Isaca AAIR Dumps

Question # 1

A financial services organization is subject to regulatory examination on its AI risk management practices. The examiner identifies that the organization lacks documented evidence of: (1) AI risk appetite statements, (2) risk-based AI system classification, (3) AI incident response procedures, and (4) board oversight of AI risk. The examiner rates the overall AI risk management program as 'Unsatisfactory.' Which remediation should be prioritized FIRST?

A. Develop AI incident response procedures — these have the most direct operational impact.
B. Establish board oversight mechanisms and AI risk appetite — as these are the foundationalgovernance elements upon which all other AI risk management activities depend.
C. Implement AI system risk classification — this enables risk-based prioritization of all otheractivities.
D. Document existing AI controls to demonstrate maturity to the regulator.

Show Answer

Question # 2

An AI model used in production has a known vulnerability that could be exploited. A patch isavailable but requires a 4-hour maintenance window during business hours. The business unitrefuses to accept the downtime. The AI risk manager must decide. What is the MOST appropriateaction?

A. Accept the risk and continue operating the vulnerable system indefinitely.
B. Formally document the risk, escalate to the appropriate governance level for risk acceptancedecision, and define compensating controls for the interim period.
C. Implement the patch without business unit approval.
D. Wait until the next scheduled maintenance window, even if months away.

Show Answer

Question # 3

An organization's AI risk management program operates independently from its enterprise riskmanagement (ERM) framework. AI risks are not reflected in the enterprise risk register orescalated to the board through ERM reporting. What is the GREATEST risk of this siloedapproach?

A. The AI risk team may develop redundant risk management processes.
B. AI risks may not receive appropriate executive attention, resource allocation, or strategic risktreatment, leaving the organization exposed to material risks that the board is unaware of.
C. The AI program may miss technical risk factors identified by the enterprise risk team.
D. Compliance auditors may identify the disconnect and cite the organization.

Show Answer

Question # 4

What is the PRIMARY purpose of an AI Risk Treatment Plan? 

A. To document all AI systems in production.
B. To define specific actions, timelines, owners, and resources required to bring AI risks towithin acceptable levels.
C. To record historical AI incidents for regulatory reporting.
D. To establish AI performance benchmarks.

Show Answer

Question # 5

An organization wants to assess the effectiveness of its AI risk controls. Which approach provides the MOST comprehensive assessment? 

A. Self-assessment by the AI development team.
B. A combination of continuous monitoring metrics, periodic independent control testing, andexternal audit.
C. Annual compliance review by the legal department.
D. Vendor-provided performance reports.

Show Answer

Question # 6

An organization uses AI to generate personalized financial advice for retail investors. A postdeployment review discovers the AI system recommends higher-risk products to lower-incomecustomers. The organization's risk appetite explicitly prohibits AI systems that produce outcomescorrelated with customer income level in ways that disadvantage lower-income groups. What is theMOST serious concern?

A. The AI may be generating advice that does not align with individual investor risk profiles.
B. The AI system is operating outside the organization's stated risk appetite, potentiallyproducing discriminatory outcomes that violate regulatory obligations and ethical standards.
C. The AI may expose the organization to increased market risk.
D. Higher-risk product recommendations may generate more revenue.

Show Answer

Question # 7

An AI risk manager is reviewing vendor contracts for AI services. Which contractual provision is MOST important from an AI risk governance perspective? 

A. Pricing and volume discount terms.
B. Right to audit AI system performance, transparency requirements, data handling obligations,and incident notification obligations.
C. Vendor's marketing and branding rights.
D. Automatic contract renewal terms.

Show Answer

Question # 8

An organization's AI incident response team receives an alert that an AI model used for fraud detection has begun flagging 300% more transactions as fraudulent than its historical baseline, with no apparent change in actual fraud rates. Which is the MOST appropriate FIRST action?

A. Disable the fraud detection AI and revert to manual review.
B. Investigate whether the anomaly represents adversarial manipulation, data pipeline failure,or concept drift before taking operational action.
C. Notify all customers flagged by the AI as suspected fraudsters.
D. Engage the AI vendor to analyze the model and identify the cause

Show Answer

Question # 9

An AI risk manager identifies a control gap: the organization's AI systems are monitored for accuracy but not for fairness metrics. What type of risk does this gap MOST represent?

A. Operational risk — the system may become unreliable.
B. Compliance and ethical risk — discriminatory outputs may go undetected, creatingregulatory and reputational exposure.
C. Technology risk — the monitoring infrastructure is insufficient.
D. Strategic risk — AI investments may not achieve business objectives.

Show Answer

Question # 10

An organization is building a supply chain AI system that relies on data feeds from multiple external partners. What is the PRIMARY third-party supply chain risk for this AI system? 

A. Partners may charge higher fees for data access.
B. Compromised, manipulated, or low-quality external data feeds could degrade modelperformance or enable supply chain attacks.
C. Partners may not provide real-time data updates.
D. Integration complexity may increase development costs.

