Isaca Updated AAISM Exam Questions and Answers by angela

AAISM identifies executive sponsorship and senior management buy-in as the foremost success factor for AI initiatives. It secures resources, resolves cross-functional conflicts, sets risk appetite, and enforces adherence to governance and controls. Model cards (A), risk registers (B), and lifecycle data mapping (C) are vital practices within the program, but without top-level commitment, adoption, funding, and accountability often fail.

According to AAISM study guidance, the most direct and effective way to obtain large volumes of diverse data for application testing is through open-source data repositories. These repositories provide freely available, well-documented, and often standardized data that supports testing and benchmarking in a compliant manner. Model cards document AI behavior but do not provide data. Incorporating search content may introduce legal, privacy, and quality risks. Data augmentation is useful for expanding existing sets but does not provide the breadth or size required when starting with insufficient data. The recommended best practice for sourcing large testing datasets is therefore the use of open-source repositories.

AAISM emphasizes root cause analysis as the primary step when AI behavior deviates unexpectedly. RCA determines whether issues stem from:

• data drift

• model drift

• poisoned data

• missing features

• logic errors

• configuration changes

Retraining (D) may be required later, but only after RCA. Kill switches (A) are last-resort tools. Audits (B) help but are narrower than RCA.

An AI acceptable use policy (AUP) sets the organizational expectations and boundaries for how AI systems may be used by employees and third parties. AAISM guidance places emphasis on ethical and legal compliance standards as core elements of an AUP to govern responsible behavior, prevent misuse, and align with regulatory and organizational principles. While data requirements, collection/storage processes, and monitoring may be covered in adjacent standards and procedures (e.g., data management policies, SOPs, and operational runbooks), the AUP’s essential function is to codify permissible use anchored to ethics, legality, and organizational values.