Which of the following is MOST important to consider when auditing an organization's AI procedures?
Correct Answer: D
The integrity of data fed into AI systems is a critical concern. The AAIA™ Study Guide emphasizes that validation and filtration processes are essential to mitigate the risk of data poisoning-an attack that can manipulate model behavior by injecting malicious inputs. "Data poisoning represents a major vulnerability in AI pipelines. Effective controls include robust validation, filtration, and monitoring of training data sources. These preventive practices are essential to ensure model reliability and security." While options A, B, and C are important operational and training measures, only D addresses a technical risk that can directly compromise model outputs and trustworthiness. Reference: ISACA Advanced in AI Audit™ (AAIA™) Study Guide, Section: "AI Governance and Risk Management," Subsection: "AI Data Integrity and Attack Prevention"
AAIA Exam Question 22
Which of the following should be applied to an AI system but are not typically used in traditional systems?
Correct Answer: B
AI systems faceunique threatsnot commonly found in traditional IT environments, particularlydata poisoning, where attackers manipulate training data to corrupt model behavior. Controls that specifically monitor and mitigate poisoning-such as input provenance checks, anomaly detection on training data, and integrity validation pipelines-are emphasized in AAIA's coverage ofAI-specific vulnerabilities. While privacy (A), data exfiltration (C), and data governance (D) controls are essential for all digital systems, monitoring for data poisoningis uniquely critical for AI because poisoned inputs can lead to faulty predictions, safety issues, or systemic bias. AAIA specifically highlights data poisoning as a distinct threat requiring specialized controls. References: ISACA,AAIA Exam Content Outline- Domain 2: Threats and Vulnerabilities Specific to AI. ISACA AI security guidance discussing poisoning and integrity attacks.
AAIA Exam Question 23
Which of the following is MOST important to review in order to gain assurance that an AI model is performing without biases?
Correct Answer: A
Bias in AI models is most commonly introduced through the training data. The AAIA™ Study Guide highlights that to ensure fairness, auditors and developers must evaluate the diversity, representativeness, and quality of the data used to train the model. "The greatest source of bias in AI comes from the training data. Reviewing and auditing this data is critical to ensuring that outputs do not disproportionately affect specific groups or skew results." While adaptability (C) and model parameters like temperature (D) affect behavior, they do not address the root cause of most biases. The development environment (B) supports infrastructure but not ethical assurance. Reference: ISACA Advanced in AI Audit™ (AAIA™) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Bias and Fairness in AI Systems"
AAIA Exam Question 24
An AI model predicts vehicle component failures using data collected at different frequencies and formats based on car type. Which of the following is the BEST course of action when evaluating data input requirements for the model?
Correct Answer: A
For reliable model performance and meaningful comparisons across inputs,data consistencyis essential. Standardizing sensor data frequency and formats ensures that the model receives aligned time steps and coherent feature structures, reducing the risk of spurious patterns, missing signals, and biased predictions. This is aligned with AAIA's focus ondata quality, data balancing, and data preparationin AI Operations. Option B ignores frequency and formatting differences, likely introducing noise and misalignment. Option C may sometimes be valid, but it increases complexity, maintenance overhead, and may still require consistent preprocessing pipelines. Option D addresses only one data source and does not solve the problem of heterogeneous sensor data. The most robust operational approach is to define clear data input requirements and standardize the sensor data(option A) before training. References: ISACA,AAIA Exam Content Outline- Domain 2: AI Operations (Data Management Specific to AI - data quality, data balancing, data security). ISACA AI operations guidance on data pipelines and preprocessing for AI models.
AAIA Exam Question 25
Which of the following should be an IS auditor's GREATEST concern if class imbalance is identified in training data for an AI model?
Correct Answer: C
Class imbalanceoccurs when one or more classes are underrepresented in the training data. The GREATEST concern ismodel bias(C): the model may learn to favor the majority class, leading to poor performance and unfair treatment for minority classes. In high-stakes applications (e.g., fraud detection, credit scoring, medical diagnosis), this can translate intosystematic discrimination or incorrect decisions. AAIA highlights class imbalance as a common source of bias and stresses mitigation techniques (resampling, reweighting, threshold adjustments). Data drift (A) refers to changes in data distributions over time-related but distinct. Data quality (B) is broader and may or may not be affected by imbalance. Overfitting (D) is a risk, but class imbalance more directly raises fairness and representativeness concerns rather than overfitting alone. Thus,bias arising from class imbalanceis the auditor's primary concern. References: ISACA,AAIA Exam Content Outline- Domain 2: Data Management Specific to AI (data balancing, bias risk). ISACA AI ethics and model risk guidance discussing class imbalance and fairness.
