AAIR Exam Dumps - Isaca AI Risk Questions and Answers

When an AI model ' s accuracy declines despite stable input distributions, the most likely cause is concept drift—where the underlying relationship between inputs and the target variable changes over time. In credit scoring, this may occur when economic conditions, consumer behavior, or risk patterns shift in ways not captured in the original training data.

Why C is Correct: The ISACA AAIR model drift guidance identifies concept drift as the greatest risk in this scenario because it means the model is making credit decisions based on relationships that no longer hold in the current environment. Faulty credit decisions can lead to incorrect denials of creditworthy applicants, incorrect approvals of high-risk applicants, regulatory violations, financial losses, and harm to individuals—all high-severity consequences for a credit-scoring application.

Why A is Wrong: Technical delays in credit score updates are an operational performance concern. Delays create business friction but do not cause the fundamental accuracy problem described in the scenario.

Why B is Wrong: Underfitting from shortened training cycles is a model development quality issue. The scenario specifies stable input distributions and declining accuracy—characteristic of drift, not underfitting, which would manifest differently.

Why D is Wrong: Increased retraining costs represent a financial efficiency concern. While budgetary impacts are real, they are secondary to the risk of faulty credit decisions affecting individuals and regulatory compliance.

Organizational governance frameworks provide the structures, processes, and oversight mechanisms through which enterprises manage their activities and risks. Aligning AI risk management with these frameworks ensures AI activities receive the same level of strategic oversight as other organizational functions.

Why C is Correct: The ISACA AAIR curriculum identifies enterprise-level oversight and strategic alignment as the primary benefit of governance framework integration. When AI risk management operates within established governance structures, AI decisions are subject to the same approval authorities, risk escalation pathways, and strategic alignment checks that govern all major organizational decisions. This produces coherent, enterprise-aware AI governance.

Why A is Wrong: Role development and responsibility clarification are governance activities that may result from alignment, but they represent structural outputs rather than the primary benefit. The benefit is the oversight quality, not the organizational structure itself.

Why B is Wrong: Expediting compliance approvals is an efficiency benefit that may arise from better-organized governance. However, speed of approval is not the primary purpose of framework alignment—the purpose is quality and consistency of oversight.

Why D is Wrong: Standardizing acquisition processes is a procurement function benefit. While governance alignment may improve procurement consistency, standardization is a narrow operational benefit compared to the strategic oversight value of full governance integration.

Risk treatment decisions are driven by two factors: whether the residual risk falls within or outside tolerance, and the criticality of the affected function. When both conditions—risk within tolerance AND non-critical function impact—are met, formal risk acceptance is the appropriate and proportionate treatment.

Why A is Correct: According to ISACA AAIR risk treatment guidance, documented formal risk acceptance is the appropriate response when residual risk is within defined tolerance for non-critical functions. Risk acceptance acknowledges the identified exposure, documents the organization ' s conscious decision to accept it, and establishes accountability for that decision. This proportionate response avoids over-investing in controls for risk that the organization has determined is acceptable.

Why B is Wrong: Recommending increases to tolerance thresholds is a governance manipulation rather than a risk treatment. Adjusting thresholds upward to accommodate risk does not address the risk; it merely reclassifies it as acceptable. This approach undermines risk governance integrity.

Why C is Wrong: Enhancing monitoring to detect deviations represents additional control investment that may be disproportionate for risk that is already within tolerance affecting non-critical functions. Enhanced monitoring is more appropriate when risk is near the tolerance boundary or when trends indicate potential future breach.

Why D is Wrong: Periodic vulnerability scanning is a security assurance activity that identifies technical weaknesses. It represents an ongoing control measure rather than the appropriate risk treatment decision for a residual risk that is already within tolerance.

Within the ISACA Advanced in AI Risk framework, life-cycle controls should protect data quality, model design, testing, validation, monitoring, change management, and secure retirement of AI systems. Training-data collection should prioritize representative and relevant samples that reflect the intended population and use case. More data is not automatically better, normalization occurs later, and public datasets can be used if their quality, provenance, and suitability are properly assessed. This makes option A, Ensure input samples are representative and relevant, the strongest answer. The other choices describe narrower technical, operational, performance, or administrative considerations and do not address the primary risk-management objective in the scenario as directly. A risk practitioner should select the response that most effectively reduces the stated exposure while preserving appropriate oversight, traceability, and alignment with organizational risk tolerance and business requirements.