AAIR Flashcards — Free ISACA Advanced in AI Risk (AAIR) (AAIR) Study Cards

During the data ingestion and preprocessing stage.

Data quality must be validated prior to training to ensure model reliability.

Identifying and documenting the context and intended use

Identifying and documenting the context and intended use is the foundation of mapping AI risks to an enterprise framework.

Demographic parity ratio in training data samples

Monitoring training data distribution is a leading indicator, whereas output monitoring is a lagging indicator.

Operational risk of deploying a poorly performing model to production.

Shadow deployments allow real-world data validation without exposing end-users to potential model failures.

The risk of model inversion attacks on the inference endpoint.

Online inference endpoints are exposed to the public/network, creating surface area for adversarial attacks.

Automated performance validation against a hold-out test set with defined threshold gates.

Automated validation of performance metrics against a 'golden dataset' ensures the model meets the required threshold.

The 'automation bias' or 'rubber stamping' of decisions by human reviewers.

Human fatigue and cognitive bias can lead to poor oversight, potentially creating a false sense of security.

To enable effective decision-making regarding AI adoption and risk management.

Directors must understand AI risks and benefits to provide informed oversight and define the organization's risk appetite.

Implement output guardrails and moderation layers.

Guardrails are technical controls placed on top of models to intercept and filter output, which is a vital part of risk governance.

Identifying and documenting the context and intended use

Identifying and documenting the context and intended use is the foundation of mapping AI risks to an enterprise framework.

Include mandatory audit rights, model validation requirements, and risk-sharing clauses in the vendor contract.

Third-party risk management must include audit rights and clear accountability for the vendor's models.

The AI Risk Appetite Statement.

The AI Risk Appetite Statement is the document approved by the Board that defines the risk tolerance for AI activities.

It bypasses established AI risk governance and compliance controls.

Shadow AI refers to AI tools deployed without the knowledge or oversight of the governance team, creating invisible, unmanaged risks.

It ensures consistent risk identification, communication, and reporting across the organization.

A common taxonomy ensures that AI risk is understood and communicated consistently across the enterprise.

The base model may have been trained on data that contains inherent, unidentifiable biases.

Transfer learning risks include the inheritance of latent biases from the pre-trained weights.

Add a model explainability and interpretability assessment step to the process.

Inclusion of model explainability assessments is necessary to address the opacity inherent in deep learning models.

Kullback-Leibler (KL) Divergence between training and inference feature distributions.

Statistical distribution shifts (like KL Divergence) in input data serve as a proxy for performance degradation.

The end-to-end model lineage and version control logs.

Model lineage/provenance trackers record the exact data versions and training parameters used for a specific model version.

Unexpected performance degradation due to infrastructure differences between development and production.

Deployment involves the risk of performance degradation, infrastructure failure, or unexpected interactions with other systems.

Perform an mandatory AI model risk assessment and escalate to the Governance Committee.

When an AI risk score crosses a predefined threshold, escalation to the risk committee or manual oversight is required.

Operational bottlenecks and delayed AI project timelines.

Centralization can create 'bottlenecks' that slow down innovation and delay deployment.