Including AI-specific disruption scenarios in the organization's Disaster Recovery Plan (DRP) ensures preparedness for worst-case events affecting AI systems. The AAIA™ Study Guide recommends tailoring business continuity and DR strategies to cover model unavailability, data corruption, and AI-specific dependencies.
"AI disruptions can arise from unique causes such as model corruption, adversarial attacks, or drift.
Integrating these into the DRP allows for effective, scenario-specific responses and minimizes downtime." Tabletop exercises (A) are valuable for preparedness but are less comprehensive than scenario planning. Kill chains (B) are security-specific. KRIs (C) aid in monitoring but don't ensure recovery. Therefore, D offers the most robust mitigation.
Reference: ISACA Advanced in AI Audit™ (AAIA™) Study Guide, Section: "AI Governance and Risk Management," Subsection: "Business Continuity and Disaster Recovery Planning for AI"

LLMs excel at processing large amounts ofunstructured text(e.g., policies, process narratives, procedures).
TheGREATEST benefitis their ability tosummarize and compare multiple documents to identify inconsistencies(B), which can signal potential control weaknesses or misalignments. This aligns with AAIA's description of AI-enabled audit analytics that supportdocument analysis, narrative comparison, and pattern detectionfor control assessment.
Option A presumes autonomy, which is unsafe without validation. Option C is more aligned with predictive or simulation models, not LLM strengths. Option D is not acceptable because walkthroughs require professional judgment and evidence gathering; AI should support, not replace. Thus,summarization and inconsistency identificationis the most practical and impactful benefit.
References:
ISACA,AAIA Exam Content Outline- Domain 3: AI in Audit Processes (use of LLMs for narrative analysis).

Ensuring that AI tools are trained on properly licensed and documented data sets is critical to avoiding copyright infringement and legal exposure. The AAIA™ Study Guide emphasizes using platforms with certified and traceable training data to meet ethical and legal standards.
"Organizations must verify the provenance and licensing of data used to train AI systems. Platforms that certify data sources reduce the risk of using protected intellectual property without consent." Manual review (A) is resource-intensive and may not detect embedded copyright violations. Labeling (C) is not sufficient for legal protection. Suspension (D) may be excessive without first attempting remediation.
Thus, B is the most strategic and effective recommendation.
Reference: ISACA Advanced in AI Audit™ (AAIA™) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Intellectual Property and Data Licensing in AI Systems"

In the context of AI-driven audit planning, the AAIA™ Study Guide identifies incomplete or inaccurate data as the most significant risk. If the data input into AI tools is missing, outdated, or inconsistent, the model's suggestions for risk prioritization or control testing will be flawed.
"Audit planning supported by AI tools is only as strong as the underlying data. Incomplete data may cause incorrect risk assessments or misallocate audit resources, undermining audit effectiveness." While scope creep and cost are common concerns in project management, and limited AI knowledge can be mitigated through training, only incomplete data directly impacts the validity of audit planning outputs.
Reference: ISACA Advanced in AI Audit™ (AAIA™) Study Guide, Section: "AI in Audit Processes," Subsection: "Data Integrity and Planning Risks"

In the case of a potential data exposure through AI model outputs, the first and most responsible action from an auditing and risk standpoint is to halt further risk propagation. According to the AAIA™ Study Guide, immediate containment is vital, especially when regulatory and reputational risks are high.
"Upon detection of a data breach risk, AI models should be immediately disabled from public or partner use, and all relevant parties should be notified as part of a responsible disclosure and containment strategy." While options A and D are longer-term remediation steps and B is investigative, none of them provide the urgent containment that is best practice in such a breach context.
Reference: ISACA Advanced in AI Audit™ (AAIA™) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "AI Data Breach and Disclosure Management"