{"id":16859,"date":"2026-09-19T11:49:17","date_gmt":"2026-09-19T11:49:17","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=16859"},"modified":"2026-09-19T11:49:17","modified_gmt":"2026-09-19T11:49:17","slug":"isaca-aaism-practice-test-questions-and-exam-dumps-part7-q121-140","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/isaca-aaism-practice-test-questions-and-exam-dumps-part7-q121-140\/","title":{"rendered":"Isaca AAISM Practice Test Questions and Exam Dumps Part7 Q121-140"},"content":{"rendered":"

<\/h1>\n

View Full <\/b>Isaca AAISM Exam Dumps<\/b><\/a> and Practice Test Dumps<\/b><\/p>\n

 <\/p>\n

Question 121. Which approach best supports an organizational culture for responsible AI governance?<\/b><\/h3>\n
    \n
  1. <\/b> Allow each AI team to define its own governance expectations without coordination<\/span><\/li>\n
  2. <\/b> Establish shared principles, leadership expectations, training, and accountability for responsible AI use<\/span><\/li>\n
  3. <\/b> Focus governance only on systems that have already caused incidents<\/span><\/li>\n
  4. <\/b> Delegate all AI governance responsibilities to the internal audit department<\/span><\/li>\n<\/ol>\n

    Correct Answer: 2. Establish shared principles, leadership expectations, training, and accountability for responsible AI use<\/b><\/p>\n

    Explanation:<\/b><\/p>\n

    A strong AI governance culture requires responsible AI practices to become part of normal organizational behavior rather than remaining an isolated compliance activity. Shared principles provide consistent expectations across departments, while leadership demonstrates that responsible AI is an organizational priority. Training helps employees understand acceptable AI use, risks, escalation procedures, and their responsibilities. Clear accountability ensures that individuals and teams understand who owns decisions and who must address identified issues. Governance should also be reinforced through policies, performance expectations, monitoring, and management communication. Focusing only on incidents is reactive and may allow significant risks to remain undetected. A coordinated culture therefore supports prevention, accountability, and continuous improvement throughout the AI lifecycle.<\/span><\/p>\n

    Question 122. What should occur when an AI risk owner cannot accept the level of residual risk identified during an assessment?<\/b><\/h3>\n
      \n
    1. <\/b> The risk should be automatically transferred to internal audit<\/span><\/li>\n
    2. <\/b> The AI system should always be permanently disabled<\/span><\/li>\n
    3. <\/b> The risk should be escalated through the organization’s defined risk authority and decision process<\/span><\/li>\n
    4. <\/b> The assessment should be deleted and performed again by the development team<\/span><\/li>\n<\/ol>\n

      Correct Answer: 3. The risk should be escalated through the organization’s defined risk authority and decision process<\/b><\/p>\n

      Explanation:<\/b><\/p>\n

      Residual risk represents the level of risk remaining after planned or implemented controls are considered. If the designated risk owner does not have sufficient authority or willingness to accept that residual risk, the issue should follow the organization’s established escalation process. This may involve a higher-level risk owner, governance committee, executive management, or another authorized decision-making body. The purpose is to ensure that risk acceptance is performed by an appropriately accountable person rather than being informally ignored. Internal audit generally provides independent assurance rather than accepting operational risk. Disabling an AI system may sometimes be appropriate, but it should be based on the organization’s risk treatment process rather than being an automatic response.<\/span><\/p>\n

      Question 123. Which control is most appropriate for managing an exception to an established AI governance policy?<\/b><\/h3>\n
        \n
      1. <\/b> Require documented justification, defined scope, approval by an authorized authority, and an expiration or review date<\/span><\/li>\n
      2. <\/b> Permit permanent exceptions whenever a business unit requests them<\/span><\/li>\n
      3. <\/b> Allow developers to approve exceptions for their own systems without documentation<\/span><\/li>\n
      4. <\/b> Remove the underlying policy whenever exceptions become frequent<\/span><\/li>\n<\/ol>\n

        Correct Answer: 1. Require documented justification, defined scope, approval by an authorized authority, and an expiration or review date<\/b><\/p>\n

