ISACA Advanced in AI Audit (AAIA) (AAIA) (AAIA) — Questions 76–150

Multi-stage builds let earlier stages compile dependencies and artefacts, then copy only the runtime essentials into a slim final stage. This directly satisfies the stem's containerised AI deployment constraint: the shipped image carries no build toolchain, cutting both image size and exploitable attack surface.

Documenting intended use cases defines the model's approved scope and boundaries, which regulators require to assess fitness for purpose. It satisfies the Model Card requirement by evidencing that deployment stays within validated parameters, distinct from performance or limitation disclosures.

Recall measures the proportion of actual positives the model correctly identifies, exposing false-negative behaviour. During audit it evidences model quality by showing missed cases, which matters where failing to detect a positive carries greater cost than a false alarm.

With a 0.5% fraud rate, a model can achieve 99.5% accuracy by simply predicting 'no fraud' for all transactions. Monitoring only overall accuracy would not reveal that fraudulent transactions are being missed. This is a classic pitfall with imbalanced datasets. The auditor should recommend using precision, recall, or F1-score to detect false negatives.

Model poisoning corrupts training data or weights so the deployed model learns attacker-chosen behaviour, undermining integrity. Detecting it requires monitoring training pipelines, data provenance and drift, which is why it demands ongoing operational oversight rather than one-off validation.

Shadow Mode mirrors live production traffic to the candidate model while its outputs are logged but never served, so comparisons against the incumbent occur with zero user impact. This satisfies the audit requirement of validating performance before promotion without risking customer-facing responses.

Generative models produce fluent output without grounding in verified fact, so they can fabricate plausible but false content. Predictive models output scores or classes from fixed features and cannot invent novel text, making hallucination and misinformation generation unique to generative AI.

CleverHans is a Python library for benchmarking machine learning models against adversarial examples, so it detects adversarial vulnerability — inputs crafted to cause misclassification. It tests model robustness rather than data poisoning or model inversion.

An AI Policy codifies governance expectations, defining acceptable use, accountability, risk assessment and compliance requirements so teams develop and deploy AI systems responsibly. It gives structured, enforceable guidance rather than leaving ethical and regulatory decisions to individual judgement.

A circuit breaker monitors calls to a failing dependency and, once a threshold is breached, trips to return fallback responses instead of forwarding requests. This halts cascading failures across microservices, satisfying the stem's requirement of preventing failure propagation.

Assigning explicit roles and responsibilities to the AI Governance Committee and model owners creates named accountability, ensuring every AI system has an owner answerable for its risks and decisions. This directly establishes the organisational accountability the stem asks for, unlike broader policy statements.

Including the target variable among the training features lets the model memorise labels rather than learn generalisable patterns, producing unrealistically high validation accuracy. This satisfies the stem's data leakage constraint, where information unavailable at inference time contaminates training, inflating reported performance and degrading real-world predictions.

Ethics derives from societal values and moral expectations, which may exceed or precede legislation, whereas compliance is bounded by enforceable legal and regulatory requirements. This axis of difference explains why an action can be legal yet unethical, satisfying the question's demand for the key distinction.

Git tracks revisions to source code, notebooks and configuration files, letting MLOps team members branch, merge and roll back changes while maintaining a full audit history. This versioning underpins reproducibility and collaboration across the model development lifecycle.

The absence of redundancy means that if the GPU server fails, the defect detection system goes offline, and defective products may pass undetected. This is a critical operational risk because it directly impacts product quality and safety. The audit should recommend implementing failover or load-balanced servers to ensure continuous operation.

Autoscaling configuration and resource limits determine how the inference service scales in response to increased request volume. This is critical for handling peak production loads without degradation. The auditor should verify that scaling policies are properly set, tested under load, and aligned with production throughput requirements to ensure reliability.

Quantitative thresholds translate risk appetite into measurable limits for model performance and ethical impact, giving the board objective criteria for governance decisions. This satisfies the requirement to define appetite concretely rather than as qualitative statements, enabling consistent monitoring and escalation.

Committing .dvc files to Git records the exact hash and pointer for each dataset version, so the referenced data cannot be silently altered. This immutability satisfies the audit requirement, since any change produces a new hash and a new commit.

SHAP values quantify each feature's marginal contribution to an individual prediction, so auditing them directly satisfies the stem's demand for local, per-instance transparency. The auditor's primary objective is verifying that these attributions faithfully explain why the model produced a given output, rather than merely documenting global accuracy or training data lineage.

