Free AAIA Quick Start: 10 Mixed Practice Questions

This diagnostic includes AI Governance and Risk, AI Operations, and AI Auditing Tools and Techniques. FlashGenius readiness results are guidance, not official ISACA passing scores.

Review all AAIA domains or begin the interactive quick-start test.

Quick-start questions with answers

Sample Question 1 — AI Auditing Tools and Techniques

A health services organization uses AI for care routing recommendations. Management states that all model and configuration changes flow through a model registry and approved deployment pipeline. During sample testing, the auditor finds one production configuration that differs from the latest approved registry entry; the team explains it was a temporary urgent adjustment. What should the auditor evaluate FIRST?

  1. A. Whether production versions reconcile to approved registry and deployment records. (Correct answer)
  2. B. Whether post-deployment monitoring detected issues from the urgent adjustment.
  3. C. Whether the emergency change procedure allows temporary configuration changes.
  4. D. Whether the model owner accepted residual risk for manual deployment.

Correct answer: A

Explanation: A is the best first step because the key audit question is whether actual production states can be traced to approved change records. That reconciliation directly tests the operating effectiveness of the change control and helps determine whether the observed mismatch is isolated or indicates a broader control failure. B is relevant to impact assessment, but monitoring after deployment does not compensate for a potentially unauthorized or unreconciled change. C is also plausible, especially given the urgent-adjustment explanation, but the auditor should first establish the factual extent of unreconciled production changes before relying on the existence of an emergency process. D may become relevant later, yet risk acceptance does not prove the change was properly approved, recorded, and deployed through controlled processes.

Sample Question 2 — AI Governance and Risk

A consumer lender uses an AI-assisted credit decision support model. The organization has defined monitoring thresholds, weekly dashboards, and monthly risk committee reporting. Monitoring reports show three consecutive weeks of fairness threshold breaches for one applicant segment. Committee minutes state the trend is under review, but there is no documented exception approval, escalation ticket closure, or interim risk response. Which evidence BEST supports the conclusion that monitoring controls are ineffective?

  1. A. Weekly dashboards showing fairness metrics were produced for review periods.
  2. B. System alerts mapped to tickets lacking timely closure evidence. (Correct answer)
  3. C. Risk committee minutes noting the segment trend was under review.
  4. D. Management attestations stating monitoring occurred according to schedule.

Correct answer: B

Explanation: B is correct because it ties the defined threshold breach to the escalation process and shows that required follow-up was not completed in a timely, traceable way. That is the strongest evidence that the monitoring control did not operate effectively. A shows reporting existed, but dashboards alone do not prove action. C shows management awareness, but discussion without documented response or approval is insufficient. D is high-level attestation and does not substantiate that repeated breaches were escalated and resolved according to control requirements.

Sample Question 3 — AI Operations

A retail bank uses an AI model to prioritize suspicious transactions for analyst review. Input drift alerts exceeded approved thresholds for three consecutive weeks. Portfolio-level false-positive rates remained stable, but complaints increased in one customer segment. The model risk team states it is collecting additional data before deciding whether to act. What is the PRIMARY audit concern?

  1. A. Portfolio-level reporting may obscure segment-level customer impact.
  2. B. The monitoring threshold may have been set too conservatively.
  3. C. Repeated threshold breaches lack documented review and escalation. (Correct answer)
  4. D. Additional observation periods may delay model performance tuning.

Correct answer: C

Explanation: C is correct because approved monitoring thresholds were breached repeatedly, yet there is no evidence of documented investigation, escalation, or management action. That indicates the monitoring control is not operating effectively. A is a meaningful risk indicator, but it is secondary to the core control failure that alerts did not trigger governed response. B is unsupported because the issue is not that thresholds are too sensitive; it is that breaches were not handled. D points to a possible consequence, but the audit concern is failed escalation and review, not delayed tuning.

Sample Question 4 — AI Governance and Risk

A global insurer maintains a central AI inventory listing 24 AI systems. Management provides an annual completeness attestation from business owners. During the audit, procurement records show 31 subscriptions tagged as AI-enabled, and platform usage logs show active users in business units not represented in the inventory. Which evidence BEST supports the conclusion that the AI inventory control is not operating effectively?