        Explanation:<\/b><\/p>\n

        AI governance exceptions should be controlled carefully because an exception temporarily permits activity that would otherwise violate an established requirement. A mature exception process normally records the reason for the exception, the affected system or activity, the scope and duration, associated risks, compensating controls, and the person authorized to approve it. An expiration or review date prevents temporary exceptions from becoming permanent weaknesses. Allowing developers or business users to approve their own exceptions can create conflicts of interest and weaken accountability. Frequent exceptions may indicate that the underlying policy needs review, but deleting the policy is not an appropriate governance response. Proper exception management preserves flexibility while maintaining traceability and risk awareness.<\/span><\/p>\n

        Question 124. What is a primary objective of AI portfolio governance?<\/b><\/h3>\n
          \n
        1. <\/b> Ensure every proposed AI initiative receives identical funding<\/span><\/li>\n
        2. <\/b> Prevent business units from developing any AI capabilities independently<\/span><\/li>\n
        3. <\/b> Replace all project-level risk assessments with one enterprise assessment<\/span><\/li>\n
        4. <\/b> Provide oversight across AI initiatives so investments, risks, dependencies, and strategic alignment can be managed collectively<\/span><\/li>\n<\/ol>\n

          Correct Answer: 4. Provide oversight across AI initiatives so investments, risks, dependencies, and strategic alignment can be managed collectively<\/b><\/p>\n

          Explanation:<\/b><\/p>\n

          AI portfolio governance considers AI initiatives as a coordinated collection rather than treating every project as completely independent. Organizations may have multiple AI systems sharing data, infrastructure, vendors, models, business processes, or regulatory obligations. Portfolio-level oversight helps management understand aggregate exposure, duplicated investments, resource conflicts, dependencies, and strategic alignment. It does not eliminate project-level governance; rather, it complements it by providing an enterprise view. Portfolio governance can also help identify initiatives that should be accelerated, redesigned, consolidated, or subjected to additional review based on established organizational criteria. This approach improves transparency and helps ensure that AI investments are managed consistently with business objectives and the organization’s overall risk framework.<\/span><\/p>\n

          Question 125. When prioritizing AI initiatives, which combination of factors should governance consider?<\/b><\/h3>\n
            \n
          1. <\/b> Only the estimated development cost<\/span><\/li>\n
          2. <\/b> Strategic value, expected benefits, risk exposure, regulatory considerations, resources, and dependencies<\/span><\/li>\n
          3. <\/b> Only the number of employees requesting the project<\/span><\/li>\n
          4. <\/b> The technical complexity of the model alone<\/span><\/li>\n<\/ol>\n

            Correct Answer: 2. Strategic value, expected benefits, risk exposure, regulatory considerations, resources, and dependencies<\/b><\/p>\n

            Explanation:<\/b><\/p>\n

            AI initiative prioritization should consider multiple dimensions because technical feasibility or financial cost alone does not provide a complete governance perspective. Strategic value helps determine whether an initiative supports organizational objectives. Expected benefits provide a basis for evaluating potential business outcomes, while risk exposure identifies possible operational, legal, privacy, security, ethical, and reputational consequences. Regulatory considerations may affect timing, design, or approval requirements. Available resources and dependencies determine whether the organization can realistically deliver and operate the initiative. A structured prioritization approach allows decision-makers to compare initiatives consistently and document why resources are allocated. Governance should ensure that high-value opportunities are considered alongside their risks and obligations rather than evaluated solely on development convenience.<\/span><\/p>\n

            Question 126. What is the main governance purpose of aligning AI investment decisions with risk exposure?<\/b><\/h3>\n
              \n
            1. <\/b> To ensure every AI project receives the same security budget<\/span><\/li>\n
            2. <\/b> To eliminate all financial uncertainty from AI programs<\/span><\/li>\n
            3. <\/b> To ensure resources and controls are proportionate to the potential value and risk of the AI initiative<\/span><\/li>\n
            4. <\/b> To allow high-risk projects to bypass governance if their expected return is high<\/span><\/li>\n<\/ol>\n

