Advanced in AI Governance (AAIG)

Last checked October 22, 2026 against the official ISACA exam page.

1. Question 1AI Risk Program Management

   Which activity starts an AI risk assessment?

   1. AChoosing the colour of the risk heat map that will be used in the board pack for each quarter's review of the programme
   2. BIdentifying the AI scenarios, the threats and vulnerabilities that could affect the system, and the assets involved
   3. CSelecting the vendor for the AI system before any risks have been identified for the use case by the risk team at all
   4. DCalculating the cost of the server hardware before the system's purpose and its users have been defined by the business
   Show answer and explanationHide answer

   Correct answer: B

   A risk assessment begins by identifying scenarios, threats, vulnerabilities and assets, which drives everything after. Choosing colours, vendors or hardware first puts the cart before the horse.

2. Question 2AI Risk Governance and Framework Integration

   Which role is accountable for an AI system's risk decisions in a well-governed organisation?

   1. AA named business owner with the authority and responsibility to accept, mitigate or escalate the system's risks
   2. BEvery employee who uses the AI tool, each acting as an independent judge of the system's risk on a personal basis
   3. CThe vendor that supplies the model, which holds responsibility for every risk decision the company makes about the system
   4. DThe data science team alone, which decides the risk outcomes without involvement from the business units that rely on it
   Show answer and explanationHide answer

   Correct answer: A

   Accountability for AI risk decisions sits with a named owner who can accept, mitigate or escalate. Shared use, vendor responsibility and team-only decisions leave no clear accountable party.

3. Question 3AI Life Cycle Risk Management

   Which control is applied during AI model development to reduce the risk of harmful outputs?

   1. AA decision to skip testing for the first version, so that the product reaches the market earlier than the rival products do
   2. BDocumented requirements, data quality checks, and testing for accuracy, bias and robustness before release
   3. CUsing the model's default output without any review, since the developers trust the design choices that were made in the model
   4. DPublishing the model without any documentation, so that competitors cannot easily copy the approach used in its development
   Show answer and explanationHide answer

   Correct answer: B

   Documented requirements, data checks and testing for accuracy, bias and robustness reduce harmful outputs before release. Skipping testing, unreviewed defaults and undocumented release each increase the risk.

4. Question 4AI Risk Program Management

   Which risk treatment strategy is used when the organisation stops the AI use case that creates the risk?

   1. ARisk transfer, which moves the financial effect of the risk to an insurer or a supplier under a contract signed with them
   2. BRisk acceptance, which keeps the activity and records that the residual risk has been accepted by the owner of the system
   3. CRisk avoidance, which removes the activity that creates the risk so that the risk no longer applies to the organisation
   4. DRisk mitigation, which adds controls while the activity continues to run exactly as it did before the assessment took place
   Show answer and explanationHide answer

   Correct answer: C

   Avoidance removes the activity that creates the risk. Acceptance keeps it, transfer shifts its financial effect and mitigation adds controls while the activity continues.

5. Question 5AI Risk Governance and Framework Integration

   What does an AI policy typically establish?

   1. AThe principles, roles, acceptable uses and controls that apply to AI across the organisation
   2. BThe exact algorithm to be used for each product, written in code so that developers can copy it directly into their projects
   3. CThe price list of AI services for each customer, which is updated by the sales team each quarter as the market changes
   4. DA list of employees' personal opinions about AI, collected each year for the human resources file on each member of staff
   Show answer and explanationHide answer

   Correct answer: A

   An AI policy sets principles, roles, acceptable uses and controls across the organisation. Algorithm code, price lists and opinion files are not policy content.