AAISM Practice Question: An AI security program manager is assessing AI risks
An AI security program manager is assessing AI risks. Which tool provides the most centralized oversight for AI model compliance?
⚠ Common exam trap
AAISM often tests the distinction between operational tooling and governance tooling — candidates pick the hands-on technical tool (script) when the question asks for centralized oversight, which is inherently a governance function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An enterprise GRC platform with AI modules.
An enterprise GRC (Governance, Risk, and Compliance) platform with AI-specific modules centralizes policy management, control mapping, risk registers, evidence collection, and regulatory reporting across all AI models in one system of record. This gives the AI security program manager a single pane of glass for compliance status, audit trails, and cross-model risk aggregation — the definition of centralized oversight. Purpose-built AI modules map controls to frameworks like NIST AI RMF, ISO/IEC 42001, and the EU AI Act.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An enterprise GRC platform with AI modules.
Why this is correct
An enterprise GRC platform with AI capabilities holds an inventory of AI models and use cases with owners and risk ratings, maps controls to frameworks such as the NIST AI RMF, ISO/IEC 42001 and the EU AI Act, stores assessments and test evidence, tracks issues, and reports to management and auditors, all with access control and audit trails. That single system of record is what centralised oversight requires.
- ✗
A local Python script for model testing.
Why it's wrong here
A Python test script can be valuable for checking a model's robustness, fairness or performance, but it runs on one machine, covers one model at a time, and has no workflow, inventory or audit trail visible to the organisation. Its results are best treated as evidence fed into a governance platform, rather than as the oversight tool itself.
- ✗
A public open-source project management board.
Why it's wrong here
A public project board offers no compliance telemetry, policy enforcement or audit trail for AI models, so it cannot provide centralised oversight. It is tempting because open-source boards genuinely track tasks and issues across teams, and would suit coordinating remediation work once a governance platform has already flagged the findings.
- ✗
A standard spreadsheet file.
Why it's wrong here
Spreadsheets are a common starting point for tracking AI risks, but they lack access control, reliable version history, workflow, integration with machine learning platforms and audit trails, and they quickly become inconsistent as models change. They cannot provide dependable, organisation-wide oversight of AI compliance, which needs a dedicated governance or GRC system.
About these practice questions
One of 333 original AAISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar AAISM questions
- A technology company has developed an AI model for autonomous decision-making in its supply chain. The AI governance tea…
- When a model fails in production, what is the first step in the 'Incident Response' process?
- A multinational bank's AI governance committee is drafting its charter. The General Counsel insists that the charter exp…
- Which THREE activities help manage 'AI Lifecycle' risk?
- Which metric should be used to track 'Data Quality' for AI training?
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This AAISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AAISM exam.