An organization is performing threat modeling for a RAG (Retrieval-Augmented Generation) pipeline. Which specific vulnerability is unique to the retrieval component?
An organization is building its AI risk register and wants to ensure that each identified risk is assigned an owner, a likelihood and impact rating, and a documented treatment decision. Which risk management principle does this practice MOST directly reflect?
A healthcare insurer deploys an AI model that predicts patient readmission risk. During post-deployment review, the risk team discovers the model performs well on the overall population but systematically underestimates risk for patients over 65. The team must address this finding within the AI risk management program. Which TWO actions BEST address this issue? (Choose two.)
A global retailer is preparing to launch an AI system that dynamically prices products for online shoppers. Legal counsel has flagged that the system may indirectly use postal code as a proxy for protected characteristics. The AI governance team must select risk controls that address proxy discrimination in the model. (Choose two.)
When establishing a risk management framework for GenAI, which THREE factors should be prioritized to satisfy the NIST AI Risk Management Framework requirements?
During an adversarial threat modeling exercise for a facial recognition system, you identify a risk of pixel perturbation attacks. Which countermeasure is the most appropriate technical control to implement?
You are assessing a supply chain risk where an AI model uses a pre-trained base model from a third-party hub. Which action most effectively mitigates the risk of model poisoning during the integration phase?
When conducting a risk assessment for an AI system, which TWO of the following are considered 'AI System' components that require individual threat assessment?
You are managing risks for a federated learning deployment. What is the primary security concern regarding the 'model updates' sent from the edge clients to the aggregator?
You are managing an AI project and notice the model is performing poorly on a subset of data representing a protected class. What is the correct next step in the risk assessment process?
A hospital's AI governance committee is deciding how to treat a vendor-supplied diagnostic model that flags possible intracranial hemorrhage on CT scans but only reports a single binary output with no confidence score. Clinicians have already overridden the tool several times, and two misses have been logged. The committee wants the residual risk to be formally owned rather than absorbed silently by the radiology department. Which action best satisfies that objective?
A financial services firm uses a third-party large language model for internal research summarization. The vendor publishes a model card but will not disclose training data composition, and the firm's regulator has begun asking how the organization would detect and respond if the model began producing outputs that subtly favor one issuer's securities. The CISO wants a control that provides early warning without requiring vendor source code. Which approach is most appropriate?
A hospital's AI governance committee is assessing an AI diagnostic imaging model that was trained on data from a single urban medical center. The model will now be deployed across a network of rural clinics. The committee wants to quantify the risk that model performance will degrade in the new environment. Which risk management activity should be performed FIRST to address this concern?
A financial services firm uses a third-party large language model via API for customer-facing investment guidance. The AI risk manager is told that the vendor has updated the model weights without changing the API version number or notifying customers. The firm's own testing now shows different outputs for the same regulated prompts. Which risk management control failure does this scenario MOST directly illustrate?
A risk manager at a financial services firm is evaluating a third-party large language model (LLM) that will be used for internal knowledge retrieval. The vendor's contract does not specify whether customer prompts and outputs are used for model retraining. Which action BEST addresses the residual risk of confidential data being incorporated into future model versions?
An AI risk analyst is reviewing a credit scoring model and finds that the model's output for an applicant can change materially when a single input feature is altered by a tiny amount within its normal range. The analyst is concerned this indicates the model is relying on unstable decision boundaries. Which technique should the analyst use to systematically quantify this sensitivity across the applicant population?
A healthcare AI governance committee is reviewing a sepsis prediction model deployed across three hospitals. The model was trained on data from one hospital and shows a 12% drop in sensitivity when used at a second hospital with a different patient demographic. The committee must decide how to treat this risk. Which action is MOST appropriate?
A global retailer is deploying an AI demand forecasting system that will automatically place supplier orders. The AI risk manager must establish controls that address the risk of automation bias, where human planners may defer to AI recommendations even when they are wrong. Which TWO controls BEST address this risk? (Choose two.)
An organization has a mature AI governance program with a complete AI asset inventory, but recent audits show that third-party foundation model providers are updating their models without notice, causing downstream performance drift in production. The CISO asks the AI security manager to reduce this supply-chain risk. Which action should the AI security manager take FIRST?
A financial services firm uses a third-party large language model (LLM) API to summarize internal audit reports. The CISO is concerned that confidential report content could be retained by the provider and later resurface in responses to other customers. Which risk management action BEST addresses this specific concern?
