Advanced in AI Risk (AAIR)

Last checked October 22, 2026 against the official ISACA exam page.

1. Question 1AI Risk Program Management

   An organisation has many AI systems but no central record of them. Which first step improves control most?

   1. ACreating an inventory of AI systems, including owners, purpose, data sources and risk ratings
   2. BBuying a new AI platform before knowing which AI systems already exist in the business units
   3. CAsking each business unit to deploy its own AI tools without any reporting of them back to the centre
   4. DDeleting all existing AI systems until they can be properly documented in a register by the team
   Show answer and explanationHide answer

   Correct answer: A

   An inventory with owners, purpose, data sources and risk ratings creates the baseline needed to manage AI risk. Buying a platform, unreported local deployments and deleting systems all move away from control.

2. Question 2AI Risk Governance and Framework Integration

   An organisation plans to deploy a generative AI assistant to its customers. Which governance step should come first?

   1. ATraining the model on all available customer data before any governance review of the use case is held
   2. BLaunching the assistant to a small group of customers and gathering risk findings from their use of it later
   3. CAsking the vendor to confirm the assistant's accuracy in a single marketing statement for the board pack
   4. DDefining the AI risk appetite and approving an accountable owner for the use case before deployment
   Show answer and explanationHide answer

   Correct answer: D

   Setting risk appetite and naming an accountable owner before deployment establishes the decision rights and risk thresholds the use case must meet. Launching first, relying on a marketing statement and training on data before review all bypass governance.

3. Question 3AI Lifecycle Risk Management

   Which lifecycle stage is most important for identifying bias in training data before a model is built?

   1. APost-deployment monitoring, which begins once the model is serving live requests to customers in production
   2. BModel retirement planning, which sets the date when the model is taken out of service in the future
   3. CData preparation and data quality review, including representativeness and label checks on the training data
   4. DModel naming and versioning, which assigns identifiers to each model build recorded in the model registry
   Show answer and explanationHide answer

   Correct answer: C

   Data preparation and quality review, including representativeness and label checks, is where training-data bias is found and addressed before the model is built. Monitoring, retirement and naming all come later or do not examine the data.

4. Question 4AI Risk Program Management

   Which metric best shows whether AI risks are being controlled over time?

   1. AThe number of AI pilots launched during the year, regardless of their risk level or results achieved
   2. BKey risk indicators for AI systems, such as drift, incident counts and overdue risk treatments
   3. CThe total size of the AI models in gigabytes that are stored across the company's cloud accounts
   4. DThe number of AI training courses attended by staff, without any measure of what the training achieved
   Show answer and explanationHide answer

   Correct answer: B

   Key risk indicators such as drift, incidents and overdue treatments show trends in AI risk control. Pilot counts, storage size and course attendance measure activity rather than risk control.

5. Question 5AI Risk Governance and Framework Integration

   Which voluntary framework structures AI risk management around the functions Govern, Map, Measure and Manage?

   1. AISO 9001, which provides a quality management system for manufacturing and service organisations generally
   2. BThe ITIL framework, which provides good practice guidance for IT service management and service delivery
   3. CThe PCI DSS standard, which applies to organisations that store, process or transmit payment card data
   4. DThe NIST AI Risk Management Framework, which structures AI risk management around four core functions
   Show answer and explanationHide answer

   Correct answer: D

   The NIST AI Risk Management Framework organises risk management around Govern, Map, Measure and Manage. ISO 9001, PCI DSS and ITIL address quality, payment card security and service management respectively.