ISACA Advanced in AI Audit (AAIA) (AAIA) (AAIA) — Questions 151–225

An MLflow Run records the parameters, metrics, artefacts and source code version (Git commit) for a single execution. It is the audit object that ties the trained model back to its exact inputs and code revision.

A shadow-model attack trains surrogate models on data resembling the target's distribution and uses their output behaviour to build a classifier that predicts membership. Because it works from observable outputs such as rankings, it fits the black-box API constraint and gives the auditor a quantitative estimate of membership inference risk.

The `transition_model_version_stage` API moves a registered model version between stages such as Staging and Production, satisfying the requirement to promote only after the automated integration test passes. It updates the version's stage metadata directly, enabling programmatic, test-gated promotion without re-registering the model.

A bias audit inspects training data for skewed representation and historical prejudice, directly targeting the unfairness and discrimination risk arising from imbalanced datasets. Because model outputs inherit these statistical distortions, auditing the data corrects the root cause rather than merely detecting downstream symptoms, satisfying the scenario's requirement to mitigate unfairness at source.

Fairness assessment examines whether error rates, false positive and false negative rates, and accuracy differ across protected groups such as sex, race, or age. Disparate error rates directly reveal bias, making this a core quantitative fairness metric.

Pipeline staleness means upstream data ingestion or transformation lags behind production, so the model scores against outdated features. Retraining and inference therefore reflect stale distributions, degrading prediction quality as real-world patterns drift away from the training data.

An A/B test splits live traffic between two model variants and compares business or quality metrics, such as conversion or accuracy, under real production conditions. This controlled comparison determines which model performs better before full rollout.

Data poisoning targets the training phase by corrupting the labelled dataset used to fit the model, so the model learns attacker-chosen patterns. It satisfies the stem's training-phase constraint, unlike inference-time attacks such as prompt injection or model evasion, which manipulate inputs after deployment.

MRM targets the governance and validation controls that keep AI and model outputs trustworthy: documented ownership, independent validation, ongoing monitoring and challenge. It addresses the compliance obligation to evidence that models are managed, not the underlying algorithm choice or training data volume.

Statistical drift between production inputs and the training baseline signals that the data distribution the model sees has shifted away from what it learned. This covariate shift typically precedes accuracy loss, making it the earliest reliable indicator of degrading reliability on the dashboard.

Sending labeled probe inputs to the live endpoint and comparing returned predictions against expected labels directly validates the deployed model without needing pipeline access. This is the essence of black-box testing: the auditor treats the model as an opaque function and measures observable behavior, producing independent evidence that matches or contradicts the model card's claims under real serving conditions.

CI/CD denotes Continuous Integration and Continuous Deployment, the DevOps practise underpinning AI Operations pipelines. Continuous Integration merges and tests code changes automatically, while Continuous Deployment releases validated models or services to production, enabling the rapid, reliable iteration that MLOps demands.

The auditor's primary responsibility is to report the finding to the appropriate governance body with sufficient evidence for it to act. Escalating through the AI governance committee ensures the violation is assessed against the organization's risk appetite and that remediation is authorized at the right level. This preserves auditor independence while triggering the formal response process defined in the governance framework.

Terminating serving infrastructure shuts down the endpoints, containers, or instances hosting the model, eliminating ongoing compute cost and removing the live inference surface. This is required because a decommissioned model must stop accepting production traffic.

A centralized AI governance committee provides oversight, sets policies, and ensures consistent risk management across all AI initiatives. Representation from key stakeholders ensures diverse perspectives and alignment with enterprise objectives. This directly addresses the lack of central oversight by creating a governing body responsible for AI-related decisions and accountability.

Aequitas requires bias metrics to be chosen before any group or fairness analysis runs, because metric selection defines which disparities the audit measures. Selecting metrics is therefore the initial step, preceding configuring groups and running the fairness report.

Disparate Impact compares favourable outcome rates between protected and reference groups, flagging models whose decisions disproportionately disadvantage a protected class. Validating it satisfies the stem's requirement to confirm the model is not violating protected class regulations during production fairness auditing.

Microsoft Defender for Cloud Apps discovers and governs unsanctioned cloud apps and services, including AI model APIs, by analysing network traffic. It surfaces Shadow AI usage that endpoint or identity tools alone would miss, giving the visibility the scenario requires.

