Isaca Updated AAIA Exam Questions and Answers by jaxxon

To determine whether an AI model’s outputs are effectively controlled for bias , an auditor needs empirical performance evidence across demographic groups. Similar accuracy ranges across groups (A) demonstrate that the model performs equitably and does not disproportionately advantage or disadvantage specific populations. This aligns with AAIA’s emphasis on fairness metrics , such as disparate error rates, equal opportunity, and demographic parity analyses.

Option B (fairness definition) is important for governance but does not prove fairness in practice. Option C may introduce historical human bias rather than mitigate it. Option D (transparency of development) supports explainability but does not validate fairness outcomes. Actual performance parity across demographic groups is the strongest evidence of bias control.

Ensuring AI model resilience against external threats involves validating that the model is configured to resist attacks, such as adversarial inputs, data poisoning, or misuse. The AAIA™ Study Guide emphasizes configuration testing as a crucial control to simulate threat scenarios and assess robustness.

“Model configuration testing simulates real-world threat conditions to validate model resilience. This includes testing against adversarial attacks, input manipulation, and exposure of sensitive outputs.”

While access monitoring (C) and anonymization (A) reduce risks, they don’t actively validate model behavior under threat conditions. Therefore, D offers the most effective resilience measure.

The AAIA™ Study Guide stresses that inputting confidential or proprietary data into third-party generative AI tools may result in unauthorized data disclosure. These tools may store, process, or retrain on the input data, leading to privacy and intellectual property risks.

“When employees input sensitive data into external AI tools, organizations risk losing control over that information. This may result in regulatory non-compliance, legal exposure, and irreversible data leakage.”

While business disruption (C) and reliance (D) are notable, the most severe and immediate risk is B—unauthorized disclosure. Data contamination (A) impacts model reliability, not data security.

In AI development, a " seed " ensures that random processes (like weight initialization) are reproducible. If an A/B test compares two models using different seeds, the auditor cannot tell if the performance difference is due to the model changes or simply due to " random luck " in how the weights were initialized. This invalidates the test results. For a fair " apple-to-apples " comparison, the seed should remain consistent. Tuning on a training set (Option B) is standard, though it risks overfitting; however, the lack of scientific control in testing (Option C) is a more immediate risk to the integrity of the change management process.