Only reviewing an ML model's performance one time prior to migrating to production (option C) is of greatest concern. The AAIA™ Study Guide emphasizes that "AI and ML models require continuous monitoring and periodic performance reviews in production to detect issues such as data drift, model degradation, or evolving risk factors." A single pre-production review fails to capture these changes and risks, potentially resulting in undetected failures or compliance issues.
Periodic (including annual) and event-driven reviews are necessary to ensure ongoing model reliability.
Reference:ISACA Advanced in AI Audit™ (AAIA™) Study Guide, Section: "Continuous Monitoring and Review of Deployed AI Models"

The greatest concern is that the generative model may hallucinate, producing incorrect facts or conclusions (option B). In an audit context, hallucinations can create false statements about control effectiveness, misreport risks, or incorrectly summarize evidence.
AAIA stresses that auditors must maintain professional skepticism and validate AI-generated content.
Misstatements are high-risk because they undermine audit credibility, regulatory compliance, and organizational decision-making.
Formatting inconsistency (C) and generic language (D) are cosmetic issues. Outdated information (A) is a concern but does not inherently create false conclusions.
Hallucinated misinformation is the most severe and dangerous issue in AI-generated audit reporting.
References:
AAIA Domain 3: AI in Audit Processes (accuracy of AI outputs, hallucination risks).
AAIA Domain 5: Ethical Responsibilities in AI-Assisted Work.

Risk assessments identify potential threats and vulnerabilities in AI systems and support the development of mitigation strategies. According to the AAIA™ Study Guide, the main objective is not just identification of risks but to proactively design controls that minimize impact and ensure ethical and regulatory compliance.
"The output of an AI risk assessment should lead to actionable mitigation strategies, supporting the secure and responsible deployment of AI solutions across business processes." Options A, C, and D are components of governance and monitoring, but B addresses the core intent of risk assessments.
Reference: ISACA Advanced in AI Audit™ (AAIA™) Study Guide, Section: "AI Governance and Risk Management," Subsection: "Risk Assessment and Mitigation for AI Systems"

When errors are discovered in training data, the primary risk is that themodel has learned from incorrect or low-quality inputs, which can systematically distort outputs (e.g., misstatements of financial information, incorrect classifications, or erroneous flags).Data quality testingdirectly targets this issue by assessing completeness, accuracy, consistency, validity, and integrity of the data used to train, validate, and test AI models.
Functional testing (A) focuses on whether the application behaves according to requirements, not specifically on the underlying data quality. User interface testing (C) concerns usability and presentation, not training data. Model validation on benchmark data (D) helps assess performance but may not reveal or correct root# cause issues in the underlying training data if those benchmarks are also flawed or unrepresentative. AAIA content emphasizes thatdata quality controls are foundationalto AI reliability and must be treated as a core operational control.
References:
ISACA,Advanced in AI Audit (AAIA) Exam Content Outline- Domain 2: Data Management Specific to AI (data quality, data balancing, data security).
ISACA AI guidance on data quality controls as the basis of trustworthy AI outcomes.

The effectiveness of an AI-driven business process-such as categorizing customers for promotional campaigns-depends on how well it supports defined business objectives. The AAIA™ Study Guide recommends validating that AI methodology aligns with intended outcomes as part of performance auditing.
"Effectiveness is best measured by assessing whether the AI logic contributes meaningfully to business goals.
Output alignment with organizational KPIs or campaign strategies provides clear evidence of functional success." Options A and D support operational resilience and quality assurance. Option C is a privacy technique, not directly tied to effectiveness validation. Thus, B is correct.
Reference: ISACA Advanced in AI Audit™ (AAIA™) Study Guide, Section: "AI in Audit Processes," Subsection: "Evaluating AI Alignment with Business Objectives"