Isaca ISACA-AAIA - Questions & Answers

The confusion matrix is a key performance evaluation tool in machine learning and AI auditing. According to the AAIATM Study Guide, a confusion matrix presents detailed information about actual versus predicted classifications, allowing auditors to assess accuracy, precision, recall, and F1 scores.

"A confusion matrix reveals not just how often predictions are correct, but also the types of errors being made--false positives and false negatives--thereby providing a clear view of the model's predictive reliability."

Adversarial testing evaluates robustness, group analysis identifies bias across subgroups, and latency testing examines performance speed--not predictive accuracy. Thus, D is the most relevant for ensuring correct predictions.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Operations and
Performance," Subsection: "Model Evaluation Metrics"

If the combined size of the training, validation, and testing sets exceeds the original data size, it suggests that records may have been reused across sets. This can lead to data leakage, where the model has access to test or validation information during training, resulting in overly optimistic performance metrics.

"Data leakage invalidates model evaluation because it introduces unintended data overlap. Auditors must ensure that the training, validation, and test sets are strictly partitioned."

Options A, C, and D refer to process order or quantity, but only B addresses the root issue of compromised model integrity due to overlapping data.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Fundamentals and
Technologies," Subsection: "Data Partitioning and Leakage Risks"

Generative AI systems, particularly those based on transformer models, produce outputs using probabilistic computations. As a result, even when given the same input data, these models may generate different outputs depending on sampling strategies (e.g., temperature, top-k sampling).

"Generative AI operates probabilistically, meaning that outputs can vary with each run based on stochastic sampling techniques. This variability is expected and must be accounted for in risk-sensitive environments like finance."

While A and B refer to limitations and architecture, and D is unrelated to logic, C directly explains the output inconsistency.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Fundamentals and
Technologies," Subsection: "Stochastic Behavior in Generative Models"

AI-related incidents often differ significantly from traditional IT incidents due to their dependence on data, model behavior, and algorithm performance. According to the AAIATM Study Guide, incident management programs must include capabilities specifically tailored to AI, such as detecting and mitigating model drift and safeguarding against data poisoning or integrity attacks.

"AI incident response frameworks must account for issues unique to machine learning, including model drift, adversarial inputs, and data integrity breaches. An effective program incorporates detection, response, and recovery mechanisms for these AI-specific threats."

While options A and B contribute to improving incident response over time, and option D suggests best-practice alignment, only
option C directly addresses active response capabilities for high-risk, real-time AI vulnerabilities.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk
Management," Subsection: "Incident and Risk Management in AI Contexts"

Transparency in AI, especially in regulated sectors like finance, is best achieved by using explainability tools that interpret the internal workings and outputs of complex ML models. The AAIATM Study Guide highlights model explainability as essential for both auditors and regulators to understand why certain decisions are made.

"Explainability tools allow auditors to trace predictions back to input features, helping verify fairness, logic, and compliance. These tools support transparency and trustworthiness in black-box models."

While documentation (A) and reporting (C) are part of governance, D directly supports decision-level clarity.
Dashboards (B) show results, not rationale.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI in Audit Processes,"
Subsection: "Model Explainability and Regulatory Assurance"

To assess compliance with intellectual property (IP) and data rights, the IS auditor must review documented data usage agreements that specify ownership, licensing, consent, and limitations of use. The AAIATM Study Guide underscores the importance of verifying that the data used to train or feed AI models is obtained and utilized within legal and contractual boundaries.

"Auditors must review data usage agreements to validate whether the organization has appropriate rights to use, distribute, or transform data inputs, especially where third-party or sensitive data is involved."

While open-source usage (C) is a concern, only B provides legal clarity. Metrics (A) and logs (D) reflect
performance--not legal compliance.
References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal
Considerations in AI," Subsection: "Data Rights, Licensing, and Intellectual Property"

Clustering, especially in sensitive domains like healthcare, can inadvertently expose confidential patient data if the resulting groups are too specific or reveal underlying health conditions. The AAIATM Study Guide warns that clustering can increase privacy risks when small, homogenous groups are formed that effectively re-identify individuals or reveal sensitive traits.

"Clustering results must be carefully reviewed to prevent indirect re-identification or unintended exposure of sensitive traits. Ethical handling of aggregated patient data is essential to protect individual privacy."

While A and B involve general concerns, and C focuses on performance, D directly addresses the most significant privacy threat: exposure through cluster outputs.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal
Considerations in AI," Subsection: "Data Anonymization and Re-identification Risks"

Problem framing (option D) is the process of clearly defining the purpose, scope, and desired outcomes of an AI system before it is built or deployed. According to the ISACA AAIATM Study Guide, "problem framing is the critical first step that aligns model development and subsequent behaviors with the strategic and operational objectives of the organization." If the AI problem is not framed in accordance with organizational goals, even a technically successful AI model could generate outputs that do not support the organization's mission or priorities.

Algorithm debugging, data transformation, and model training are all important phases but rely on the initial problem framing to ensure their efforts are correctly directed.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Project Lifecycle
Alignment"

The AAIATM Study Guide defines the core purpose of machine learning as the ability to enable systems to learn from data and make decisions or perform tasks that typically require human cognitive functions. ML allows AI systems to identify patterns, learn from historical data, and automate complex decision-making.

"Machine learning empowers systems to simulate aspects of human intelligence, including pattern recognition, language understanding, and decision-making. It forms the backbone of many AI applications designed to replace or augment human tasks."

While visual analysis (A) and statistical inference (D) are functions of ML, they are subsets--not primary goals. Explainability (B) is important but is not a core ML function. Thus, C best represents the primary objective.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Fundamentals and
Technologies," Subsection: "Machine Learning Basics and Objectives"

In the case of a potential data exposure through AI model outputs, the first and most responsible action from an auditing and risk standpoint is to halt further risk propagation. According to the AAIATM Study Guide, immediate containment is vital, especially when regulatory and reputational risks are high.

"Upon detection of a data breach risk, AI models should be immediately disabled from public or partner use, and all relevant parties should be notified as part of a responsible disclosure and containment strategy."

While options A and D are longer-term remediation steps and B is investigative, none of them provide the urgent containment that is best practice in such a breach context.

References:
ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal
Considerations in AI," Subsection: "AI Data Breach and Disclosure Management"