              Correct Answer: 3. To ensure resources and controls are proportionate to the potential value and risk of the AI initiative<\/b><\/p>\n

              Explanation:<\/b><\/p>\n

              AI investment decisions should account for both anticipated value and potential exposure. A system that processes sensitive information or influences significant decisions may require stronger security, privacy, validation, monitoring, documentation, and oversight than a low-impact internal tool. Risk-based investment helps organizations direct appropriate resources toward controls that address meaningful threats without necessarily applying identical requirements to every AI initiative. This does not mean high expected financial returns justify bypassing governance. Instead, management should understand the risks associated with the expected benefits and decide whether the proposed controls and residual risk are acceptable. Effective governance therefore connects investment planning with risk management so that funding decisions support sustainable and controlled AI adoption.<\/span><\/p>\n

              Question 127. Which risk consideration should be included in an AI business case before approval?<\/b><\/h3>\n
                \n
              1. <\/b> Potential regulatory, privacy, security, operational, model, and third-party risks associated with the proposed use<\/span><\/li>\n
              2. <\/b> Only the model’s training speed<\/span><\/li>\n
              3. <\/b> Only the number of available developers<\/span><\/li>\n
              4. <\/b> Whether the AI vendor has the lowest advertised price<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1. Potential regulatory, privacy, security, operational, model, and third-party risks associated with the proposed use<\/b><\/p>\n

                Explanation:<\/b><\/p>\n

                An AI business case should present decision-makers with a balanced view of expected benefits, costs, assumptions, and risks. AI-specific risks can arise from inaccurate outputs, biased decisions, inappropriate data use, privacy violations, cybersecurity threats, operational dependencies, regulatory obligations, and third-party providers. Considering these issues before approval allows management to determine whether appropriate safeguards can be implemented and whether the expected benefits justify the remaining exposure. Training speed or developer availability may be relevant project considerations, but they do not provide a complete risk picture. Similarly, selecting a vendor solely because of price can overlook contractual, security, privacy, reliability, and dependency concerns. Including material risks in the business case supports informed governance decisions and improves accountability.<\/span><\/p>\n

                Question 128. Which requirement is most important when procuring an external AI service for a high-impact business process?<\/b><\/h3>\n
                  \n
                1. <\/b> The vendor must provide the newest model regardless of business need<\/span><\/li>\n
                2. <\/b> The vendor must offer the lowest subscription price<\/span><\/li>\n
                3. <\/b> The organization should avoid documenting vendor responsibilities<\/span><\/li>\n
                4. <\/b> Procurement should evaluate security, privacy, performance, compliance, transparency, resilience, and contractual responsibilities<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 4. Procurement should evaluate security, privacy, performance, compliance, transparency, resilience, and contractual responsibilities<\/b><\/p>\n

                  Explanation:<\/b><\/p>\n

                  AI procurement introduces risks that may extend beyond the organization’s direct technical environment. A vendor may process organizational data, provide critical model functionality, influence business decisions, or become difficult to replace. Procurement should therefore evaluate security controls, privacy practices, regulatory compliance, performance requirements, resilience, transparency, incident notification, data handling, and contractual responsibilities. For higher-impact systems, organizations should establish clear expectations for testing, monitoring, access control, audit evidence, service availability, and termination arrangements. Lowest price or newest technology does not necessarily represent the most appropriate procurement decision. A risk-based procurement process helps ensure that vendor capabilities and contractual commitments are consistent with the organization’s governance requirements before the service becomes operationally significant.<\/span><\/p>\n

                  Question 129. What evidence is most useful when assessing an AI vendor’s governance and control environment during due diligence?<\/b><\/h3>\n
                    \n
                  1. <\/b> The vendor’s marketing slogan<\/span><\/li>\n
                  2. <\/b> Independent assurance reports, security documentation, relevant certifications, testing evidence, policies, and control descriptions<\/span><\/li>\n
                  3. <\/b> A verbal statement from a sales representative<\/span><\/li>\n
                  4. <\/b> The number of advertisements published by the vendor<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 2. Independent assurance reports, security documentation, relevant certifications, testing evidence, policies, and control descriptions<\/b><\/p>\n