A model validation gate that incorporates fairness metrics ensures that any retrained model must pass predefined bias checks before being promoted to production. This is a direct operational control that prevents biased models from being deployed. Auditors should examine the gate's configuration, the fairness metrics used, and the approval workflow to confirm effectiveness.

Automated retraining triggered by drift detection ensures that the model adapts to changing fraud patterns without manual intervention. This is critical for maintaining effectiveness in a dynamic environment. The audit team should verify that drift detection thresholds are properly calibrated and that retraining pipelines include validation gates to prevent performance regressions.

A Model Inventory consolidates every deployed and in-development model into one register, giving auditors centralised visibility of models. This directly satisfies the audit objective of knowing which models exist, their owners and purposes, enabling complete scoping rather than discovering models piecemeal across business units.

Drift can shift a model's learned decision boundaries as live data diverges from training data, producing discriminatory outcomes that were absent at validation. Auditors must monitor post-deployment outputs across demographic segments to detect emergent bias rather than relying solely on pre-release testing.

A PII Scrubber detects and anonymises personally identifiable information such as names, addresses and identifiers within datasets or pipelines. Anonymising sensitive data removes direct identifiers before processing, satisfying privacy obligations and preventing regulated personal data from propagating through downstream AI systems.

CloudTrail records every KMS API call, including which key encrypted the training data and who used it. Auditors can therefore trace key usage events to verify that SageMaker training jobs consumed encrypted data, providing the evidential trail the scenario demands.

Red teaming actively probes the application with adversarial prompts designed to override instructions, exposing injection weaknesses that static review cannot. It directly tests robustness by simulating real attacker behaviour against the deployed model, satisfying the audit's requirement for empirical prompt-injection testing.

A Model Card documents a model's intended use, design, performance and known limitations in a standardised format, giving external regulators the transparency evidence the AI Transparency requirement demands. It is the recognised artifact for disclosing model characteristics to third parties.

Serving features from a unified source guarantees that the identical feature definitions and values used during training are also supplied at inference, eliminating training-serving skew. This directly satisfies the consistency constraint, since both pipelines read from one governed repository rather than separate, divergent transformations.

Vertex AI Metadata stores and tracks artefacts, executions and contexts, recording which dataset and code version produced each model. This lineage graph satisfies the stem's requirement by linking every model artefact back to its exact training inputs and pipeline components.

Adversarial red teaming probes the safety filter with deliberately crafted prompts that attempt to bypass its guardrails, revealing jailbreak weaknesses under realistic attack conditions. Static benchmarks and standard evaluation sets do not simulate adaptive adversaries, so they miss these bypasses.

Explanation faithfulness measures whether the stated rationale genuinely reflects the model's internal decision logic, rather than being a plausible post-hoc rationalisation. An explanation can be convincing yet unfaithful if it does not correspond to the actual features driving predictions.

Input validation and sanitisation screen incoming training records for malformed, anomalous or adversarial samples before they enter the dataset. Rejecting or cleaning poisoned entries at ingestion stops corrupted data from skewing the retail model's learned parameters, directly mitigating data poisoning.

Verifying that data processing aligns with privacy policies confirms handling of personal data meets governance obligations such as consent, purpose limitation and retention. This directly satisfies the audit requirement to demonstrate that pipeline processing respects documented privacy commitments throughout the model deployment lifecycle.

A dedicated secret vault keeps API keys out of code, configuration files and container images, storing them encrypted with tightly scoped, auditable access. This satisfies the public cloud deployment constraint, where shared responsibility and exposed build pipelines make hard-coded credentials a primary breach vector.

Manual review before execution satisfies HITL by inserting a human decision point between model output and consequential action, which is precisely where high-risk errors cause harm. Unlike post-hoc auditing or sampling, pre-execution review blocks the action until a person approves it, matching the stem's requirement for a best-practice control.

Partitioning isolates training data by tenant or purpose, and feature selection excludes identifiers and sensitive attributes, directly limiting what a model can memorise and expose. This constrains leakage at the data layer rather than detecting it afterwards.

Recording the root cause satisfies the requirement to document why a finding occurred, not merely what was observed. It anchors each finding to the underlying control failure, enabling remediation to address the cause rather than the symptom, which is essential for defensible audit documentation and repeatable corrective action.

Automated metadata tracking captures lineage continuously across pipelines, models and datasets by instrumenting each transformation and recording inputs, outputs and timestamps. This satisfies the complex-ecosystem constraint, where manual documentation cannot keep pace with distributed, frequently retrained AI components.

