Isaca Updated AAISM Exam Questions and Answers by elisei

AAISM governance guidance stresses that when dealing with agentic AI systems capable of autonomous decision-making, the primary consideration is accountability. Without clear accountability structures, unforeseen or harmful outcomes may result in unmitigated liability for the organization. While dependencies, base models, and defined risk levels are important, they do not directly address who is responsible when systems act unpredictably. The key governance safeguard is the implementation of an accountability model that ensures liability and oversight are properly assigned.

Within AAISM’s privacy governance, consent is a lawful basis that authorizes processing of personal data for defined purposes. Its principal significance is granting the organization the authority to process user data in AI workflows in line with stated purposes and limits. While fairness (A) and security controls (C) are essential, they are distinct obligations; data subject rights such as rectification/erasure (B) exist regardless of consent and are not “enabled” by it. Therefore, the greatest significance of consent is that it legally permits processing under declared purposes and constraints.

According to AAISM, hyperparameter tuning uses validation data, not training or test data. Validation datasets are specifically designed to evaluate different hyperparameter configurations without contaminating the training or testing sets.

Training data (C) teaches the model. Test data (D) is used only for final evaluation. Configuration data (B) is unrelated to performance optimization.

AAISM governance practices emphasize automation as the most effective way to maintain comprehensive, accurate, and scalable data classification and inventory management. An automated data cataloging tool integrated with all repositories ensures continuous visibility, reduces human error, and supports regulatory compliance. Centralized teams and manual processes provide oversight but cannot achieve the same scale and consistency. Periodic audits detect issues but are reactive rather than proactive. For effective governance, the best solution is automated cataloging integrated across data repositories.