Isaca Updated AAISM Exam Questions and Answers by erica

AAISM highlights the importance of an AI threat–control matrix that:

• maps threats (e.g., poisoning, exfiltration, injection)

• identifies required controls

• defines assurance/testing activities

• ensures consistent coverage across all AI components

Control baselines (A) are useful but not AI-specific. Red teaming (C) is reactive and not comprehensive. Vendor reports (D) are supplemental, not sufficient.

Third-party audit reports provide independent assurance that the vendor’s stated controls are designed and operating effectively against recognized criteria. Such attestations (e.g., audit/assurance frameworks) are traceable, repeatable, and verifiable, and they support supply-chain risk reviews and contractual assurance. Internal red-team reports are not independent, industry “peer reviews” are not control attestations, and whitepapers are marketing/educational materials without evidence of control operation.

AAISM materials identify human-in-the-loop governance as the most effective safeguard against risks such as hallucinations in AI systems used in high-stakes domains like healthcare. By ensuring that human experts validate outputs before they influence patient treatment decisions, organizations preserve accountability, safety, and accuracy. Penetration testing is a cybersecurity measure, not relevant to hallucination risk. AI impact analysis helps evaluate systemic effects but does not directly prevent faulty outputs. Data validation improves input quality but cannot fully prevent generative hallucinations. The key safeguard is human-in-the-loop oversight.

AAISM states that when evaluating external AI vendors, independently issued third-party audit reports (SOC, ISO, AI assurance assessments) provide the strongest evidence of implemented controls because they are objective, repeatable, and externally verified.

Peer reviews (A) lack formality, internal red-team reports (C) are non-independent, and whitepapers (D) are marketing documents without assurance value.