or misleading outputs. The AAIA™ Study Guide notes, "Generative models are highly sensitive to input data; inaccurate, irrelevant, or inappropriate inputs increase the likelihood of nonsensical or incorrect outputs." While bias detection, data quality audits, and anonymization are important, ensuring the relevance and suitability of input data is foundational for reliable generative AI performance.
Reference:ISACA Advanced in AI Audit™ (AAIA™) Study Guide, Section: "Input Data Governance for Generative AI"

In an audit context,transparencyof sampling is essential for demonstrating that the sample is fair, unbiased, and aligned with the audit objectives. When an AI tool selects samples for testing financial transactions, auditors must be able to explain and defendhowthe sample was generated-particularly to management, regulators, and external stakeholders. Option A directly supports AAIA's focus onaudit planning, sampling methodologies, and AI audit evidence.
High throughput (option B) and speed (option C) are beneficial but secondary to methodological soundness and explainability. Option D (historical performance) can be helpful but does not guarantee current transparency or appropriateness in new contexts. For AI-enabled sampling, the priority is that theselection logic is understandable, documented, and reproducible, ensuring audit defensibility.
References:
ISACA,AAIA Exam Content Outline- Domain 3: AI Auditing Tools and Techniques (Audit Testing and Sampling Methodologies; Audit Evidence Collection Techniques).
ISACA auditing guidance on sampling and transparency in AI-assisted audit procedures.

Regular threat modeling allows organizations to proactively identify vulnerabilities specific to AI, such as:
* Data poisoning
* Model inversion attacks
* Membership inference attacks
* Prompt injection
* Unauthorized model manipulationAAIA highlights AI threat modeling as essential for anticipating and mitigating AI-specific security risks that traditional IT threat modeling does not fully address.Option C (regulatory compliance) is a secondary benefit. Option D (drift prevention) is unrelated. Option B relates to performance, not security.The primary purpose is early identification of security weaknesses before exploitation occurs.
References:
AAIA Domain 2: Threats and Vulnerabilities Specific to AI.
AAIA Domain 1: Risk Assessment and Control Planning.