                    Explanation:<\/b><\/p>\n

                    Vendor due diligence should rely on evidence that can substantiate claims about the provider’s governance and controls. Depending on the service and risk level, useful evidence may include independent assurance reports, applicable certifications, security and privacy documentation, testing results, policies, architecture information, control descriptions, incident history, and audit evidence. The organization should evaluate whether the evidence is current, relevant to the contracted service, and sufficient for the identified risks. Marketing material and informal statements may provide useful background but generally do not provide equivalent assurance. Due diligence should also identify gaps and establish contractual or compensating controls where necessary. A documented evidence-based assessment creates a stronger basis for approving, monitoring, or rejecting vendor arrangements.<\/span><\/p>\n

                    Question 130. Why should AI contracts explicitly address ownership and permitted use of organizational data?<\/b><\/h3>\n
                      \n
                    1. <\/b> To prevent unauthorized retention, reuse, disclosure, or training of models using organizational information<\/span><\/li>\n
                    2. <\/b> To guarantee that the vendor will never experience an outage<\/span><\/li>\n
                    3. <\/b> To ensure that every model produces identical results<\/span><\/li>\n
                    4. <\/b> To eliminate the need for data classification<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 1. To prevent unauthorized retention, reuse, disclosure, or training of models using organizational information<\/b><\/p>\n

                      Explanation:<\/b><\/p>\n

                      AI services can introduce uncertainty about how submitted information is stored, processed, retained, reused, or incorporated into model improvement activities. Contracts should therefore establish clear rights and restrictions concerning organizational data. Depending on the use case, provisions may address ownership, permitted processing, retention periods, deletion, secondary use, model training, confidentiality, subcontractors, security controls, breach notification, and return or destruction of information. These requirements help prevent sensitive or proprietary information from being used beyond the organization’s intended purpose. Contractual clarity does not replace technical controls or data classification, but it provides an enforceable governance foundation. For externally hosted AI services, clearly defined data responsibilities are particularly important because the organization may have limited direct control over the provider’s environment.<\/span><\/p>\n

                      Question 131. Which AI service-level requirement is most relevant for a business-critical AI service?<\/b><\/h3>\n
                        \n
                      1. <\/b> The vendor’s marketing response time<\/span><\/li>\n
                      2. <\/b> The number of model parameters advertised<\/span><\/li>\n
                      3. <\/b> Defined availability, performance, incident response, recovery, and service-support commitments<\/span><\/li>\n
                      4. <\/b> The vendor’s preferred programming language<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 3. Defined availability, performance, incident response, recovery, and service-support commitments<\/b><\/p>\n

                        Explanation:<\/b><\/p>\n

                        Business-critical AI services require measurable service expectations because failures can affect important business processes. A service-level agreement can establish requirements for availability, response times, performance, incident notification, support, maintenance, recovery objectives, and escalation procedures. These requirements should reflect the actual business impact of service disruption and may be supported by appropriate service credits or remediation provisions where applicable. Model size or programming language does not establish whether the service can reliably support business operations. Service-level requirements should also be consistent with business continuity and resilience planning. By defining measurable expectations before deployment, organizations can monitor provider performance, identify breaches, and establish clear responsibilities for responding to operational problems.<\/span><\/p>\n

                        Question 132. What should an organization establish before relying on a third-party AI provider for a critical capability?<\/b><\/h3>\n
                          \n
                        1. <\/b> An exit strategy covering data retrieval, migration, replacement options, contractual termination, and operational transition<\/span><\/li>\n
                        2. <\/b> A requirement to use the vendor indefinitely<\/span><\/li>\n
                        3. <\/b> A prohibition against documenting alternative providers<\/span><\/li>\n
                        4. <\/b> A policy allowing the vendor to determine the organization’s retention requirements<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 1. An exit strategy covering data retrieval, migration, replacement options, contractual termination, and operational transition<\/b><\/p>\n

