Isaca Updated AAIR Exam Questions and Answers by dorothea

Third-party AI suppliers introduce significant risk through model updates, changes in training data, and modifications to system behavior. Contractual disclosure requirements ensure the acquiring organization can maintain active risk oversight despite not controlling the vendor's development processes.

Why B is Correct: The ISACA AAIR framework emphasizes that third-party AI contracts must protect against harms arising from undisclosed changes. When vendors make silent updates to models, the acquiring organization cannot assess new risks before they affect users, decisions, or regulated outcomes. Timely disclosure requirements enable proactive risk detection and mitigation before individuals are harmed.

Why A is Wrong: Availability guarantees are service-level concerns addressed by SLA provisions. While important operationally, they do not address the risk management imperative of understanding what changes have been made to AI models.

Why C is Wrong: Internal trust-building is a change management consideration, not the primary purpose of contractual disclosure requirements. Contracts address risk obligations, not organizational confidence.

Why D is Wrong: Vendor staff access to sensitive datasets is a data access and privacy concern addressed through data processing agreements and access controls, not model update disclosure requirements.

Synthetic data is generated algorithmically to resemble real data while protecting individual privacy. However, synthetic data generation processes may not perfectly capture the full statistical diversity of real-world populations—particularly rare conditions, edge cases, and underrepresented demographic groups.

Why A is Correct: According to ISACA AAIR data quality guidance for AI, the greatest risk of training on synthetic data is that it may not reflect real-world diversity. In healthcare, this is particularly consequential because AI models trained on non-diverse synthetic data may perform poorly for patient populations not well-represented in the original real data—potentially producing inaccurate diagnoses or treatment recommendations for vulnerable groups, perpetuating health inequities.

Why B is Wrong: While reduced diversity could contribute to increased false negatives in some scenarios, this is a specific manifestation of the broader diversity problem. The root cause—lack of real-world representativeness—is the more fundamental and comprehensive risk.

Why C is Wrong: Regulatory noncompliance from synthetic data use depends on jurisdiction-specific requirements. Many regulations explicitly encourage synthetic data to protect privacy. While compliance must be verified, it is not the greatest inherent risk of synthetic data quality.

Why D is Wrong: Synthetic data generation occurs in controlled internal environments and is not inherently more susceptible to data poisoning than other data types. Poisoning risk is a function of data pipeline controls, not whether data is synthetic or real.

AI-driven business intelligence enhances the quality and timeliness of analytical outputs across enterprise risk processes. When integrated into risk management, AI analytics can continuously compare emerging risk signals against organizational risk thresholds, providing real-time alignment verification that human analysts cannot achieve at scale.

Why B is Correct: According to ISACA AAIR analytics integration guidance, the primary benefit of integrating AI-driven business intelligence into enterprise risk processes is enhanced alignment of analysis outputs with organizational risk thresholds. AI analytics tools continuously process risk data at scale, comparing patterns and emerging exposures against defined thresholds to provide risk practitioners with timely, calibrated intelligence. This alignment ensures risk responses are proportionate and that threshold breaches are detected promptly rather than discovered during periodic reviews.

Why A is Wrong: Cost reduction through eliminating redundant oversight mechanisms is an efficiency benefit that may result from process optimization but is not the primary purpose of integrating AI-driven business intelligence. Oversight mechanisms may be streamlined but rarely eliminated entirely.

Why C is Wrong: Automated production of technical performance reports is an operational reporting automation benefit. While valuable for reducing manual reporting burden, it is a narrow operational benefit compared to the strategic risk alignment value of AI-enhanced analytics.

Why D is Wrong: AI inventory governance and classification is a risk management administration function. Centralizing these activities is an organizational efficiency benefit, not the primary value delivered by AI-driven business intelligence integration into risk processes.

AI-driven technical support systems rely on accurate, current knowledge to resolve user issues. Model drift causes the system to diverge from real-world conditions, producing inaccurate outputs that erode user trust, increase escalations, and potentially cause harm if incorrect technical guidance is followed.

Why A is Correct: According to ISACA AAIR validation guidance, inaccurate outputs from model drift represent the greatest risk in a technical support AI because they directly compromise the system's core function—providing correct technical guidance. Inaccurate outputs lead to unresolved issues, potential system damage from wrong instructions, and reputational harm. Unlike the other options, drift-driven inaccuracy affects every user interaction and cannot be remediated without model updates.

Why B is Correct Context: Infrequent training dataset updates are a contributing cause of model drift and are a serious concern, but they are an input factor rather than the manifest risk itself. The concern is the resulting inaccuracy.

Why C is Wrong: Encryption is a security control for data in storage and transit. While important for confidentiality, it does not affect the accuracy of AI outputs or the system's ability to provide correct technical guidance.

Why D is Wrong: Excessive manual sampling is a testing methodology concern that may reduce testing coverage efficiency. However, it represents a process inefficiency rather than a direct risk to output quality—the model's accuracy is the greater concern.