An AI risk analyst is assessing a computer vision model used for quality inspection on a manufacturing line. The model occasionally misclassifies defective parts as acceptable, and the defect rate is low. Which risk metric BEST communicates the operational exposure to plant leadership?
A financial services firm uses an AI model to approve loan applications. The model was trained on historical data that reflects past lending biases. An internal audit finds that the model's decisions disproportionately deny loans to applicants from certain demographic groups, even though those groups are not explicitly represented in the input features. The AI security manager must address this risk. Which action is MOST effective for mitigating the identified bias?
A bank's AI governance committee is reviewing a new generative AI tool for credit memo summarization. The vendor provides SOC 2 Type II reports but refuses to disclose training data sources, citing trade secrets. The committee must decide whether to approve the tool for production use. Which action BEST aligns with ISACA's AI risk management principles?
An AI governance team is mapping controls for a credit-scoring model to the NIST AI Risk Management Framework. The team has completed the MAP function and is now working on MEASURE. Which activity is MOST appropriate for the MEASURE function?
A global retailer is deploying a generative AI assistant that summarizes customer service transcripts for human agents. The legal team is concerned about privacy risk from the assistant retaining or regurgitating personally identifiable information (PII) from previous conversations. Which TWO controls BEST reduce this risk? (Choose two.)
A healthcare organization is deploying a generative AI chatbot that provides medical information to patients. The AI security manager is concerned about the risk of the chatbot generating harmful or misleading medical advice. Which control is MOST appropriate to mitigate this risk before deployment?
An AI risk manager is preparing a board-level report on a portfolio of machine learning models. The board wants to understand which models pose the greatest potential for financial loss. Which approach BEST aligns model risk assessment with enterprise risk management?
A hospital is deploying an AI triage system that recommends patient priority levels. The risk committee wants to ensure ongoing risk visibility after go-live. Which TWO activities provide continuous risk visibility for this deployed system? (Choose two.)
A financial services firm has deployed a credit-scoring model, but the model owner cannot produce a defensible rationale for the weighting of each input feature, and the model card omits the intended use and known limitations. The CISO wants to align the AI system with ISACA's AI risk management expectations. Which action should be taken FIRST to address this gap?
A retail company's AI-powered recommendation engine begins suggesting products that are culturally insensitive in certain regions. The model has not been changed, but sales data from a newly acquired subsidiary was recently added to its training pipeline. Which risk management principle does this scenario BEST illustrate?
An AI security manager is assessing the risk of model inversion attacks on a machine learning model that predicts patient outcomes. The model is accessible via an API that returns confidence scores. Which TWO controls are MOST effective at reducing the risk of model inversion? (Choose two.)
An enterprise risk committee is reviewing a generative AI assistant that recommends credit-limit increases. The model is a third-party SaaS large language model (LLM) accessed via API, with no visibility into its training data, weights, or fine-tuning process. The committee wants to know which risk treatment best addresses residual model risk before the assistant goes live, given that the vendor will not permit audits of the model itself.
A security analyst is reviewing the risk register for a deployed credit-scoring AI model and notices that the 'Model Drift' risk entry has no owner and no monitoring threshold. The model currently performs well on the original validation set. What is the MOST appropriate action for the analyst to take?
An AI governance lead is mapping the organization's AI risk register to the NIST AI Risk Management Framework. A business unit asks why the 'Map' function must be completed before the 'Measure' function is fully executed for a new fraud-detection model. Which response BEST justifies the sequence?
A company uses an AI model to screen job applicants. An internal audit finds that the model's decisions cannot be explained in terms a rejected candidate could understand, and the company operates in a jurisdiction with a right-to-explanation law. Which risk management response is MOST appropriate?
An organization is developing an AI risk register as part of its AI governance program. The AI security manager needs to ensure that risks are tracked and managed throughout the AI system lifecycle. Which element is MOST critical to include in the risk register for each identified AI risk?
A hospital's AI governance lead is classifying an AI triage tool that prioritizes emergency department patients. The tool was trained on five years of historical admission data. A risk assessment must determine the inherent risk tier before any controls are applied. Which factor most directly drives the inherent risk classification of this system?
A hospital's AI governance committee is evaluating a vendor-provided clinical decision support model. The vendor refuses to disclose training data composition or model architecture but provides accuracy metrics and a third-party audit attestation. The committee must decide how to treat the residual risk of unknown model provenance. Which approach BEST aligns with AI risk management principles?
