AAIA ISACA Advanced in AI Audit - Set 1 - Part 1

Correct Answer: Limited memory artificial intelligence

Option c is correct because limited memory AI systems store recent information and use it to inform current decisions, making them ideal for chatbots that must maintain conversation context throughout a session.

Option a is incorrect because reactive machines respond only to current input with no memory of past interactions, making them unsuitable for maintaining coherent multi-turn conversations with patients.

Option d is incorrect because self-aware AI possessing consciousness and subjective experience is theoretical and not required for practical chatbot functionality in healthcare settings today.

Option d is incorrect because self-aware AI possessing consciousness and subjective experience is theoretical and not required for practical chatbot functionality in healthcare settings today.

Correct Answer: Intellectual property and data provenance

Option a is correct because generative AI systems raise significant concerns about training data provenance, potential inclusion of copyrighted material, and ownership questions regarding AI-generated content and synthetic data.

Option b is incorrect because while model accuracy matters, the primary concern with generative AI specifically involves intellectual property issues and the source of training data rather than predictive accuracy.

Option c is incorrect because reinforcement learning safety constraints relate to trial-and-error learning approaches, not to generative models that create new content from learned patterns in datasets.

Option d is incorrect because supervised learning label quality concerns apply to classification and regression tasks with labeled training data, not generative models creating synthetic content outputs.

Correct Answer: Overfitting to the training data

Option d is correct because overfitting occurs when a model memorizes training data including noise and quirks rather than learning generalizable patterns, resulting in excellent training performance but poor real-world results.

Option a is incorrect because while statistical bias affects model fairness, the specific symptom of excellent training accuracy coupled with poor deployment accuracy is the classic signature of overfitting.

Option b is incorrect because inadequate hyperparameter tuning typically results in suboptimal performance during both training and deployment phases, not the dramatic gap described in this scenario situation.

Option c is incorrect because reinforcement learning involves trial-and-error learning through environment interaction, which is unrelated to the training versus deployment accuracy discrepancy described here.

Correct Answer: Statistical bias from sampling issues

Option b is correct because statistical bias arises from issues within data collection, sampling, and processing methods, such as unrepresentative sample data that over-represents certain geographic regions in fraud cases.

Option a is incorrect because human bias involves subjective judgments during the AI lifecycle like labeling decisions or design choices, not the geographic composition of collected transaction data samples.

Option c is incorrect because systemic bias stems from inherent biases in societal structures and institutions that become embedded in data, not from technical sampling methodology limitations during collection.

Option d is incorrect because algorithmic bias relates to model architecture and computational methods, whereas the scenario describes a data representativeness problem during the data gathering phase.

Correct Answer: Unsupervised learning with clustering techniques

Option c is correct because unsupervised learning is designed to find patterns, structures, and relationships in unlabeled data, making clustering techniques ideal for discovering hidden groupings in sensor readings.

Option a is incorrect because supervised learning requires labeled data where each input is paired with the correct output, which is explicitly absent in this scenario with unlabeled sensor readings.

Option b is incorrect because reinforcement learning involves an agent learning through trial and error with rewards and penalties, not pattern discovery in historical equipment sensor datasets.

Option d is incorrect because while deep learning is powerful, using it with labeled image data is irrelevant when the task involves unlabeled sensor readings requiring pattern discovery.

Correct Answer: Lack of cross-functional holistic perspective

Option a is correct because effective AI steering committees require cross-functional representation including IT, risk management, legal, operations, and finance to ensure a holistic view of AI implications.

Option b is incorrect because while technical expertise concentration exists, the fundamental problem is missing perspectives from legal, risk, and operations rather than having too many technical members present.

Option c is incorrect because the primary governance gap involves internal cross-functional representation, not external stakeholder involvement, which is a separate consideration for comprehensive AI governance programs.

Option d is incorrect because the committee already includes data science representation; the deficiency lies in missing non-technical perspectives that provide legal, risk, and operational viewpoints.

Correct Answer: Requirement for maximum data and algorithm control

Option d is correct because internal hosting provides full control over hardware, software, data, and proprietary algorithms without transmitting sensitive information to external providers or risking intellectual property exposure.

Option a is incorrect because high scalability requirements actually favor cloud hosting, which can easily scale resources up or down based on demand without significant capital investment.