  1. A. Annual business attestations stating that registered AI systems are complete.
  2. B. Inventory records showing assigned owners and risk ratings for entries.
  3. C. Reconciliation exceptions showing active AI subscriptions missing from inventory. (Correct answer)
  4. D. Committee minutes discussing possible shadow AI use by business units.

Correct answer: C

Explanation: C is correct because reconciliation exceptions provide independent evidence that active AI-enabled services exist outside the inventory, directly demonstrating a failure in completeness monitoring and operating effectiveness. A is weaker because attestation is management representation, not independent validation. B supports the quality of items already in the register, but it does not address whether the register is complete. D shows awareness of possible shadow AI risk, but discussion alone is less persuasive than documented exceptions proving omissions.

Sample Question 5 — AI Auditing Tools and Techniques

An internal audit team used an AI-assisted document review tool to classify thousands of vendor contracts for third-party AI risk. The tool reported a high classification accuracy during a pilot, but some contracts were excluded because of unreadable scans and unsupported file types. Management wants the audit team to use the tool output to define the high-risk vendor population. What should the auditor evaluate FIRST?

  1. A. Whether processed contracts reconcile to the repository and exclusions were resolved (Correct answer)
  2. B. Whether the pilot accuracy rate was approved by the audit methodology owner
  3. C. Whether reviewers documented their conclusions for a sample of high-risk contracts
  4. D. Whether the tool configuration changes were reviewed before fieldwork began

Correct answer: A

Explanation: A is best because the auditor must first determine whether the AI-assisted output represents a complete and reliable population before using it for scoping or sample selection. Reconciling processed contracts to the source repository and resolving exclusions addresses the primary risk that high-risk vendors were omitted. B is relevant to tool governance, C to review documentation, and D to change control, but none of those directly establish population completeness for audit reliance.

Sample Question 6 — AI Operations

A retail bank deployed an updated AI credit-risk scoring model before a seasonal lending campaign. The change ticket exists, but independent validation sign-off was dated after production deployment. Management states the release was urgent and that early default-rate indicators improved. What should the auditor evaluate FIRST?

  1. A. Whether the deployment was linked to documented approval and exception handling before release (Correct answer)
  2. B. Whether post-release portfolio metrics indicate improved model performance after deployment
  3. C. Whether the model repository contains release notes for the deployed model version
  4. D. Whether the rollback procedure was referenced in the release planning materials

Correct answer: A

Explanation: A is best because the first audit priority is to confirm whether the model was authorized for production or released under a documented exception before deployment. Without that evidence, accountability and control operation are unproven. B is wrong because improved outcomes do not substitute for pre-release authorization. C is wrong because release notes support traceability, not approval. D is wrong because rollback readiness is relevant, but it is secondary to whether the release was properly authorized.

Sample Question 7 — AI Operations

An insurer uses a claims triage model fed by several source systems. One upstream claims application was recently upgraded, and management states there were no visible outages. The auditor needs to conclude whether production input data completeness and schema-change controls are operating effectively. Which evidence BEST supports the conclusion?

  1. A. Approved lineage diagrams showing source systems mapped to model features.
  2. B. System reconciliations and exception logs around the source upgrade. (Correct answer)
  3. C. A management attestation that feed issues are usually detected quickly.
  4. D. Business reports showing claim processing volumes remained stable.

Correct answer: B

Explanation: B is correct because reconciliations and exception logs provide direct, traceable evidence that completeness checks and exception handling operated during the upstream change. A shows intended design, but not whether the control worked after the upgrade. C is weaker because it is only management assurance, not operating evidence. D reflects business throughput, which could remain stable even if data fields were missing, altered, or mis-mapped for the model.

Sample Question 8 — AI Governance and Risk

A lender uses AI-generated risk summaries to support credit analysts reviewing small business loan applications. The procedure states that analysts make the final decision and must escalate cases when specified risk indicators appear. Management reports a low complaint rate and states that analysts can override AI-generated recommendations. Which evidence BEST supports the conclusion that human oversight is operating effectively?

