CRISC Information Technology and Security Practice Question
An organization uses AI/ML for credit scoring decisions. The risk manager is concerned about regulatory compliance if the model cannot explain its decisions. Which AI risk is most directly addressed by requiring explainability?
⚠ Common exam trap
A common mix-up: candidates confuse 'model bias' with 'data privacy' or 'adversarial attacks,' but the question specifically ties explainability to regulatory compliance, which is fundamentally about detecting and proving fairness (bias), not about data protection or input manipulation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Model bias
Requiring explainability in an AI/ML credit scoring model directly addresses model bias because it forces the model to reveal which input features (e.g., income, zip code) drive its decisions. Without explainability, the organization cannot detect or prove that the model is not discriminating against protected groups, violating regulations like the Equal Credit Opportunity Act (ECOA) or GDPR's right to explanation. Explainability is the primary technical control to audit and mitigate bias in automated decision-making.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data privacy in AI training
Why it's wrong here
Data privacy is about protecting training data, not decision explainability.
- ✗
Vendor lock-in
Why it's wrong here
Vendor lock-in is a procurement risk, not AI-specific.
- ✗
Adversarial attacks
Why it's wrong here
Adversarial attacks manipulate inputs, not directly addressed by explainability.
- ✓
Model bias
Why this is correct
Explainability helps identify and mitigate bias in AI decisions.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.