Isaca AAIR Exam Dumps

The shared responsibility model creates complexity in AI governance because control obligations are distributed between the organization and the vendor. The most critical risk is ambiguity about who owns specific controls and who makes decisions when issues arise.

Why D is Correct: The ISACA AAIR framework identifies documented assignment of control ownership as the cornerstone of shared responsibility governance. Without explicit documentation of which controls the organization owns versus which the vendor owns, and who has decision authority in each scenario, gaps and overlaps emerge that allow risks to go unmanaged. Named ownership ensures accountability persists across the shared boundary.

Why A is Wrong: Staff training on procedures is important but addresses operational readiness rather than the fundamental governance challenge of shared responsibility. Training supports a well-structured model but cannot substitute for defined ownership.

Why B is Wrong: Contractual liability clauses are legal protections that determine financial recourse after incidents. While essential, they do not prevent governance gaps from forming during normal operations.

Why C is Wrong: Data pathway testing is a security assurance activity addressing technical controls. It verifies control function but does not establish who owns those controls or what authority they have in the shared model.

Enterprise Risk Management (ERM) provides the strategic framework within which all organizational risks---including AI risks---should be managed. When AI risk management operates in isolation, it loses connection to enterprise strategy, risk appetite, and cross-functional control objectives.

Why A is Correct: The ISACA AAIR curriculum identifies strategic control alignment as a foundational ERM integration requirement. When AI risk operates independently, controls may conflict with or duplicate enterprise controls, risk appetite thresholds may differ, and AI risks cannot be aggregated or prioritized alongside other organizational risks. This misalignment creates blind spots at the enterprise level and undermines coherent strategic risk management.

Why B is Wrong: Inconsistent regulatory reporting is a compliance concern but is a downstream consequence of poor governance rather than the greatest organizational risk from separation. Regulatory gaps can often be patched operationally without full integration.

Why C is Wrong: Training cost increases represent a financial efficiency concern unrelated to the governance challenge of separate risk management functions. ROI impacts are not driven by organizational structure of risk management.

Why D is Wrong: Redundant documentation is an operational inefficiency, not a strategic risk. Duplicated records are wasteful but do not threaten organizational strategy or expose the enterprise to unmanaged risk.

Inconsistent data reliability from external feeds undermines model accuracy and creates auditability challenges. The solution requires both understanding where data comes from (provenance) and verifying its quality before it enters the model's learning process (stage gate reviews).

Why C is Correct: The ISACA AAIR data quality governance guidance identifies establishing data provenance and implementing stage gate quality reviews as the comprehensive approach to managing inconsistent external data reliability. Provenance tracking records the origin, processing history, and chain of custody of each data source, enabling quality issues to be traced to their source. Stage gate reviews enforce quality standards at defined points in the data pipeline, preventing unreliable data from advancing to model training.

Why A is Wrong: Weighting historical data over recent samples introduces temporal bias and prevents the model from reflecting current real-world conditions---the opposite of what most AI applications require. This trade-off may be appropriate in specific contexts but is not a general mitigation for inconsistent data reliability.

Why B is Wrong: Updating model versions improves model architecture and training processes but does not resolve the underlying external data quality problems. The model update cannot compensate for ingesting unreliable data.

Why D is Wrong: Reducing data source diversity sacrifices the breadth of information that diverse feeds provide, potentially reducing model performance and representativeness. The goal is to ensure consistent quality from diverse sources, not to reduce diversity.

Temperature is a hyperparameter in language model generation that controls output randomness. Lower temperatures make the model more deterministic---concentrating probability mass on the most likely tokens and producing more consistent, predictable outputs. Higher temperatures introduce more randomness and diversity.

Why B is Correct: According to ISACA AAIR model configuration guidance, lowering model temperature is primarily used to enhance consistency and accuracy of outputs. In production applications requiring reliable, reproducible responses---such as customer service, compliance reporting, or technical documentation---lower temperature ensures the model consistently generates the most appropriate response based on its learned knowledge, reducing variability and improving output quality.

Why A is Wrong: Temperature adjustment does not directly mitigate bias. Bias in AI models is a function of training data and model architecture, not output randomness. A biased model at low temperature will consistently generate biased outputs; lowering temperature may actually make bias more persistent by reducing variation.

Why C is Wrong: Diversifying ideas and recommendations is achieved by increasing temperature, not lowering it. Higher temperature is used for creative tasks where variety is valuable; lower temperature is used for tasks requiring precision and consistency.

Why D is Wrong: Model temperature has no direct relationship to computational energy consumption. Energy use is primarily driven by model size, computation requirements, and inference frequency---not the temperature parameter.

AI risk assessment must be calibrated to the potential consequences of AI-driven decisions. The criticality and impact of AI-driven decisions directly determine the magnitude of risk exposure and the appropriate level of risk treatment.

Why D is Correct: According to ISACA AAIR principles, the most fundamental risk assessment consideration is the nature and impact of decisions driven by the AI system. Systems making high-stakes decisions---affecting employment, credit, healthcare, or public safety---carry significantly greater risk than those supporting low-impact tasks. Understanding decision criticality frames all other risk assessment activities and drives proportionate control selection.

Why A is Wrong: Escalation protocols are governance process elements that should be designed after understanding the risk profile. They are outputs of risk assessment, not inputs to the primary assessment consideration.

Why B is Wrong: Prior automation levels provide contextual background but do not determine the risk profile of the new AI system. The relevant risk driver is forward-looking, not historical.

Why C is Wrong: Internal expertise levels affect assessment capability but represent an organizational constraint rather than the primary risk consideration. The risk lies in the system's potential impact, not in who assesses it.