  1. A. Sampled case records showing analyst rationale, documented overrides, and escalations consistent with defined criteria. (Correct answer)
  2. B. Training completion records showing analysts acknowledged procedures for review, override, and escalation.
  3. C. Management reports showing low complaint volumes and stable approval rates after AI deployment.
  4. D. Workflow configuration records showing analysts have system permissions to override AI recommendations.

Correct answer: A

Explanation: A is best because it provides direct, case-level evidence that reviewers exercised judgment and followed escalation criteria in actual decisions. For operating effectiveness, documented execution of the control is stronger than evidence that staff were trained, outcomes were favorable, or system functionality existed. The key distinction is between the presence of an oversight capability and evidence that meaningful oversight occurred. Why the other options are weaker: B) Training records support control readiness more than operating effectiveness; training does not prove analysts actually challenged or escalated AI outputs. C) Outcome metrics like complaints and approval rates are useful contextual evidence but indirect — they may not reveal whether the required human review control operated. D) Permission to override supports control design or system capability, but it does not demonstrate that analysts performed meaningful oversight.

Sample Question 9 — AI Auditing Tools and Techniques

An internal audit department at a multinational manufacturer uses an AI tool to summarize third-party contract clauses and flag unusual terms during procurement audits. Engagement teams report improved coverage, but there is no formal validation of the tool, and human spot-checks are inconsistently documented. Which recommendation is MOST appropriate?

  1. A. Require documented validation and use criteria before relying on outputs. (Correct answer)
  2. B. Expand tool use only for low-risk clauses until accuracy improves.
  3. C. Obtain vendor accuracy reports before including results in workpapers.
  4. D. Increase reviewer spot-checking for contracts flagged as unusual.

Correct answer: A

Explanation: A is the best recommendation because the core audit issue is unsupported reliance on AI-generated output. Before the audit function uses those outputs as evidence or risk indicators, it should establish documented validation, permitted use, and reliance criteria. B may reduce exposure, but it does not address the absence of validation or define when outputs are trustworthy enough to support audit conclusions. C could provide supplemental information, yet vendor claims are not a substitute for validation in the audit function's own use context. D is also plausible because human review can mitigate risk, but spot-checking alone is insufficient when it is informal and inconsistently documented; it does not replace a governed validation framework.

Sample Question 10 — AI Operations

A consumer lender uses an AI tool to prioritize loan applications for manual underwriting review. Policy requires human review for borderline model scores. Training states that underwriters remain accountable, but sampled workflow logs show some cases moved from AI recommendation to final decision without reviewer comments. Managers state that comments are sometimes retained outside the workflow. Which control deficiency is MOST significant?

  1. A. Training materials assign accountability but are not recently refreshed.
  2. B. Override rates are low and not benchmarked across underwriting teams.
  3. C. Workflow logs show final decisions without required review evidence. (Correct answer)
  4. D. Productivity incentives may discourage detailed reviewer comments.

Correct answer: C

Explanation: C is correct because the policy requires human review, and workflow logs are the strongest evidence of whether that control actually operated. If final decisions are recorded without required review evidence, the control is not operating effectively. A is incorrect because training currency is secondary when required reviews cannot be demonstrated. B is incorrect because low override rates may warrant analysis but do not prove that review occurred. D is incorrect because incentives may contribute to the issue, but they are less direct evidence than missing workflow records.

AAIA Practice Test FAQs

What is the ISACA Advanced in AI Audit (AAIA) exam?

AAIA is an ISACA certification exam focused on auditing artificial intelligence systems. It covers AI governance and risk, AI operations, and AI auditing tools and techniques.

How many questions and how much time does the AAIA exam have?

The AAIA exam configuration is 90 questions in 150 minutes across three domains.

What score is required for AAIA?

ISACA uses a scaled score, with 450 on an 800-point scale listed as the passing score in the exam configuration. