Isaca Updated AAIA Exam Questions and Answers by edwin

AAIA emphasizes that transparency and interpretability require clear explanations of how the model functions, what features drive predictions, and how decisions are derived.

Creating documentation and visual interpretability tools (option C) provides:

Feature importance breakdowns

Decision pathway visualizations

Examples of prediction reasoning

Plain-language explanations for nontechnical stakeholders

Evidence that can be validated during audits

While training stakeholders (A) is helpful, it does not make the model itself clearer.

A rule-based system (B) supports validation, not interpretability.

Simplifying the model (D) may affect accuracy and is not necessary if documentation and interpretability tooling solve the issue.

Therefore, the best approach is to improve interpretability through clear documentation and visualization.

Privacy regulations like GDPR and CCPA emphasize the principle of " Data Minimization " —collecting only the data that is strictly necessary for the intended purpose. In an AI context, organizations often feel tempted to collect as much data as possible to improve accuracy (Option A), but this increases privacy risk and legal exposure. According to ISACA, implementing data minimization is the most effective practice for ensuring regulatory compliance. It reduces the " attack surface " in the event of a breach and ensures that the organization is not holding onto sensitive PII that it cannot justify. Indefinite retention (Option D) is a direct violation of most modern privacy laws.

" Agentic AI " goes beyond simple detection; it can take actions (like shutting down a server) autonomously. The greatest risk is that the AI might misinterpret a legitimate but unusual business activity as a threat and trigger a " kill switch, " causing massive, unplanned downtime. This is a significant operational and availability risk. Auditors must ensure there are " guardrails " or a " human-in-the-loop " for high-impact actions. While reduced intervention (Option B) is a benefit, it is also the source of the risk that the auditor must mitigate through governance and control evaluation.

For organization-wide adoption of AI, the MOST important change management consideration is that the organization has suitable data governance and infrastructure readiness (D). Without robust data governance, AI systems may rely on poor-quality, noncompliant, or insecure data; without appropriate infrastructure (compute, storage, monitoring, integration), implementations will be fragile, unreliable, and risky. AAIA stresses that AI readiness includes governance structures, data stewardship, and technical foundations.

Senior leadership involvement (A) is critical for sponsorship and culture, but even strong leadership cannot compensate for fundamentally inadequate data governance and infrastructure. Option B (shorter training cycles) focuses on user adoption but not core risk and control issues. Option C (phased implementation and stage gates) is good project discipline, but still depends on the underlying readiness. Therefore, from an AI risk and governance perspective, ensuring data governance and infrastructure readiness is the primary prerequisite for successful, safe change management in AI adoption.