Isaca Updated AAISM Exam Questions and Answers by kira

The AAISM framework highlights that organizations adopting AI must ensure accountability structures are in place to govern ethical and responsible use. An accountability model assigns clear responsibility for decisions, outputs, and risks related to AI systems. While model cards provide transparency about a model’s design and performance, they are primarily documentation tools. Vendor monitoring focuses on third-party oversight, not internal accountability. Security by design improves resilience but does not by itself address ethical use. The governance approach that most directly supports responsible and ethical AI deployment is an accountability model.

The AAISM governance framework notes that in multi-party AI ecosystems, the greatest challenge is ensuring clear accountability for AI outputs. When models from different parties interact, responsibility for errors, bias, or harmful recommendations can be unclear, leading to disputes and compliance gaps. While aggregate risk assessment and error identification are significant, they are secondary to the fundamental governance requirement of establishing transparent lines of responsibility. Without defined accountability, no stakeholder can reliably manage or mitigate risks. Therefore, the greatest challenge in such a distributed architecture is responsibility for AI outputs.

AAISM identifies output review and annotation as the most practical compensating control when robust input validation cannot be applied.

Output moderation detects:

• maliciously influenced responses

• unsafe outputs

• security-policy violations

IAM (B) does not mitigate prompt injection itself. Human review of inputs (C) is unrealistic at scale. Fine-tuning (A) cannot guarantee full prevention.

AAISM emphasizes that data governance over the full AI life cycle is foundational. The official content describes effective AI data management as including documented procedures for: (1) how data is sourced, (2) how lineage is tracked from origin to model, and (3) how data quality is validated and monitored. This ensures transparency, accountability, and auditability, which are especially critical in regulated areas like credit assessments. While hashing identifiers (B) and encryption/access controls (C) are important privacy and security mechanisms, they are partial controls within a broader governance framework and do not, on their own, establish end-to-end life-cycle management. Limiting training to structured data (D) is a design choice and may reduce risk but is neither sufficient nor required as a best practice. Option A directly reflects AAISM’s prescribed governance controls for AI data throughout its life cycle.