Extraction testing feeds prefixes or partial phrases from the training corpus and checks whether the model continues with the exact original text. Measuring the longest common subsequence between the generated continuation and the source quantifies verbatim reproduction, directly answering whether the model regurgitates training passages.

Red teaming uses curated adversarial prompts, including role-play, encoding tricks, and jailbreak templates, to probe whether the assistant leaks its system prompt or generates prohibited content. It directly tests the deployed guardrails under realistic attack conditions. A structured library ensures coverage and repeatability, and findings can be mapped to specific policy violations, making it the appropriate technique for this audit objective.

Validation performed by the developing team lacks organisational independence, so reviewers may rationalise their own design choices and overlook defects. This self-review bias compromises the objectivity and integrity of the validation process, which the audit stem flags as the concern.

A non-compliant model must be remediated immediately or withdrawn from production, because continued operation exposes the organisation to regulatory, ethical and reputational harm. This satisfies the governance requirement that non-compliant systems cannot remain in live service pending review.

The Model Manager or Product Owner owns the model through its lifecycle, so they translate governance policy into day-to-day practise: approving changes, monitoring performance and enforcing controls. This satisfies the daily-operations responsibility, which sits with operational ownership rather than the governance board or internal audit.

Model versioning records each trained model iteration with its artefacts and parameters, enabling reproducibility of prior results and rollback to an earlier version when a newer model regresses. This satisfies the stem's requirement for both reproducibility and rollback.

An immutable model registry provides a single source of truth for all model versions, including metadata such as training data and performance metrics. This is essential for auditing and for ensuring that the correct model version is deployed. It also enables safe rollback by allowing the team to identify and retrieve a previous version if needed.

Contractual enforcement is the only mechanism that binds an external provider to the firm's governance requirements, since the firm cannot apply its internal controls directly to third-party infrastructure. The SLA translates policy obligations into auditable, enforceable commitments, satisfying the compliance constraint the scenario demands.

Mutual TLS authenticates both client and server via X.509 certificates, so only trusted callers with valid certs reach the model endpoint. This satisfies the stem's endpoint-hardening requirement by enforcing bidirectional identity verification and encrypting traffic, preventing unauthorised inference requests or credential replay against exposed AI APIs.

SHAP values assign each feature a contribution for a single prediction, giving the local, per-decision explanation the audit requires. They work with non-linear models, unlike global surrogate methods, satisfying the requirement for individual credit decision transparency.

Operational AI challenges concern running models in production after deployment. Data quality management addresses drift, incomplete or biased inputs that degrade live inference, making it a recurring operational burden rather than a design-time or pipeline-construction concern.

Automated retraining periodically retrains a deployed model on fresh operational data, so performance tracks current patterns rather than the original training snapshot. This directly counters model drift and data staleness, keeping predictions accurate without manual retraining cycles, which is the primary benefit over static one-off training.

The AI Risk Assessment documents potential harms, likelihood and severity before deployment, feeding mitigation into design. Identifying and evaluating risks pre-deployment satisfies governance requirements, unlike post-incident review or ongoing monitoring, which occur after the model is already live.

Fine-tuning updates the model's weights using new data, so any bias present in that dataset becomes embedded in the model's learned parameters. A fresh bias audit is therefore required because the original pre-training audit cannot detect biases introduced by the fine-tuning data.

Federated learning trains models across devices without centralising raw data, so each device keeps its data locally and shares only model updates. This directly satisfies the governance requirement for data privacy, since sensitive records never leave the endpoint or reach a central repository.

Adversarial training hardens the model against perturbed inputs by exposing it to crafted examples during training, while input filtering rejects suspicious samples at inference time. Together they directly counter the adversarial input constraint, unlike detection-only or post-hoc approaches that cannot prevent manipulation of the inference pipeline.

SHAP explains any model's predictions using Shapley values from cooperative game theory, computing per-feature contributions from inputs and outputs alone. It requires no access to internal weights or architecture, making it model-agnostic across model types.

Fairness-aware loss functions penalise disparate error rates across demographic groups during training, directly countering the skew caused by imbalanced representation. This satisfies the stem's requirement to detect bias by surfacing performance gaps that aggregate accuracy metrics conceal.

Accountability is a cornerstone of AI governance, especially in healthcare where model errors can directly affect patient safety. Assigning responsibility to a named clinical leader ensures that someone with both authority and clinical expertise is answerable for the model's performance and its impact on care decisions. This control enables escalation, remediation, and alignment with the organization's risk appetite. ISACA's governance principles emphasize clear ownership of AI risks.

