Isaca Updated AAISM Exam Questions and Answers by erica

AAISM emphasizes that the primary objective of responsible AI is to establish and maintain trust in AI-driven decisions and predictions. Trust is achieved through transparency, accountability, fairness, and governance. While confidentiality and integrity are critical technical objectives, they are not the overarching purpose of responsible AI service provision. Autonomy and learning ability are features of AI, but without trust, adoption and compliance falter. The correct answer is that responsible AI services must focus on building trust in AI outcomes.

AAISM materials make clear that the best safeguard against sensitive information being leaked through the outputs of LLMs is data sanitization. This involves filtering, redacting, or masking sensitive content before the model can use it, thereby preventing unintended disclosure in outputs. Encryption protects confidentiality in storage and transmission but does not stop output leaks. Adversarial testing helps identify vulnerabilities but does not prevent exposure by itself. Least privilege access restricts who can interact with the model but does not sanitize the content of its outputs. The control most directly tied to preventing leakage is implementing data sanitization techniques.

AAISM governance practices identify ownership and accountability as the most critical element in any centralized AI inventory. An AI inventory provides oversight by cataloging all AI assets within an organization, and assigning responsibility ensures that each system has clear governance, monitoring, and compliance coverage. While use cases, training data, and registries are valuable metadata, they do not guarantee accountability. Without defined ownership, no party is responsible for addressing risk, bias, or incidents. Therefore, the most important information to include is ownership and accountability details for each AI system.

AAISM risk management guidance clarifies that the organization’s risk tolerance is the most important factor in determining how much monitoring is needed. Risk tolerance specifies the amount of risk the organization is willing to accept and defines the threshold for triggering monitoring or mitigation activities. Risk appetite is broader and strategic, while tolerance sets the operational limits. The number of users may influence scale, and compensating controls may affect resilience, but neither dictates monitoring intensity as directly as risk tolerance.