Pass the Isaca Advanced in AI Audit AAIA Questions and answers with ExamsMirror

Audit trails in AI systems serve to document the inputs, processes, and outputs of AI decisions, allowing stakeholders and auditors to trace how decisions were made. The AAIA™ Study Guide identifies transparency and traceability as the core functions of an AI audit trail.

“Maintaining audit logs is critical to explainability and accountability. It ensures that decisions made by AI systems can be reconstructed and assessed for accuracy, ethics, and legality.”

Although compliance (D) is an outcome and fairness (B) a goal, only A captures the foundational purpose of audit trails in AI systems.

Only reviewing an ML model’s performance one time prior to migrating to production (option C) is of greatest concern. The AAIA™ Study Guide emphasizes that “AI and ML models require continuous monitoring and periodic performance reviews in production to detect issues such as data drift, model degradation, or evolving risk factors.” A single pre-production review fails to capture these changes and risks, potentially resulting in undetected failures or compliance issues.

Periodic (including annual) and event-driven reviews are necessary to ensure ongoing model reliability.

Transparency in AI, especially in regulated sectors like finance, is best achieved by using explainability tools that interpret the internal workings and outputs of complex ML models. The AAIA™ Study Guide highlights model explainability as essential for both auditors and regulators to understand why certain decisions are made.

“Explainability tools allow auditors to trace predictions back to input features, helping verify fairness, logic, and compliance. These tools support transparency and trustworthiness in black-box models.”

While documentation (A) and reporting (C) are part of governance, D directly supports decision-level clarity. Dashboards (B) show results, not rationale.

Accountability for data management (option D) is the most crucial consideration. The AAIA™ Study Guide emphasizes that “clear roles, responsibilities, and ownership for data management activities are central to trustworthy AI systems, as they ensure compliance, traceability, and the consistent application of policies and controls.”

Retention, portability, and data training practices are important, but accountability is foundational for the enforcement and monitoring of all other governance practices.

K-means clustering is a widely used unsupervised learning algorithm. However, it is sensitive to outliers and assumes that features are on the same scale, which can distort clustering results if not properly normalized. According to the AAIA™ Study Guide, this sensitivity can impact model reliability and the meaningfulness of clusters.

“Auditors should assess whether proper data preprocessing (e.g., normalization, outlier removal) was applied in clustering models. K-means assumes Euclidean distances, making it prone to errors when features differ in scale or contain outliers.”

Therefore, C correctly identifies the key risk.

Representativeness ensures that the training data reflects the full spectrum of conditions the AI model will encounter in production. According to the AAIA™ Study Guide, models trained on non-representative data are prone to bias, poor generalization, and underperformance in real-world applications.

“Ensuring that training data accurately represents the operational environment is critical for model reliability, fairness, and scalability. Without it, the model may perform well in testing but fail in actual usage.”

Timeliness (A) and understandability (D) support performance and usability, but they are secondary to ensuring data coverage. Predictability (B) may not be desirable in dynamic modeling.

Using postal codes as a primary factor in credit scoring raises concerns of geographic and socioeconomic bias. Postal codes can serve as proxies for race, ethnicity, or income level—potentially violating fair lending laws and ethical guidelines.

“Auditors should flag models that rely on proxies for protected attributes. Postal codes are high-risk features that may inadvertently lead to redlining or other discriminatory practices.”

A, B, and C are more justifiable under fair lending guidelines. Thus, D presents the highest concern.

Allowing AI to autonomously generate code without human review introduces significant risks, including security vulnerabilities, logic errors, and noncompliance with organizational development standards. The AAIA™ Study Guide strongly advocates for human-in-the-loop oversight, particularly in automated development contexts.

“AI-assisted development must include manual code reviews to ensure functionality, compliance, and security. Autonomous code generation without validation increases the risk of introducing undetected flaws.”

While A, B, and C involve operational risks or inefficiencies, only D constitutes a direct breach of secure development life cycle principles.

Overfitting occurs when a model performs very well on training data but poorly on unseen data, indicating that the model has learned patterns specific to the training set rather than generalizing effectively. The AAIA™ Study Guide identifies overfitting as a common problem that impacts model reliability.

“Overfitting limits the model's applicability to real-world scenarios. It reflects excessive tailoring to the training data and poor performance on new, diverse inputs.”

Underfitting (A) would result in poor performance on both training and test data. Generalization (C) is the desired state, and bias (D) is a separate issue. Therefore, B is correct.

Ensuring that input data is appropriate and relevant (option D) is the most critical factor in preventing hallucinations—where generative models produce fabricated or misleading outputs. The AAIA™ Study Guide notes, “Generative models are highly sensitive to input data; inaccurate, irrelevant, or inappropriate inputs increase the likelihood of nonsensical or incorrect outputs.”

While bias detection, data quality audits, and anonymization are important, ensuring the relevance and suitability of input data is foundational for reliable generative AI performance.