                          Explanation:<\/b><\/p>\n

                          An exit strategy reduces dependency risk when an organization relies on an external AI provider. It should consider how organizational data can be retrieved or transferred, how models or configurations can be replaced where possible, what alternative services are available, how contractual termination will operate, and how business processes will continue during transition. The organization should understand technical and contractual limitations before becoming dependent on the provider. Exit planning is particularly important for critical AI capabilities because abrupt provider failure, unacceptable service performance, regulatory changes, pricing changes, or strategic decisions could require migration. Establishing an exit strategy does not imply that the organization expects immediate termination; it ensures that continued use remains a controlled business decision rather than an unavoidable dependency.<\/span><\/p>\n

                          Question 133. Which condition is a common indicator of AI vendor lock-in risk?<\/b><\/h3>\n
                            \n
                          1. <\/b> The organization has documented multiple alternative providers<\/span><\/li>\n
                          2. <\/b> The provider supports standardized export formats<\/span><\/li>\n
                          3. <\/b> The contract clearly defines data portability and termination assistance<\/span><\/li>\n
                          4. <\/b> Migration would require substantial redevelopment because proprietary interfaces, formats, or model dependencies are difficult to replace<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 4. Migration would require substantial redevelopment because proprietary interfaces, formats, or model dependencies are difficult to replace<\/b><\/p>\n

                            Explanation:<\/b><\/p>\n

                            Vendor lock-in occurs when switching providers becomes difficult, costly, or operationally disruptive because the organization has become heavily dependent on proprietary capabilities. In AI environments, lock-in can arise from proprietary APIs, unique data formats, specialized model configurations, embedded workflows, unavailable model portability, or extensive integration with vendor-specific services. Strong portability provisions, standardized interfaces, documented alternatives, and exit assistance can reduce this exposure. Lock-in should be considered during procurement rather than only after the organization becomes dependent on a provider. Governance teams can assess migration complexity, switching costs, data portability, technical dependencies, and market alternatives as part of third-party risk management. Identifying these factors early allows management to make better-informed sourcing and architecture decisions.<\/span><\/p>\n

                            Question 134. What governance issue should be considered when an organization incorporates an open-source AI model into a production system?<\/b><\/h3>\n
                              \n
                            1. <\/b> Only whether the model can run on existing hardware<\/span><\/li>\n
                            2. <\/b> Licensing, provenance, security, maintenance, support, vulnerabilities, and compliance requirements<\/span><\/li>\n
                            3. <\/b> Whether the model has the largest possible parameter count<\/span><\/li>\n
                            4. <\/b> Whether the source code contains comments<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 2. Licensing, provenance, security, maintenance, support, vulnerabilities, and compliance requirements<\/b><\/p>\n

                              Explanation:<\/b><\/p>\n

                              Open-source AI components can provide significant flexibility, but their use introduces governance considerations that should be evaluated before production deployment. Organizations should understand the applicable license and any restrictions concerning modification, redistribution, commercial use, or attribution. Provenance is also important because the organization should know where components originated and whether dependencies can be trusted. Security risks may arise from vulnerable libraries, compromised packages, malicious modifications, or inadequate maintenance. Governance should also consider support availability, update practices, model limitations, data requirements, and applicable compliance obligations. Open-source status does not automatically mean that a component is risk-free or unrestricted. A documented assessment helps determine whether the component can be safely incorporated into the organization’s controlled AI environment.<\/span><\/p>\n

                              Question 135. Why should AI governance address licensing risks for third-party models, datasets, and software components?<\/b><\/h3>\n
                                \n
                              1. <\/b> Licensing determines whether the organization may use, modify, distribute, or commercialize certain components under specified conditions<\/span><\/li>\n
                              2. <\/b> Licensing guarantees model accuracy<\/span><\/li>\n
                              3. <\/b> Licensing eliminates cybersecurity vulnerabilities<\/span><\/li>\n
                              4. <\/b> Licensing determines the model’s computational speed<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1. Licensing determines whether the organization may use, modify, distribute, or commercialize certain components under specified conditions<\/b><\/p>\n