Technical system architecture documentation reveals how the AI model is built, deployed and integrated, exposing data flows, components and control points. It lets the auditor map the governance structure, including oversight roles and decision rights, to the actual system, satisfying the scoping requirement.

ResourceQuotas cap aggregate CPU and memory consumption within the namespace, preventing Katib trial pods from consuming capacity the production inference service depends on. This enforces the resource isolation the scenario requires, avoiding starvation during concurrent hyperparameter tuning runs.

Disparity analysis measures outcome rates across protected or demographic segments, comparing metrics such as selection rate or error rate between groups. This quantifies whether the model treats subgroups equitably, which is the core evidence an AI fairness audit examines.

Kubeflow Pipelines records each pipeline's component definitions, container images, parameters, and artefacts, giving auditors the versioned specification needed to rerun steps identically. This satisfies the reproducibility requirement by exposing exactly which inputs and images produced each output.

A Model Approval workflow inserts a mandatory human review gate before a model reaches production, so a named reviewer must explicitly accept the artefact. This enforces human oversight of deployment, preventing automated promotion of unvetted or drifting models.

Internal AI policy and guidelines count as governance inputs because they are artefacts fed into AI systems' development and operation, shaping decisions before outputs emerge. They satisfy the stem's requirement by governing data, model selection and usage constraints upstream, unlike monitoring reports or audit findings, which are governance outputs generated after deployment.

An AI Ethics Board provides governance oversight, reviewing AI initiatives against corporate values and societal norms before deployment. This satisfies the stem's requirement for the primary function: assessing alignment rather than performing technical implementation, model training, or regulatory enforcement. It ensures ethical considerations are embedded in decision-making across the organisation's AI portfolio.

Standardised model risk assessment templates enforce consistent scoring criteria, evidence capture and documentation across every AI model reviewed. This satisfies the framework requirement by making risk evaluations repeatable and comparable, rather than relying on ad hoc analyst judgement.

Reproducibility means the same pipeline, code, data and configuration yield the same model artefacts. Re-running the pipeline with identical inputs and comparing outputs verifies determinism, exposing hidden nondeterminism such as unseeded randomness or uncontrolled data drift.

CPU and memory utilization metrics reveal whether the inference service is experiencing resource contention or saturation. A gradual increase in latency often correlates with rising resource usage due to increased traffic, memory leaks, or inefficient scaling. Analyzing these metrics helps distinguish between infrastructure degradation and model-related causes, guiding remediation.

SHAP values assign each feature a contribution to a specific prediction based on cooperative game theory, providing consistent local explanations. For an individual candidate, the auditor can present which qualifications raised or lowered the ranking. SHAP is model-agnostic in its kernel and sampling variants, so it applies across common recruitment model types, and its additive property makes the explanation auditable and reproducible.

Adversarial testing deliberately perturbs inputs, often via gradient-based or perturbation methods, then measures whether model output changes materially. That directly satisfies the robustness evaluation described, unlike standard accuracy or drift monitoring, which never probe deliberate input manipulation.

Containerisation packages the model, its dependencies and runtime into an immutable image, so an auditor can rerun inference in the identical environment and obtain the same results. This environment reproducibility is what makes audit findings verifiable and defensible.

Without point-in-time correctness, training data may include feature values that were not available at the time of prediction, causing data leakage. For example, future lab results could leak into training, making the model appear more accurate than it will be in production. This leads to overly optimistic performance estimates and poor real-world performance, a critical risk in healthcare.

Placing the gate between training and registration ensures the model is evaluated on held-out data before it enters the registry, so only validated artefacts become versioned and deployable. This satisfies the constraint that unvalidated models must never reach the registration stage.

Orchestrators such as Kubeflow and Airflow model pipelines as directed acyclic graphs, scheduling each step to run only after its upstream dependencies succeed, plus retries and monitoring, rather than performing model training or inference themselves.

A centralised model registry with artifact management provides versioned lineage, immutable storage and approval gates, so every deployed model traces to a reproducible build. This directly satisfies the operational stability requirement by preventing untracked model drift, enabling rollback to prior versions and enforcing promotion controls before production release.

An AI audit log records inputs, outputs, model changes, and user interactions over time, creating a traceable record for accountability and compliance. This satisfies the need to track and document all interactions and changes made to the AI system.