Model Monitor continuously evaluates endpoint traffic against a baseline and detects both data drift (shifts in input feature distributions) and model drift (degradation in prediction quality), satisfying the requirement to catch changes in incoming data and model behaviour over time.

A Data Quality assertion evaluates datasets against defined expectations, such as completeness, schema conformance and value ranges, before they enter training. Failing records are flagged or quarantined, preventing corrupted or drifted inputs from degrading model accuracy and satisfying the pre-training validation requirement.

Model validation assesses the trained model against held-out test data, confirming it generalises beyond the training set. This satisfies the audit lifecycle's need to evidence that performance claims hold on unseen records before the model is relied upon.

The AI policy defines which systems, data and processes fall within audit boundaries, while the Risk Management Framework supplies the risk criteria and control expectations used to judge them. Together they establish scope; standards and regulations inform obligations but do not themselves bound the audit.

SLAs define the availability, latency and support guarantees the deployment must meet, so they directly constrain whether a hosting model can satisfy business expectations. This satisfies the selection criteria by quantifying acceptable performance and uptime before committing to an architecture.

Bias assessment and mitigation requirements directly satisfy the ethical alignment constraint by mandating documented evaluation of training data and model outputs for discriminatory patterns. This ensures AI systems undergo systematic fairness testing before deployment, addressing protected characteristics and preventing disparate impact — a core governance control that an AI Policy must specify to demonstrate regulatory and ethical compliance.

High-stakes loan decisions demand transparency and contestability, so the audit framework requires explainability. XAI tools such as SHAP or LIME expose which features drove each prediction, letting auditors and applicants challenge outcomes. This satisfies the stem's constraint that a black-box model be interpretable before deployment.

NeMo Guardrails intercepts prompts and completions, applying programmable rails that block unsafe, off-topic or policy-violating content. This enforces safety boundaries at runtime, directly satisfying the framework's need to mitigate harmful LLM input and output risk.

Silent failures in retraining mean the model becomes stale without anyone knowing. Automated monitoring and alerting would detect failures and trigger remediation, ensuring the model is updated as intended. This is a fundamental operational control for any automated pipeline and directly addresses the identified gap.

Defined escalation paths satisfy the plan's compliance requirement by routing ethical or performance incidents to accountable owners within set timeframes. This ensures AI failures are triaged, documented and remediated under governance controls, rather than handled ad hoc. Escalation ownership is what auditors expect to see evidenced in an AI incident response plan.

Broken lineage between feature store and training pipeline means the provenance of features cannot be traced, so metadata logging and transformation documentation are deficient. Without recorded transformations and versions, reproducibility and regulatory auditability of the model fail.

Backtesting replays historical data against the model to confirm it would have produced the same outputs and accuracy over past periods. This verifies historical model performance, satisfying the audit's need to evidence consistent behaviour before deployment rather than projected or live results.

Automated re-training triggered by performance thresholds directly counters concept drift by refreshing the model whenever its mapping between inputs and outputs degrades. Unlike static retraining schedules, threshold triggers respond to actual distributional change, satisfying the requirement to mitigate drift in production where data distributions evolve unpredictably over time.

Concept drift occurs when the relationship between input features and the target variable changes over time. In fraud detection, fraudsters continuously adapt their tactics, so patterns that indicated fraud two years ago may no longer be valid. The model's degradation despite no change in code or data pipeline is a classic symptom of concept drift. The auditor should flag this as a model risk requiring retraining and ongoing monitoring.

A deployment pipeline automates the sequence of steps that promote a trained model from training into production, including validation, packaging and release. This automation satisfies the MLOps goal of repeatable, reliable delivery, replacing manual handoffs that cause inconsistency and slow iteration.

Basic regulatory expectations require each inventory entry to identify an accountable model owner, the documented business purpose, and the model's current lifecycle status. These three fields establish accountability, intended use and operational state, which auditors need before assessing risk or compliance.

Likelihood and impact are fundamental to risk prioritization in any domain, including AI. Risks with high probability and severe consequences should be prioritized. This aligns with standard risk management frameworks and ISACA guidance. It ensures that resources are allocated to the most significant threats to business objectives.

Recording the deployed model version or ID gives traceability, letting teams map any prediction or incident back to the exact artefact in production. This satisfies the deployment log's audit requirement, since without the version identifier rollback and reproducibility become guesswork.