                                Explanation:<\/b><\/p>\n

                                AI solutions can depend on many third-party components, including pretrained models, datasets, libraries, frameworks, and other software. Each component may have licensing terms that impose specific obligations or restrictions. Depending on the license, an organization may need to provide attribution, preserve notices, disclose modifications, comply with distribution conditions, or restrict certain uses. Failure to understand licensing requirements can create legal and operational exposure, especially when AI systems are commercialized or distributed externally. Governance should therefore include processes for identifying component provenance, recording applicable licenses, assessing compatibility, and obtaining appropriate approvals when necessary. Licensing does not determine whether an AI model is accurate or secure, but it is an important part of responsible component management and technology risk governance.<\/span><\/p>\n

                                Question 136. Which governance practice best addresses intellectual-property risk associated with AI-generated or AI-assisted outputs?<\/b><\/h3>\n
                                  \n
                                1. <\/b> Assume that every AI-generated output automatically belongs to the organization<\/span><\/li>\n
                                2. <\/b> Permit employees to submit confidential third-party material to any public AI service<\/span><\/li>\n
                                3. <\/b> Establish rules for approved inputs, ownership assessment, human review, provenance, and permitted use of AI-generated content<\/span><\/li>\n
                                4. <\/b> Ignore intellectual-property considerations unless litigation occurs<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 3. Establish rules for approved inputs, ownership assessment, human review, provenance, and permitted use of AI-generated content<\/b><\/p>\n

                                  Explanation:<\/b><\/p>\n

                                  AI-generated and AI-assisted content can create intellectual-property questions concerning both inputs and outputs. Organizations should establish acceptable-use rules that address what information employees may submit to AI systems, particularly when the information belongs to the organization or another party. Output governance may require human review, provenance records, verification, and assessment of whether content can be used for the intended purpose. Depending on the jurisdiction, contractual terms, source material, and nature of the output, ownership and rights may not always be straightforward. Organizations should avoid assuming that every AI-generated result can automatically be treated as unrestricted corporate property. A structured governance process helps reduce legal exposure and provides employees with practical expectations for responsible AI-assisted content creation.<\/span><\/p>\n

                                  Question 137. In an AI system that processes personal information, why should governance address data-subject rights and privacy requests?<\/b><\/h3>\n
                                    \n
                                  1. <\/b> Privacy requests are unrelated to AI because models are automated<\/span><\/li>\n
                                  2. <\/b> Governance should ensure that applicable rights can be identified, assessed, and handled through defined processes<\/span><\/li>\n
                                  3. <\/b> AI systems automatically satisfy every privacy obligation<\/span><\/li>\n
                                  4. <\/b> Data-subject requests should always be rejected when a model is involved<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 2. Governance should ensure that applicable rights can be identified, assessed, and handled through defined processes<\/b><\/p>\n

                                    Explanation:<\/b><\/p>\n

                                    AI systems that process personal information may be subject to privacy obligations concerning individuals’ rights, depending on the applicable law, jurisdiction, data type, and processing activity. Governance should therefore establish processes for identifying relevant requests, determining whether a particular right applies, locating affected information where feasible, documenting decisions, and completing required responses within applicable requirements. AI can complicate these processes because personal information may exist in source datasets, prompts, logs, outputs, or other system components. Organizations should understand the limitations of their technical architecture and establish appropriate procedures rather than assuming that automation removes privacy responsibilities. Effective governance connects privacy requirements with data inventories, retention practices, system documentation, access controls, and responsible personnel.<\/span><\/p>\n

                                    Question 138. What is the primary governance purpose of maintaining reliable records and evidence for AI systems?<\/b><\/h3>\n
                                      \n
                                    1. <\/b> To increase the number of documents stored regardless of usefulness<\/span><\/li>\n
                                    2. <\/b> To replace all operational monitoring<\/span><\/li>\n
                                    3. <\/b> To ensure developers can avoid accountability for system decisions<\/span><\/li>\n
                                    4. <\/b> To provide traceability and evidence of decisions, approvals, assessments, controls, changes, and compliance activities<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 4. To provide traceability and evidence of decisions, approvals, assessments, controls, changes, and compliance activities<\/b><\/p>\n