F1-score is the harmonic mean of precision and recall, giving a single balanced measure of classification performance. Auditors favour it because it exposes poor performance on minority classes that raw accuracy hides, making it a standard classification audit metric.

Apache Airflow renders the directed acyclic graph of tasks and dependencies, giving a visual, end-to-end view of how data flows through each pipeline stage. That graph is the lineage confirmation auditors need, unlike point tools that show only isolated transformations.

The Govern function establishes and enforces AI risk policies, assigning accountability and controls across the organisation. It provides the documented oversight evidence a board needs to confirm its AI policy is operationally enforced, unlike Map, Measure or Manage, which address context, analysis and treatment.

A Model Registry stores and versions trained model artifacts, enabling reproducible deployment and rollback across AI pipeline stages. It satisfies the pipeline's need to track which model version produced which output, providing the version control the scenario requires rather than compute or data storage.

An Input Feature Schema documents the expected data format and constraints for each model input, such as type, range and permitted values. This gives auditors a defined baseline to verify that production inputs match what the model was trained and validated against.

Hyperparameters are configuration values chosen before training, such as learning rate and batch size, recorded alongside the model artefact. Tracking them in a registry satisfies the stem's requirement for model metadata, enabling reproducibility and comparison between training runs.

Detected production performance issues justify rollback because the deployed model's live inference quality has degraded against monitored metrics, breaching the acceptable threshold defined for that endpoint. Rolling back restores the previously validated model version, immediately halting the degraded predictions while root-cause analysis proceeds, satisfying the requirement to remediate active production harm.

GitHub Secrets encrypts values at rest and injects them as masked environment variables at runtime, so registry credentials never appear in workflow logs. This directly satisfies the stem's constraint that sensitive credentials must not be exposed, unlike plaintext storage in workflow YAML or repository files.

This is the core function of a model registry.

Automated pipeline triggers represent a higher MLOps maturity level: model training, validation and deployment pipelines execute automatically on code, data or schedule events, removing manual orchestration. This distinguishes mature, repeatable automation from ad-hoc or fully manual workflows.

Reviewing critical AI decisions places a human checkpoint before consequential outcomes, satisfying the HITL constraint that high-impact or low-confidence outputs require human judgement rather than autonomous execution. This catches errors, bias and edge cases that automated confidence thresholds miss, ensuring accountability for decisions affecting users.

Immutable versioning stores each model artefact as a distinct, unalterable version, so prior states cannot be overwritten or deleted. This preserves a tamper-evident audit trail, satisfying the requirement to maintain reliable evidence during model versioning audits.

Assessing likelihood and severity quantifies each identified risk, satisfying the stem's requirement to evaluate impact rather than merely list hazards. This scoring underpins prioritisation and mitigation planning, and aligns with Microsoft Entra ID governance guidance for AI systems. Without it, an AI risk assessment cannot rank threats or justify controls.

Larger models require more floating-point operations per inference pass, directly extending compute time within the pipeline. Parameter count therefore governs the processing stage's duration, making it a genuine latency factor alongside data preprocessing and inference hardware throughput.

Without a defined decommissioning process, retired models remain deployed and continue serving predictions, so outdated or insecure versions persist in production. This directly satisfies the stem's missing lifecycle control, since Microsoft Entra ID and monitoring cannot compensate for absent retirement governance. The impact is sustained exposure to model drift and unpatched vulnerabilities.

The Fairness monitor in IBM Watson OpenScale computes disparate impact by comparing favourable outcome rates across protected and reference groups, flagging bias when the ratio breaches the four-fifths threshold. This directly satisfies the regulatory compliance requirement to detect disparate impact, unlike drift or quality monitors, which track accuracy degradation rather than group-level fairness.

Performance Monitoring tracks live metrics such as latency, throughput and error rates against defined thresholds, directly satisfying the SLA compliance constraint in the stem. It detects degradation before users are affected, enabling alerts and remediation that keep AI services within contracted availability and response-time commitments.

Mapping each use case to the enterprise AI risk appetite ensures that risk tolerance is consistently applied across the AI portfolio. Approval by the AI governance committee provides oversight and accountability. This directly addresses the gap where use cases are approved without reference to the risk appetite statement, aligning with ISACA AAIA guidance on integrating risk appetite into AI governance.

Canary deployment routes a small slice of live traffic to the new model version while the majority still hits the stable one. This limits blast radius, letting teams observe stability and performance before full rollout, satisfying the need to test in production gradually.