A retail company's AI team wants to deploy a customer-facing chatbot powered by a large language model. The chief information security officer asks the AI risk manager to identify the MOST significant risk introduced by this deployment that does not exist with traditional rule-based chatbots.
A hospital network is deploying a clinical decision support model that recommends triage priorities. The risk committee wants to establish human oversight that satisfies AI risk management expectations while preserving clinical workflow efficiency. Which TWO design choices BEST achieve meaningful human oversight? (Choose two.)
A financial services firm has deployed an AI model that flags suspicious transactions. After six months, monitoring shows the model's false-positive rate has drifted from 4% to 11%, generating excessive analyst workload. The data science team confirms the model has not been retrained and the feature pipeline is unchanged. Which risk management action should the AI governance lead prioritize?
A financial services firm is building an AI risk taxonomy for its enterprise risk management framework. The CISO asks which characteristics distinguish AI-specific risks from traditional IT risks so that appropriate controls can be designed. Which TWO characteristics should be included? (Choose two.)
A multinational manufacturer uses an AI system to optimize supply chain logistics across 12 countries. The AI risk manager is building a third-party risk assessment process for the AI vendor that provides the optimization engine. The vendor uses a proprietary model hosted in a jurisdiction with different data protection laws than the manufacturer's headquarters. Which factor is MOST critical to include in the vendor risk assessment?
A retailer's AI system uses a third-party foundation model accessed through a vendor API to summarize customer support transcripts. During risk assessment, the team realizes the vendor may use submitted content to improve its own models, and the retailer cannot inspect the vendor's training data or security controls. Which approach BEST manages this third-party AI risk?
A global insurer uses an AI model to flag potentially fraudulent claims. Six months after deployment, claim volume patterns shift substantially because of a regional economic downturn, and the model's false-positive rate rises sharply. The risk team must respond in a way that reflects sound AI risk management. Which action is MOST appropriate?
An e-commerce company discovers that its recommendation model, trained on historical customer data, systematically under-recommends products to users from certain demographic groups, reducing their access to promotional offers. The legal team flags potential fair-lending-style exposure even though no credit is involved. Which action BEST addresses this risk within an AI risk management framework?
An AI risk manager is presenting to the board on the organization's AI risk appetite. The board asks how the organization should handle an AI system that delivers high business value but has a residual risk level that exceeds the stated risk appetite for model accuracy in financial forecasting. Which response BEST reflects ISACA's risk management principles?
A startup is preparing to launch a generative AI customer service assistant. Before go-live, the risk team wants to ensure the system has a documented process for handling harmful or inappropriate outputs discovered after deployment. Which practice BEST satisfies this requirement?
A mid-sized insurance company is building its first AI risk inventory. The CISO asks the AI governance lead to define the scope of systems that must be registered in the inventory. Which approach best aligns with AI risk management principles?
A global bank's AI governance committee is operationalizing 'AI Risk Appetite' for a portfolio of 40 generative AI use cases. The CISO wants the appetite expressed so that it can be measured continuously against live production telemetry rather than only reviewed annually. Which approach BEST enables continuous measurement of AI risk appetite?
A global bank deploys a generative AI assistant that drafts personalized wealth-management emails using the bank's proprietary product catalogue and live client portfolio data. The AI risk manager must classify the assistant's risk tier before go-live. The assistant can only read data, never execute trades, and all drafts require advisor approval before sending. Which classification approach BEST aligns with an AI risk management framework?
A hospital's AI risk manager is evaluating a sepsis-prediction model that was validated on historical data from 2019-2021. The vendor has not retrained the model, and the hospital's patient demographics and treatment protocols have shifted substantially. Clinicians report the model's alerts no longer match their clinical judgment. Which risk is MOST directly illustrated by this situation?
An AI risk manager at an insurance company is designing controls for a claims-triage model that recommends whether a claim should be fast-tracked or manually reviewed. The model's recommendations influence but do not determine the final decision. The manager wants to ensure that claimants who are adversely affected can understand and contest the outcome. Which control BEST addresses this requirement?
A retail company is onboarding a third-party AI vendor that provides a recommendation engine for product pricing. The AI risk manager must assess the vendor's risk posture before contract signature. Which action is MOST appropriate as an initial step in third-party AI risk management?
An AI risk manager at a telecommunications company is establishing an ongoing monitoring program for a network-fault prediction model deployed in production. The model triggers field technician dispatches. The manager wants to define monitoring signals that would indicate the model's risk profile has materially changed and require re-assessment. Which TWO signals are MOST appropriate to include? (Choose two.)