Isaca Updated AAIA Exam Questions and Answers by celine

In AI systems, data accuracy and privacy are foundational to both performance and regulatory compliance. Inadequate controls over data accuracy and privacy compliance (D) pose the greatest risk , as they can lead to incorrect decisions, legal violations, regulatory penalties, and significant reputational damage. AAIA emphasizes that data governance programs must ensure data is accurate, secure, lawfully processed, and appropriately protected throughout the AI life cycle.

Option A (inconsistent practices) is concerning but is often a symptom of underlying governance weaknesses; its impact is most severe when it affects accuracy and privacy. Option B focuses on backup procedures, which are important for availability and resilience, but not as central to AI decision quality and legal risk. Option C (limited performance and accuracy reviews) is serious but again narrower than outright inadequacy of key controls over accuracy and privacy.

For " edge cases " or " rare scenarios " (often called " black swan " events), historical data is insufficient because the events haven ' t happened yet. " Synthetic data " is artificially generated data that maintains the statistical properties of real data but includes simulated rare events. This allows auditors to " stress test " how the AI model would react to extreme conditions, such as a massive market crash or a rare medical emergency. Anonymized or de-identified data only reflects past occurrences. Using synthetic data is a proactive testing strategy to ensure the AI ' s safety and robustness in unpredictable environments.

For a predictive AI tool analyzing abnormalities , the GREATEST concern is the rate and impact of false positives and false negatives (A). False positives can lead to unnecessary investigation, while false negatives mean true issues (e.g., fraud, control failures) remain undetected. From an assurance perspective, false negatives are especially critical because they directly undermine audit objectives. AAIA underscores that key performance metrics (e.g., precision, recall) and error trade-offs are essential in evaluating AI tools used in audit.

Integration ease (B), speed (C), and cost (D) are important practical considerations but are secondary to whether the tool accurately identifies or misses significant anomalies . Therefore, error behavior—false positives and false negatives—represents the primary risk to audit quality.

" Agentic AI " possesses the autonomy to perform actions within a system. In a cybersecurity context, an agent might autonomously block an IP or shut down a database if it detects a threat. The most significant risk is that a " False Positive " could trigger an automated response that causes a massive service disruption. Auditors must validate the existence of " Guardrails, " " Human-in-the-loop " approval for high-impact actions, and " Kill Switches " to halt the agent if it behaves erratically. While reduced intervention (Option B) is a benefit, it is also the primary driver of this operational risk.