ISACA Advanced in AI Audit (AAIA)

AI-related incidents often differ significantly from traditional IT incidents due to their dependence on data, model behavior, and algorithm performance. According to the AAIATM Study Guide, incident management programs must include capabilities specifically tailored to AI, such as detecting and mitigating model drift and safeguarding against data poisoning or integrity attacks.

"AI incident response frameworks must account for issues unique to machine learning, including model drift, adversarial inputs, and data integrity breaches. An effective program incorporates detection, response, and recovery mechanisms for these AI-specific threats."

While options A and B contribute to improving incident response over time, and option D suggests best-practice alignment, only
option C directly addresses active response capabilities for high-risk, real-time AI vulnerabilities.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk
Management," Subsection: "Incident and Risk Management in AI Contexts"

When using generative AI tools during audit activities, the most critical concern is the reliability and appropriateness of the information being entered and processed. According to the AAIATM Study Guide, auditors are accountable for ensuring that audit data is valid, confidential, and that generated outputs are factual and verifiable.

"IS auditors must evaluate whether the information entered into AI tools is reliable and appropriate for the audit context. Inputting sensitive or unverified data may lead to regulatory violations or audit inaccuracies."

While hallucinations (C) and privacy notices (B) are important concerns, the primary auditor responsibility is to ensure that source data is accurate and suitable. Therefore, D is the correct response.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal
Considerations in AI," Subsection: "Auditor Responsibility and AI Input Validation"

Sudden and unexplained changes in AI-generated credit scores may result from data drift, model overfitting, or lack of recalibration. According to the AAIATM Study Guide, regular expert review and calibration help maintain model reliability and transparency, particularly in high-stakes decisions like credit scoring.

"Ongoing human oversight ensures that predictive models remain stable and justifiable. In high-impact environments, such as banking, experts must review and recalibrate AI systems to prevent opaque or unexpected behavior."

Option B may cause the exclusion of relevant long-term patterns. C promotes risk by removing oversight.
D is a validation strategy, not a stability control. Therefore, A is the best option.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Operations and
Performance," Subsection: "Model Monitoring and Recalibration Strategies"

Data drift occurs when the statistical properties of input data change over time, impacting the accuracy of an AI model. In this case, the model failed to adapt to recent demand trends, indicating that the data on which it was trained no longer reflects current behavior.

"Data drift leads to performance degradation in AI systems when real-world input data shifts away from training data patterns. Monitoring for drift is essential, particularly in dynamic environments such as retail."

Although training diversity (A) and outlier detection (D) are relevant to accuracy, only B addresses the temporal misalignment between training data and real-time data. Overfitting (C) would more likely cause poor generalization in other contexts.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Operations and
Performance," Subsection: "Model Monitoring and Data Drift Detection"

The integrity of data fed into AI systems is a critical concern. The AAIATM Study Guide emphasizes that validation and filtration processes are essential to mitigate the risk of data poisoning--an attack that can manipulate model behavior by injecting malicious inputs.

"Data poisoning represents a major vulnerability in AI pipelines. Effective controls include robust validation, filtration, and monitoring of training data sources. These preventive practices are essential to ensure model reliability and security."

While options A, B, and C are important operational and training measures, only D addresses a technical risk that can directly compromise model outputs and trustworthiness.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk
Management," Subsection: "AI Data Integrity and Attack Prevention"

The AAIATM Study Guide defines the core purpose of machine learning as the ability to enable systems to learn from data and make decisions or perform tasks that typically require human cognitive functions. ML allows AI systems to identify patterns, learn from historical data, and automate complex decision-making.

"Machine learning empowers systems to simulate aspects of human intelligence, including pattern recognition, language understanding, and decision-making. It forms the backbone of many AI applications designed to replace or augment human tasks."

While visual analysis (A) and statistical inference (D) are functions of ML, they are subsets--not primary goals. Explainability (B) is important but is not a core ML function. Thus, C best represents the primary objective.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Fundamentals and
Technologies," Subsection: "Machine Learning Basics and Objectives"

The greatest challenge for IS auditors in evaluating the explainability of generative AI models is the changing nature of algorithms as AI continues to learn (option D). Generative AI models, especially those using advanced techniques like deep learning and reinforcement learning, often employ continuous or dynamic learning, which results in models that evolve over time. This adaptability can significantly hinder explainability because the logic, parameters, or decision pathways may shift with ongoing retraining or real-time learning.

The ISACA Advanced in AI AuditTM (AAIATM) Study Guide stresses that: "Continually learning AI systems present unique audit challenges, as their internal representations and reasoning can change after deployment, making it difficult to fully capture and explain the rationale for outputs at any given point."

Other options, such as bias in input data or computational performance, are significant but do not pose as fundamental a challenge to explainability as a model whose internal workings can dynamically change.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Explainability and
Dynamic Models"

Generative AI excels at synthesizing large datasets and technical documentation into understandable insights. The AAIATM Study Guide recommends leveraging generative AI to identify domain-specific risks and control considerations by analyzing complex environments and correlating them with industry risk patterns.

"AI can assist auditors during planning by generating tailored risk profiles for technologies under review, helping prioritize audit focus and scoping."

While summarizing interviews (D) and creating diagrams (B) are helpful, only C directly informs audit planning with actionable intelligence. A (separation of duties) is a later-stage control assessment.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI in Audit Processes,"
Subsection: "Generative AI Use in Planning and Scoping"

The AAIATM Study Guide stresses that inputting confidential or proprietary data into third-party generative AI tools may result in unauthorized data disclosure. These tools may store, process, or retrain on the input data, leading to privacy and intellectual property risks.

"When employees input sensitive data into external AI tools, organizations risk losing control over that information. This may result in regulatory non-compliance, legal exposure, and irreversible data leakage."

While business disruption (C) and reliance (D) are notable, the most severe and immediate risk is B-- unauthorized disclosure. Data contamination (A) impacts model reliability, not data security.
References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI,"
Subsection: "Data Privacy and Use of External AI Tools"

An AI acceptable use policy (AUP) defines how AI tools and technologies should be ethically and responsibly used within an organization. According to the AAIATM Study Guide, the primary goal of an AUP is to prevent misuse and promote adherence to ethical, legal, and operational standards.

"An AI acceptable use policy provides governance over how AI tools may be used, especially regarding data handling, fairness, and prohibited uses. It aligns employee actions with organizational values and compliance requirements."

Monitoring procedures (B), training (C), and taxonomy explanations (D) may be included in broader AI documentation, but the AUP's core purpose is ethical usage governance.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk
Management," Subsection: "Policies, Standards, and Ethical Frameworks for AI"