Isaca Updated AAIR Exam Questions and Answers by skyler

Risk avoidance is the risk treatment strategy of not engaging in an activity because the risks it presents cannot be adequately mitigated to within acceptable tolerance. For high-impact AI systems, the justification for avoidance must be proportionate to the gravity of the decision to forgo deployment entirely.

Why A is Correct: The ISACA AAIR risk treatment framework identifies potential harm to stakeholders as the most compelling justification for risk avoidance in AI deployment decisions. When a high-impact AI system poses risks of significant harm to individuals, communities, or society that cannot be adequately controlled, avoiding deployment is the ethically and legally appropriate choice. Stakeholder harm—especially irreversible or widespread harm—represents the highest severity risk outcome and justifies the most conservative risk treatment.

Why B is Wrong: Cost reduction objectives are business case considerations, not risk management justifications. Avoiding deployment to reduce costs is a financial decision, not a risk avoidance strategy. Risk avoidance decisions are driven by harm potential, not cost efficiency.

Why C is Wrong: Staff expertise shortages represent an organizational capability constraint that can be addressed through hiring, training, or managed services. A capability gap is a surmountable operational challenge, not a justification for permanently avoiding a valuable deployment.

Why D is Wrong: Data poisoning attack likelihood is a security risk that can be mitigated through appropriate controls—data integrity verification, provenance tracking, anomaly detection. A manageable risk with available mitigations does not justify full risk avoidance when stakeholder harm is not at stake.

A RACI (Responsible, Accountable, Consulted, Informed) matrix is a governance tool that explicitly maps roles and decision authority across project activities. For AI systems, RACI frameworks ensure that accountability for decisions, outputs, and risk management is clearly defined and documented.

Why D is Correct: The ISACA AAIR curriculum identifies the RACI matrix as a foundational accountability instrument. Its primary benefit is establishing unambiguous responsibility and decision authority, which is essential for AI governance where multiple stakeholders—technical teams, business owners, risk practitioners, compliance officers—must work together with clear lanes of authority. This clarity prevents accountability gaps and ensures risk management actions are owned.

Why A is Wrong: Facilitating collaboration is a secondary benefit. While RACI does support cross-functional coordination, collaboration enablement is not its defining purpose. Collaboration can occur without a RACI through other mechanisms.

Why B is Wrong: Consolidating governance authority in senior leadership describes centralization, which is not the purpose of RACI. In fact, RACI typically distributes responsibility across multiple levels rather than consolidating it.

Why C is Wrong: Strengthening technical development governance is an application of the RACI, not its primary benefit. The RACI benefit is accountability clarity, which then supports technical and architectural governance.

Threat actor profiling characterizes the motivations, capabilities, and likely attack methods of potential adversaries. In AI risk management, understanding who the likely attackers are and what they seek enables the design of controls specifically matched to the actual threat landscape.

Why B is Correct: According to ISACA AAIR threat-based risk management guidance, the most important reason for threat actor profiling is to tailor controls to adversary motivations and capabilities. Different threat actors—nation-state attackers, criminal organizations, competitors, insiders, activists—have different objectives (espionage vs. financial gain vs. disruption), capabilities (sophisticated vs. opportunistic), and methods. Controls calibrated to actual threat actor profiles are significantly more effective than generic controls that may not address the specific threats the organization actually faces.

Why A is Wrong: Aligning AI threats with IT control taxonomy is a governance integration activity that improves control consistency but does not capture the threat actor-specific tailoring value of profiling. Taxonomy alignment is an administrative benefit; threat-tailored controls are a security effectiveness benefit.

Why C is Wrong: Response metrics for cybersecurity incidents are developed for incident management planning. Threat actor profiling informs control design and incident response strategies but is not primarily used to develop response metrics.

Why D is Wrong: Prioritizing external threats over internal threats is a security strategy choice that threat actor profiling does not prescribe. Many AI attacks, including insider threats and social engineering, are internal. Profiling should result in appropriate prioritization based on actual threat likelihood, not a blanket prioritization of external threats.

AI governance depends on the ability of stakeholders to understand, audit, and oversee AI model decisions. Explainability is the technical and documentation property that enables this oversight. When model cards fail to adequately document explainability, the entire governance chain is compromised.

Why B is Correct: According to ISACA AAIR, inadequate explainability in model documentation is the greatest governance risk because it prevents risk practitioners, auditors, regulators, and business owners from understanding why a model produces its outputs. Without explainability, discriminatory or erroneous decisions cannot be identified, challenged, or corrected. This undermines accountability, compliance, and responsible AI governance at the enterprise level.

Why A is Wrong: Regulatory filing delays represent a compliance timing issue that can be remediated. While risky, they do not fundamentally compromise the governance capability of understanding and overseeing AI behavior.

Why C is Wrong: Decentralized version control creates configuration management challenges and audit trail gaps. These are significant but can be remediated through governance process improvements. Explainability gaps affect the underlying ability to govern the model itself.

Why D is Wrong: Overly detailed technical specifications represent a documentation quality issue that may reduce usability but does not create a governance risk. Excessive detail is easily distilled; absent explainability cannot be reconstructed after the fact.