Isaca AAIR Practice Exam Questions

Isaca AAIR Sample Question Answers

Question # 1

A financial services organization is subject to regulatory examination on its AI risk management practices. The examiner identifies that the organization lacks documented evidence of: (1) AI risk appetite statements, (2) risk-based AI system classification, (3) AI incident response procedures, and (4) board oversight of AI risk. The examiner rates the overall AI risk management program as 'Unsatisfactory.' Which remediation should be prioritized FIRST?

A. Develop AI incident response procedures — these have the most direct operational impact.
B. Establish board oversight mechanisms and AI risk appetite — as these are the foundationalgovernance elements upon which all other AI risk management activities depend.
C. Implement AI system risk classification — this enables risk-based prioritization of all otheractivities.
D. Document existing AI controls to demonstrate maturity to the regulator.

Show Answer

Question # 2

An AI model used in production has a known vulnerability that could be exploited. A patch isavailable but requires a 4-hour maintenance window during business hours. The business unitrefuses to accept the downtime. The AI risk manager must decide. What is the MOST appropriateaction?

A. Accept the risk and continue operating the vulnerable system indefinitely.
B. Formally document the risk, escalate to the appropriate governance level for risk acceptancedecision, and define compensating controls for the interim period.
C. Implement the patch without business unit approval.
D. Wait until the next scheduled maintenance window, even if months away.

Show Answer

Question # 3

An organization's AI risk management program operates independently from its enterprise riskmanagement (ERM) framework. AI risks are not reflected in the enterprise risk register orescalated to the board through ERM reporting. What is the GREATEST risk of this siloedapproach?

A. The AI risk team may develop redundant risk management processes.
B. AI risks may not receive appropriate executive attention, resource allocation, or strategic risktreatment, leaving the organization exposed to material risks that the board is unaware of.
C. The AI program may miss technical risk factors identified by the enterprise risk team.
D. Compliance auditors may identify the disconnect and cite the organization.

Show Answer

Question # 4

What is the PRIMARY purpose of an AI Risk Treatment Plan? 

A. To document all AI systems in production.
B. To define specific actions, timelines, owners, and resources required to bring AI risks towithin acceptable levels.
C. To record historical AI incidents for regulatory reporting.
D. To establish AI performance benchmarks.

Show Answer

Question # 5

An organization wants to assess the effectiveness of its AI risk controls. Which approach provides the MOST comprehensive assessment? 

A. Self-assessment by the AI development team.
B. A combination of continuous monitoring metrics, periodic independent control testing, andexternal audit.
C. Annual compliance review by the legal department.
D. Vendor-provided performance reports.

Show Answer

Question # 6

An organization uses AI to generate personalized financial advice for retail investors. A postdeployment review discovers the AI system recommends higher-risk products to lower-incomecustomers. The organization's risk appetite explicitly prohibits AI systems that produce outcomescorrelated with customer income level in ways that disadvantage lower-income groups. What is theMOST serious concern?

A. The AI may be generating advice that does not align with individual investor risk profiles.
B. The AI system is operating outside the organization's stated risk appetite, potentiallyproducing discriminatory outcomes that violate regulatory obligations and ethical standards.
C. The AI may expose the organization to increased market risk.
D. Higher-risk product recommendations may generate more revenue.

Show Answer

Question # 7

An AI risk manager is reviewing vendor contracts for AI services. Which contractual provision is MOST important from an AI risk governance perspective? 

A. Pricing and volume discount terms.
B. Right to audit AI system performance, transparency requirements, data handling obligations,and incident notification obligations.
C. Vendor's marketing and branding rights.
D. Automatic contract renewal terms.

Show Answer

Question # 8

An organization's AI incident response team receives an alert that an AI model used for fraud detection has begun flagging 300% more transactions as fraudulent than its historical baseline, with no apparent change in actual fraud rates. Which is the MOST appropriate FIRST action?

A. Disable the fraud detection AI and revert to manual review.
B. Investigate whether the anomaly represents adversarial manipulation, data pipeline failure,or concept drift before taking operational action.
C. Notify all customers flagged by the AI as suspected fraudsters.
D. Engage the AI vendor to analyze the model and identify the cause

Show Answer

Question # 9

An AI risk manager identifies a control gap: the organization's AI systems are monitored for accuracy but not for fairness metrics. What type of risk does this gap MOST represent?

A. Operational risk — the system may become unreliable.
B. Compliance and ethical risk — discriminatory outputs may go undetected, creatingregulatory and reputational exposure.
C. Technology risk — the monitoring infrastructure is insufficient.
D. Strategic risk — AI investments may not achieve business objectives.

Show Answer

Question # 10

An organization is building a supply chain AI system that relies on data feeds from multiple external partners. What is the PRIMARY third-party supply chain risk for this AI system? 

A. Partners may charge higher fees for data access.
B. Compromised, manipulated, or low-quality external data feeds could degrade modelperformance or enable supply chain attacks.
C. Partners may not provide real-time data updates.
D. Integration complexity may increase development costs.

Show Answer