                                      Explanation:<\/b><\/p>\n

                                      AI governance depends on reliable records because organizations may need to demonstrate how systems were approved, assessed, changed, monitored, and controlled. Governance evidence can include risk assessments, impact assessments, approval records, model documentation, testing results, exception approvals, monitoring reports, incident records, vendor assessments, and relevant audit trails. These records support accountability and make it easier to investigate issues or demonstrate compliance. Record management should consider accuracy, integrity, access restrictions, retention requirements, and appropriate disposal. Keeping every possible piece of information indefinitely is not the objective. Instead, organizations should retain relevant evidence for an appropriate period and ensure that it remains trustworthy and retrievable when management, auditors, regulators, or other authorized stakeholders require it.<\/span><\/p>\n

                                      Question 139. Which approach is most effective for communicating AI governance requirements to different stakeholder groups?<\/b><\/h3>\n
                                        \n
                                      1. <\/b> Provide every stakeholder with identical technical documentation<\/span><\/li>\n
                                      2. <\/b> Communicate only after an AI incident occurs<\/span><\/li>\n
                                      3. <\/b> Tailor governance communication to stakeholder responsibilities, decision needs, risk exposure, and level of technical knowledge<\/span><\/li>\n
                                      4. <\/b> Restrict governance information to the AI development team<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 3. Tailor governance communication to stakeholder responsibilities, decision needs, risk exposure, and level of technical knowledge<\/b><\/p>\n

                                        Explanation:<\/b><\/p>\n

                                        AI governance communication is most effective when information is relevant to the audience receiving it. Board members and senior executives may need concise information about strategic alignment, significant risks, regulatory exposure, investment, and major decisions. Business owners may require information about performance, responsibilities, controls, and operational risks. Technical teams may need detailed requirements involving security, testing, model behavior, data handling, and monitoring. Legal, privacy, compliance, and audit functions may require evidence supporting their specific responsibilities. Providing identical technical material to everyone can reduce understanding rather than improve it. A stakeholder-focused communication approach improves accountability because people receive information that helps them perform their governance responsibilities and make appropriately informed decisions.<\/span><\/p>\n

                                        Question 140. Which information is most appropriate for a board-level AI governance report?<\/b><\/h3>\n
                                          \n
                                        1. <\/b> Detailed source-code debugging results for every AI model<\/span><\/li>\n
                                        2. <\/b> Strategic objectives, significant AI risks, regulatory exposure, major incidents, governance performance, and management actions<\/span><\/li>\n
                                        3. <\/b> Individual developer coding preferences<\/span><\/li>\n
                                        4. <\/b> Every low-level model parameter used by operational systems<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 2. Strategic objectives, significant AI risks, regulatory exposure, major incidents, governance performance, and management actions<\/b><\/p>\n

                                          Explanation:<\/b><\/p>\n

                                          Board-level AI reporting should focus on information that supports oversight and strategic decision-making rather than overwhelming directors with technical implementation details. Appropriate reporting may include alignment between AI initiatives and organizational strategy, significant risk exposures, material regulatory developments, major incidents, important third-party dependencies, governance performance indicators, unresolved high-level issues, and management’s planned responses. The level of detail should allow the board to understand whether significant risks are being identified and managed within approved expectations. Technical metrics can be included when they materially affect business or risk outcomes, but routine source-code details and individual developer preferences are generally operational matters. Effective board reporting creates visibility into material AI risks, accountability, and management actions without replacing operational governance.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Isaca AAISM Exam Dumps and Practice Test Dumps   Question 121. Which approach best supports an organizational culture for responsible AI governance? Allow each AI team to define its own governance expectations without coordination Establish shared principles, leadership expectations, training, and accountability for responsible AI use Focus governance only on systems that have […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/16859"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=16859"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/16859\/revisions"}],"predecessor-version":[{"id":16930,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/16859\/revisions\/16930"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=16859"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=16859"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=16859"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}