A requirements.txt file records the exact library versions and dependencies used during training, giving the auditor reproducible evidence of the software environment. This satisfies the Model Training Process verification by evidencing the toolchain that produced the model.

Concept drift occurs when the statistical relationship between input features and the target variable changes over time, so the same inputs no longer map to the same outputs. It is distinct from data drift, which concerns input distribution shifts, making concept drift one of the two common drift categories.

Model Owners hold accountability for the AI system's purpose, risk posture and lifecycle decisions, so interviewing them establishes the audit scope, intended use, governance controls and known limitations that frame which evidence the audit must examine.

Prompt injection succeeds because untrusted input reaches the model without filtering or adversarial testing. Inadequate input validation and absent red-team exercises let crafted prompts override instructions, so the governance failure is the missing validation and testing controls around the Inference API.

Trustworthy AI frameworks require reliability and consistent performance so the system behaves predictably across its lifecycle, satisfying the criterion that outputs remain dependable under expected operating conditions rather than degrading or drifting unpredictably over time.

Versioning records each model iteration with its training data, parameters and artefacts, so any past version can be reconstructed and its decisions traced. This directly satisfies the audit requirement for reproducibility and auditability of historical model versions during review.

The fixed vocabulary cannot handle new slang and abbreviations, leading to out-of-vocabulary tokens that degrade model performance. Regular retraining with a rolling window of recent data would update the vocabulary and allow the model to learn new language patterns. This is a fundamental operational control for NLP models in dynamic environments, ensuring the model remains relevant and safe.

Inference latency is most often caused by CPU or memory throttling, so container resource limits and requests should be checked first. Insufficient limits force queuing and slow responses, directly producing the high latency the auditor observed.

Model inversion exploits a model's outputs to infer or reconstruct sensitive training data, such as recovering recognisable features of individuals in the training set. It differs from membership inference, which only determines whether a record was used.

A feature store provides a centralised repository that both stores computed features and serves them consistently to training and inference, eliminating duplicated engineering and preventing training-serving skew. This centralised serving and storage is precisely the function the question asks about.

System latency monitoring is essential because model observability requires tracking operational performance alongside prediction quality. Latency directly affects user experience and can signal infrastructure degradation, queue saturation, or resource contention in production inference pipelines. Without it, teams cannot detect performance regressions that occur independently of model accuracy, leaving a critical observability gap unaddressed.

Board-level governance sets direction rather than managing operational controls. It ensures AI initiatives align with corporate strategy and the board's stated risk appetite, satisfying the stem's demand for the primary objective at that oversight tier.

Overfitting occurs when a model memorises training data, fitting noise rather than generalisable patterns. The model scores highly on training data but performs poorly on unseen validation data, producing the characteristic gap of high training accuracy alongside low validation accuracy.

An AI Model Gateway sits between applications and multiple model providers, centralising authentication, rate limiting, prompt logging and content filtering. This brokers every inference request through one controlled point, satisfying the need for consistent governance and security across disparate AI backends rather than per-application credentials.

Demographic parity compares the proportion of positive outcomes across groups, requiring selection rates to be equal regardless of group membership. It satisfies the audit's need to detect disparate impact by measuring outcome-rate gaps directly, rather than conditioning on true labels or predicted scores as equalised odds and calibration would.

An AI audit trail records model inputs, outputs, decisions and version changes, creating traceable evidence of how systems behave. This directly delivers transparency and accountability, satisfying the stem's requirement by enabling investigators to reconstruct events, detect bias, and demonstrate compliance with governance obligations.

Board-level oversight means governing direction and risk appetite, not operational detail. Approving the annual AI strategy alongside its risk mitigation plans exercises that authority, ensuring AI initiatives align with organisational objectives and acceptable risk tolerances.

Workspace Access Control (IAM) holds the role assignments governing who can read or write to the model registry. Auditors verify these assignments to confirm only authorised CI/CD service principals hold registry permissions, satisfying the restriction requirement.

Orchestrator task execution logs record each pipeline step's start, completion, inputs, outputs, and errors, so they pinpoint exactly where the run failed. They satisfy the diagnostic requirement by showing task-level sequencing rather than only model or data-level detail.

Independent model validation reports evidence that a party separate from development assessed the model's methodology, assumptions and outputs. This provides the objective, documented scrutiny auditors need to confirm that model governance controls operated effectively throughout the life cycle.