Show Answer

Question # 11

An organization discovers that its AI vendor has a subcontractor processing training data in a jurisdiction with inadequate data protection laws. This arrangement was not disclosed during vendor due diligence. The organization is subject to GDPR. What is the GREATEST risk and MOST appropriate response? 

A. Risk: vendor reputation. Response: Notify customers of the data processing arrangements.
B. Risk: GDPR violation through unauthorized international transfer of personal data.Response: Immediately assess transfer compliance, require the vendor to remediate, andconsider contract suspension until compliant.
C. Risk: Data quality degradation. Response: Require the subcontractor to demonstrate datahandling certifications.
D. Risk: Competitive intelligence leakage. Response: Conduct a data classification review.

Show Answer

Question # 12

Which of the following BEST describes 'risk transfer' as an AI risk treatment option? 

A. Moving the AI system to a different business unit to reassign accountability.
B. Shifting financial consequences of an AI risk to a third party, such as through insurance orcontractual indemnification.
C. Reducing AI risk exposure through the implementation of preventive controls.
D. Eliminating an AI system to remove the associated risk entirely.

Show Answer

Question # 13

An organization is developing its AI risk reporting framework for the board. What information is MOST important to include in board-level AI risk reporting? 

A. Technical details of AI model architectures and training parameters.
B. AI risk exposure levels, trends, significant incidents, risk appetite compliance status, andrecommended governance actions.
C. Detailed audit logs of all AI model outputs.
D. Vendor SLA compliance statistics.

Show Answer

Question # 14

An organization's AI system for automated trading generates anomalous trades during a marketvolatility event, causing significant financial loss. Post-incident analysis reveals the model was nottested against extreme market conditions. Which control would have been MOST effective inpreventing this incident?

A. Real-time monitoring with automatic trading halt triggers when model outputs exceeddefined thresholds.
B. Stress testing the AI model against historical market crisis scenarios before deployment.
C. Implementing a 24-hour delay on AI-generated trades for human review.
D. Diversifying AI trading models across multiple vendors.

Show Answer

Question # 15

An organization implements an AI system that monitors employee communications for policyviolations. An employee files a complaint alleging the monitoring is invasive and not disclosed inthe employment agreement. What is the PRIMARY governance risk?

A. The AI system may produce inaccurate monitoring results.
B. The organization may have failed to meet transparency, consent, and privacy obligationsregarding employee surveillance.
C. The employee may share confidential information externally.
D. The AI monitoring system may be susceptible to adversarial manipulation.

Show Answer

Question # 16

An organization's AI vendor provides a service level agreement (SLA) promising 99.9% uptime foran AI-powered customer service system. During an incident, the system is down for 12 hours,causing significant customer complaints and lost revenue. What risk management lesson does thisincident MOST highlight?

A. SLA-based contractual guarantees are insufficient substitutes for internal AI resiliencecontrols and business continuity planning.
B. The organization should negotiate a higher SLA of 99.99% with the vendor.
C. The vendor should be replaced with a more reliable provider.
D. AI systems should never be used for customer-facing services.

Show Answer

Question # 17

An organization's AI governance committee reviews a report showing that 40% of theorganization's AI systems have no defined risk owner, 25% have not been assessed in over twoyears, and 15% have open high-severity risks with no treatment plans. The committee must decideon priority actions. What should be the FIRST priority?

A. Conduct comprehensive new risk assessments for all systems.
B. Assign risk owners to the 40% of systems lacking ownership — because withoutaccountability, no other governance action can be effectively executed.
C. Develop treatment plans for the 15% of systems with open high-severity risks.
D. Report the governance gaps to the board and request additional budget.

Show Answer

Question # 18

Which of the following BEST describes the purpose of AI red-team testing?

A. To assess the financial return on investment of AI systems.
B. To simulate adversarial attacks and misuse scenarios to identify vulnerabilities in AI systemsbefore they can be exploited.
C. To review AI system code quality and development standards.
D. To validate AI model accuracy on production data.

Show Answer

Question # 19

An AI risk manager conducts a Business Impact Analysis (BIA) for an AI-powered supply chain optimization system. The BIA should prioritize which factor FIRST? 

A. Cost of retraining the AI model after failure.
B. Maximum tolerable downtime (MTD) and recovery time objectives (RTO) based on businessimpact of the system being unavailable.
C. Technical architecture of the AI system for backup planning.
D. Number of users who depend on the system daily.

Show Answer

Question # 20

During an AI risk assessment, a risk manager uses a quantitative approach and calculates the Annual Loss Expectancy (ALE) for an AI system failure scenario as $2.4M. The cost of implementing a control to reduce this risk is $800K annually. However, the control would only reduce the probability of loss by 40%. Should the control be implemented based purely on quantitative analysis?

A. Yes — any reduction in risk justifies control implementation.
B. No — the control cost ($800K) exceeds the risk reduction benefit (40% of $2.4M = $960Knet risk reduction). Wait — the benefit is $960K which exceeds $800K. Yes, implement.
C. No — quantitative analysis alone is insufficient for AI risk decisions without qualitativefactors.
D. Yes — but only if the remaining 60% residual risk is within the risk appetite.

Show Answer