AI-related incidents often differ significantly from traditional IT incidents due to their dependence on data, model behavior, and algorithm performance. According to the AAIA™ Study Guide, incident management programs must include capabilities specifically tailored to AI, such as detecting and mitigating model drift and safeguarding against data poisoning or integrity attacks.
"AI incident response frameworks must account for issues unique to machine learning, including model drift, adversarial inputs, and data integrity breaches. An effective program incorporates detection, response, and recovery mechanisms for these AI-specific threats." While options A and B contribute to improving incident response over time, and option D suggests best- practice alignment, only option C directly addresses active response capabilities for high-risk, real-time AI vulnerabilities.
Reference: ISACA Advanced in AI Audit™ (AAIA™) Study Guide, Section: "AI Governance and Risk Management," Subsection: "Incident and Risk Management in AI Contexts"

Sustaining effective AI governance and risk management requirescontinuous, organization-wide awareness, not just one-off or role-limited training. Option D embeds AI topics (governance, risk, ethics, privacy, and security) into the existingsecurity awareness program, which is already a recurring and mandatory mechanism across the enterprise. This supports ongoing adaptation to rapidly evolving AI technologies, aligns with ISACA's emphasis on integrating AI risk considerations into existing governance and risk frameworks, and ensures that staff at all levels understand their responsibilities.
Options A and C are too narrow in scope, as they target only technical staff or senior management; they help but do not create pervasive, sustainable governance. Option B can supplement internal training, but outsourcing alone does not ensure continuity or alignment with internal policies.
References:
ISACA,AAIA Exam Content Outline- Domain 1: AI Governance and Risk (AI governance, AI training and awareness, program metrics).
ISACA,Advanced in AI Audit Exam Candidate Guide- sections on governance, risk, and professional responsibilities.

The use of customer data in AI training presents a significant privacy risk, especially when the data is not properly anonymized or when consent has not been explicitly obtained. The AAIA™ Study Guide classifies the unauthorized or inadvertent disclosure of personally identifiable information (PII) as the most severe risk in such contexts.
"Training AI models on customer data without proper safeguards can result in the unintentional exposure of personal or sensitive information, leading to data breaches and compliance violations." While bias (B) and hallucinations (D) are important operational concerns, they do not pose the same regulatory and ethical severity as PII exposure. Therefore, A is the most critical risk.
Reference: ISACA Advanced in AI Audit™ (AAIA™) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Privacy Risks and Data Minimization"

Government organizations are held to high standards of transparency, fairness, and accountability. Regular AI training ensures that employees remainup-to-date on ethical responsibilities, legal implications, fairness obligations, and responsible AI principles(B). This aligns with AAIA's domain onethical and legal considerations, which stresses continuous competence-building.
Cost reduction (A) is not the primary driver. Understanding tools (C) is useful but not as critical as ethics.
Avoiding outdated information (D) is secondary. Ethics training is essential because government AI decisions affect public trust, rights, and equity.
References:
ISACA,AAIA Exam Content Outline- Domain 5: Ethical AI Principles and Public-sector Obligations.

To determine whether an AI model's outputs areeffectively controlled for bias, an auditor needsempirical performance evidenceacross demographic groups.Similar accuracy ranges across groups (A)demonstrate that the model performs equitably and does not disproportionately advantage or disadvantage specific populations. This aligns with AAIA's emphasis onfairness metrics, such as disparate error rates, equal opportunity, and demographic parity analyses.
Option B (fairness definition) is important for governance but does not prove fairness in practice. Option C may introduce historical human bias rather than mitigate it. Option D (transparency of development) supports explainability but does not validate fairness outcomes. Actualperformance parity across demographic groupsis the strongest evidence of bias control.
References:
ISACA,AAIA Exam Content Outline- Domain 1: AI Governance and Risk (fairness evaluation; bias assessments).
ISACA fairness guidance emphasizing cross-group performance comparison.