Option b is incorrect because minimizing upfront capital costs favors cloud hosting with its pay-as-you-go model rather than internal hosting requiring significant infrastructure investment upfront.

Option c is incorrect because preferring outsourced infrastructure management favors cloud hosting where providers handle maintenance, not internal hosting requiring dedicated specialized staff.

Correct Answer: Model drift affecting system performance

Option c is correct because model drift occurs when real-world data diverges from training data over time, causing performance degradation, which explains why the chatbot struggles with newer product questions.

Option a is incorrect because initial training data problems would have manifested immediately after deployment, not after eighteen months of previously acceptable performance with declining recent satisfaction scores.

Option b is incorrect because hyperparameter configuration errors would cause consistent performance issues from the start rather than gradual degradation appearing after extended operational time in production.

Option d is incorrect because overfitting manifests as poor real-world performance immediately upon deployment, not as gradual decline after an extended period of successful customer service operations.

Correct Answer: Risk tolerance and prioritization framework

Option a is correct because risk tolerance defines how much risk an organization accepts while pursuing objectives, and prioritization enables deciding which risks require immediate action versus ongoing monitoring.

Option b is incorrect because the scenario states that potential risks have already been identified, indicating that risk identification methodology is functioning but subsequent prioritization processes are absent.

Option c is incorrect because technical controls address specific risks after prioritization decisions are made; the gap exists in determining which risks warrant control implementation in the first place.

Option d is incorrect because monitoring dashboards support ongoing surveillance after prioritization; without a framework for prioritization, monitoring efforts cannot be appropriately focused on critical risks.

Correct Answer: High risk with strict mandatory requirements

Option d is correct because AI systems used in government administration affecting fundamental rights, such as citizenship decisions, fall under high-risk classification requiring mandatory risk management and human oversight.

Option a is incorrect because minimal risk applies to simple applications like spam filters or video game AI, not government systems making decisions that significantly impact individuals' fundamental rights.

Option b is incorrect because unacceptable risk is reserved for practices like government social scoring systems that pose clear threats to fundamental rights, not legitimate administrative processing assistance.

Option c is incorrect because limited risk with transparency obligations applies to systems like general chatbots where users must know they interact with AI, not high-stakes government decision-making.

Correct Answer: Privacy as the default system setting

Option c is correct because privacy as the default requires that data collection be minimized by default and that only necessary data be gathered, which is violated when excessive behavioral data is collected but unused.

Option a is incorrect because end-to-end security concerns protection throughout the data lifecycle rather than the initial decision about how much data to collect for the system's intended purpose.

Option b is incorrect because while proactive prevention is important, the specific violation here is collecting more data than needed by default rather than failing to anticipate potential privacy harms.

Option d is incorrect because transparency involves informing users about data handling practices; the issue here is excessive collection regardless of whether users are informed about these practices.

Correct Answer: Provide meaningful information about decision logic

Option a is correct because GDPR grants individuals the right to meaningful information about the logic involved in automated decision-making, especially for decisions with significant effects like medical diagnoses.

Option b is incorrect because GDPR does not prohibit AI use in medical contexts; rather, it requires appropriate safeguards, transparency, and the right to contest automated decisions affecting individuals.

Option c is incorrect because while consent is important, GDPR's automated decision-making provisions focus on transparency and the right to human intervention rather than requiring separate consent per decision.

Option d is incorrect because while CCPA has provisions potentially requiring logic disclosure, GDPR requires meaningful information about decision logic rather than complete source code disclosure to individuals.

Correct Answer: Systemic bias from societal structures

Option d is correct because systemic bias stems from historical inequities embedded in societal structures and practices that become reflected in training data, causing AI to perpetuate existing discrimination patterns.

Option a is incorrect because human bias involves subjective judgments during AI development, not the reflection of historical societal inequities that existed prior to the AI system being developed.

Option b is incorrect because statistical bias relates to sampling methodology and data collection errors, not the societal patterns of income disparity across neighborhoods reflected in historical insurance data.

Option c is incorrect because algorithmic bias concerns model architecture and computational methods, whereas this scenario describes discrimination patterns learned from historically biased societal data inputs.

Correct Answer: Establish a dedicated AI steering committee

Option b is correct because organizations serious about AI benefit from a dedicated AI steering committee with cross-functional representation that can focus specifically on AI strategy, risks, and governance requirements.

