Disparate impact analysisis a specific technique used to detect whether model decisions disproportionately disadvantage certain protected or sensitive groups (e.g., by gender, age, ethnicity, or other attributes). For an AI model determiningpremiums and eligibility, fairness and non-discrimination are critical regulatory and ethical requirements, and AAIA content highlights fairness and bias evaluation as core elements of AI governance and risk management.
Regression testing (A) checks that changes do not introduce defects in previously functioning components, not fairness. Cross-cluster analysis (B) may reveal patterns but is not inherently a fairness test. Predictive analytics (D) is a broad term for forward-looking analysis, not a method specifically designed to detect bias.
Therefore,disparate impact analysisis the most appropriate and targeted method to identify bias in the insurance AI model's outputs.
References:
ISACA,AAIA Exam Content Outline- Domain 1: AI Governance and Risk (bias, fairness, and transparency considerations).
ISACA AI ethics and fairness guidance used in AAIA training materials.

Root cause analysis (option B) is the most critical step for continuous improvement because it ensures that incidents are not only resolved but prevented from recurring.
AAIA incident management emphasizes:
* Identifying underlying systemic failures
* Determining whether issues arose from data, model logic, drift, integration, or human factors
* Implementing long-term mitigation strategies
* Updating governance and operational controls
Defining ownership (A) is important early in the process.
Assessing severity (D) prioritizes response.
Archiving logs (C) supports documentation.
But none of these guarantee process learning or long-term resilience.
Root cause analysis is the essential step for organizational maturation and risk reduction.
References:
AAIA Domain 2: Incident Management and Post-Incident Review
AAIA Domain 1: Continuous Improvement in AI Governance

Large Language Models (LLMs) have the capacity to memorize and unintentionally reveal sensitive information if not properly managed. As per the AAIA™ Study Guide, data masking is a critical technique that prevents the exposure of personally identifiable information (PII) or confidential content by obscuring or replacing sensitive parts of the data during training or interaction.
"Data masking ensures that training data used for LLMs does not contain real sensitive identifiers. Unlike sanitization, masking modifies data to maintain utility while eliminating exposure risk." Manual monitoring and access controls are supportive security measures, and data sanitization helps remove content but may not preserve the data's structure. Data masking offers the most proactive and technically robust solution.
Reference: ISACA Advanced in AI Audit™ (AAIA™) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Data Privacy and Information Protection in AI Systems"

The GREATEST insider threat isexfiltrating sensitive data(D). AI systems often contain rich datasets including personal, financial, operational, and proprietary information. If an insider extracts or leaks this data, the result can be severe legal, regulatory, and reputational consequences.
Destroying backups (C) affects availability but not confidentiality. Social engineering attacks (B) are serious but indirect. Hyperparameter leakage (A) exposes model configuration but usually does not endanger sensitive data directly. AAIA stresses thatdata confidentiality risksare the most severe category in AI governance.
References:
ISACA,AAIA Exam Content Outline- Domain 5: Ethical and Legal Risks; Data Protection and Confidentiality.

A numeric field stored as an object (string) format (option C) indicates improper data typing. Models cannot correctly compute correlations or statistical relationships when numerical values are stored as textual data.
AAIA emphasizes that incorrect datatypes are one of the most common causes of ML model misbehavior, including:
* Failure to compute averages, correlations, or mathematical operations
* Silent errors in preprocessing
* Skewed learning patterns
* Incorrect feature importance evaluationsThus, the Final Grade Percent field in object format is the most significant indicator of processing risk.Options A, B, and D are valid datatypes for their respective fields and pose no inherent model processing risk.
References:
AAIA Domain 2: Data Quality, Data Types, and Preprocessing.
AAIA Domain 3: AI Readiness and Data Validation.