Isaca AAIR Exam Dumps - Actual Questions Answers

Acceptable use policies (AUPs) govern how employees interact with organizational systems and tools. Embedding AI risk considerations into AUPs ensures that AI-related behaviors align with the organization ' s risk appetite and tolerance thresholds.

Why C is Correct: According to ISACA AAIR governance principles, the best justification for embedding AI risk in AUPs is maintaining consistent enterprise risk tolerance across all AI-driven decision-making. When risk tolerances are codified in AUPs, employees understand what AI behaviors are permissible, and deviation from these boundaries triggers escalation. This enterprise-wide alignment prevents individual business units from accepting risks that exceed organizational thresholds.

Why A is Wrong: Shadow AI mitigation through allow lists is a specific technical control mechanism, not the primary governance justification for AUP integration. It addresses unauthorized tool use rather than risk tolerance alignment.

Why B is Wrong: Applying uniform risk controls across diverse business functions is a compliance approach that may not be appropriate—different functions may legitimately have different risk profiles. The goal is tolerance alignment, not control uniformity.

Why D is Wrong: Assigning accountability to business unit leadership is a governance structure decision. AUPs define behavioral expectations, not organizational accountability assignments, which are addressed through RACI frameworks and policy governance.

Within the ISACA Advanced in AI Risk framework, program management connects risk identification, control selection, treatment, monitoring, resilience, third-party oversight, and reporting to enterprise risk objectives. Predictive-maintenance models can become unreliable when equipment behavior, operating conditions, or sensor relationships change. The practitioner should verify that the model can adapt to changing operational conditions rather than merely checking software version or end-user training effort. This makes option C, The model is capable of adjusting quickly to changes in operational conditions, the strongest answer. The other choices describe narrower technical, operational, performance, or administrative considerations and do not address the primary risk-management objective in the scenario as directly. A risk practitioner should select the response that most effectively reduces the stated exposure while preserving appropriate oversight, traceability, and alignment with organizational risk tolerance and business requirements.

Even when an AI system is initially assessed as within risk tolerance, its risk profile evolves as the system encounters new data, the operational environment changes, and model performance drifts. Controls that were effective at deployment may become insufficient as these changes accumulate.

Why C is Correct: The ISACA AAIR operational monitoring guidance identifies continuous monitoring for data and performance drift as the most important mechanism for maintaining control effectiveness over time. Drift detection provides early warning when the AI system begins behaving differently from its validated state—enabling timely control adjustments before risk tolerance is breached. This is particularly critical because AI systems can degrade gradually in ways not visible without active monitoring.

Why A is Wrong: Framework alignment establishes the control baseline but does not actively verify that controls remain effective as the system evolves. Frameworks provide structure; monitoring provides assurance.

Why B is Wrong: Security and risk awareness training is an important human capability development activity but does not detect technical changes in AI system behavior. Training does not substitute for technical monitoring.

Why D is Wrong: Periodic compliance reviews occur at scheduled intervals and may miss drift that develops between review cycles. Continuous monitoring provides real-time detection that periodic reviews cannot match.