Isaca Updated AAIA Exam Questions and Answers by raheem

Bias in AI models is most commonly introduced through the training data. The AAIA™ Study Guide highlights that to ensure fairness, auditors and developers must evaluate the diversity, representativeness, and quality of the data used to train the model.

“The greatest source of bias in AI comes from the training data. Reviewing and auditing this data is critical to ensuring that outputs do not disproportionately affect specific groups or skew results.”

While adaptability (C) and model parameters like temperature (D) affect behavior, they do not address the root cause of most biases. The development environment (B) supports infrastructure but not ethical assurance.

The AAIA™ Study Guide emphasizes that the foundation of any high-performing and ethical AI system lies in the quality and integrity of its data. For high-risk AI systems, such as those used in healthcare, finance, or criminal justice, it is essential to base models on trustworthy data. This ensures reliable predictions, reduces bias, and mitigates risk.

“Trustworthy datasets are characterized by accuracy, completeness, consistency, and ethical sourcing. In high-risk AI applications, ensuring data quality at every stage is crucial to system reliability and compliance.”

While backups, user training, and MFA are important for security and operational resilience, they do not address the core challenge of ensuring model accuracy and fairness at the development and design phase. Therefore, option C is the most effective practice.

In the case of a potential data exposure through AI model outputs, the first and most responsible action from an auditing and risk standpoint is to halt further risk propagation. According to the AAIA™ Study Guide, immediate containment is vital, especially when regulatory and reputational risks are high.

“Upon detection of a data breach risk, AI models should be immediately disabled from public or partner use, and all relevant parties should be notified as part of a responsible disclosure and containment strategy.”

While options A and D are longer-term remediation steps and B is investigative, none of them provide the urgent containment that is best practice in such a breach context.

Including AI-specific disruption scenarios in the organization’s Disaster Recovery Plan (DRP) ensures preparedness for worst-case events affecting AI systems. The AAIA™ Study Guide recommends tailoring business continuity and DR strategies to cover model unavailability, data corruption, and AI-specific dependencies.

“AI disruptions can arise from unique causes such as model corruption, adversarial attacks, or drift. Integrating these into the DRP allows for effective, scenario-specific responses and minimizes downtime.”

Tabletop exercises (A) are valuable for preparedness but are less comprehensive than scenario planning. Kill chains (B) are security-specific. KRIs (C) aid in monitoring but don’t ensure recovery. Therefore, D offers the most robust mitigation.