Option a is incorrect because while existing IT committees can provide oversight, AI's unique challenges involving ethics, bias, and organizational transformation often require dedicated focus beyond traditional IT governance.

Option c is incorrect because delegating all decisions to data scientists excludes essential perspectives from legal, risk management, operations, and business leadership needed for comprehensive AI governance oversight.

Option d is incorrect because outsourcing governance to vendors contradicts the principle that organizations cannot outsource accountability and must retain oversight responsibility for AI systems they deploy.

Correct Answer: Rate of irrelevant recommendations flagged

Option c is correct because the rate of irrelevant recommendations flagged serves as an early warning indicator that the AI system may be degrading, allowing intervention before significant customer impact occurs.

Option a is incorrect because total recommendations generated is a volume metric that does not indicate quality problems or emerging risks; high volume could mask declining relevance of recommendations.

Option b is incorrect because revenue attribution is a lagging performance indicator showing past success rather than an early warning signal of potential problems developing within the system.

Option d is incorrect because processing speed measures technical efficiency rather than recommendation quality; fast but irrelevant recommendations would not be detected by this metric alone.

Correct Answer: Bias and fairness testing across groups

Option a is correct because bias and fairness testing evaluates whether the model produces equitable outcomes across different demographic groups, which is essential before deploying credit decision systems affecting real applicants.

Option b is incorrect because performance testing for speed measures technical efficiency rather than whether decisions are fair and unbiased across different groups of loan applicants being evaluated.

Option c is incorrect because stress testing validates system behavior under high load conditions but does not assess whether credit decisions treat applicants from different demographic groups equitably.

Option d is incorrect because competitive benchmarking compares functionality against other solutions but does not specifically address fairness concerns that are critical for loan decision AI systems.

Correct Answer: Shared based on control and contribution

Option d is correct because shared responsibility models allocate accountability based on which party controls each layer; the vendor is responsible for the core model while the customer bears responsibility for data configuration.

Option a is incorrect because while the vendor created the biased core model, the customer also bears responsibility for their data pipeline configuration that feeds inputs into the AI system.

Option b is incorrect because placing entire responsibility on the customer ignores that the fundamental bias exists within the vendor's core model, which the customer cannot directly modify or control.

Option c is incorrect because equal splitting does not reflect actual control and contribution; responsibility should be proportionate to each party's role in creating and feeding the bias.

Correct Answer: AI systems can learn and adapt behavior

Option c is correct because AI's ability to learn from data and adapt its behavior over time creates unique governance challenges including emergent behavior and the black-box problem that traditional IT policies cannot address.

Option a is incorrect because network connectivity requirements exist for many traditional IT systems and do not represent a unique AI characteristic requiring specialized policy development beyond standard IT governance.

Option b is incorrect because while AI often processes large data volumes, big data management is addressed in traditional data governance policies and is not uniquely an AI-specific challenge.

Option d is incorrect because regular software updates are standard IT practice; AI's unique challenge is that the system's behavior can change through learning without explicit software modifications being deployed.

Correct Answer: Seek positive-sum solutions preserving both

Option a is correct because Privacy by Design's fourth principle requires full functionality through positive-sum approaches where both privacy and functionality objectives are achieved without unnecessary trade-offs.

Option b is incorrect because Privacy by Design explicitly rejects zero-sum thinking that sacrifices privacy for functionality; creative solutions should be sought to achieve both objectives simultaneously.

Option c is incorrect because accepting reduced functionality contradicts the positive-sum principle; organizations should innovate to find solutions that deliver full functionality while protecting privacy.

Option d is incorrect because Privacy by Design requires embedding privacy from the beginning, not as an afterthought; deferring to post-deployment contradicts the proactive principle of this framework.

Correct Answer: Inadequate role-based training coverage

Option d is correct because effective AI training must extend to all roles affected by AI systems, including business users who make decisions based on AI outputs, not just technical staff who build systems.

Option a is incorrect because the finding indicates insufficient breadth of training coverage rather than depth; technical staff received extensive training while business users received inadequate coverage.

Option b is incorrect because the scenario does not mention compliance training; the issue is that business users who need training on AI usage and limitations received insufficient attention overall.

Option c is incorrect because the training program exists with extensive technical components, suggesting executive support; the gap is in training design coverage rather than sponsorship availability.