Advanced in AI Audit (AAIA)

Last checked October 22, 2026 against the official ISACA exam page.

1. Question 1AI Operations

   An AI model's accuracy has declined over the past three months, but the model has not been changed. What cause should an auditor investigate first?

   1. AData drift, where production data no longer matches the data the model was trained on
   2. BA change in the colour scheme of the application, which affects how users read the outputs
   3. CAn increase in the number of user logins, which slows the model's response time each day
   4. DA change in the server's time zone, which shifts the timestamps in the model's logs
   Show answer and explanationHide answer

   Correct answer: B

   Data drift, where production inputs change from the training data, is a common cause of declining accuracy without model changes. Interface colours, login counts and time zones do not change model accuracy.

2. Question 2AI Governance and Risk

   An internal audit team is reviewing a bank's new credit-scoring model. Which artefact should the auditor check first to confirm accountability for the model?

   1. AThe model's performance dashboard, which shows accuracy by month for the last year
   2. BA documented model owner and approval record, showing who accepted the model's risk
   3. CThe vendor's marketing brochure, which describes the model's intended business benefits
   4. DThe cloud region where the model is hosted, which determines the data residency rules
   Show answer and explanationHide answer

   Correct answer: B

   A documented owner and an approval record show who is accountable for the model's risk, which is the first governance question. Dashboards, brochures and hosting location are evidence about the model, not about accountability.

3. Question 3AI Auditing Tools and Techniques

   Which tool best supports an auditor's analysis of a complete population of AI system transactions?

   1. AA walk-through of one transaction, observed by the auditor while the system processes it
   2. BManual sampling of ten transactions chosen at random from the population, with no analysis
   3. CComputer-assisted audit techniques (CAATs) and data analytics run over the full population
   4. DReading the policy document only, without access to the transaction data or the system logs
   Show answer and explanationHide answer

   Correct answer: C

   CAATs and data analytics run over the full population, which lets the auditor test every record for exceptions and patterns. Ten random samples, a single walk-through and policy reading alone cannot test the full population.

4. Question 4AI Operations

   Which control best protects an AI system's training data from unauthorised change?

   1. AA shared folder that all data scientists can edit at any time without any record of changes
   2. BA spreadsheet of data changes, kept on one analyst's laptop and updated when they remember
   3. CVersioned datasets with access controls, change approval and an audit trail of each modification
   4. DStoring the training data in a public repository, so that any change is visible to everyone
   Show answer and explanationHide answer

   Correct answer: C

   Versioned datasets with access controls, change approval and audit trails protect data integrity and make changes traceable. Shared editable folders, laptop spreadsheets and public repositories all allow unrecorded or unauthorised change.

5. Question 5AI Governance and Risk

   An organisation wants a structured framework to manage risks from its AI systems across their life cycle. Which framework is designed for this purpose?

   1. AA general-purpose financial controls framework that covers only the accounting processes
   2. BThe NIST AI Risk Management Framework, organised around govern, map, measure and manage
   3. CAn accessibility standard for web interfaces, which governs how content is presented to users
   4. DA network hardening guide, which describes configuration baselines for routers and switches
   Show answer and explanationHide answer

   Correct answer: B

   The NIST AI Risk Management Framework organises AI risk management around govern, map, measure and manage across the life cycle. Financial controls, accessibility standards and hardening guides do not address AI-specific risk.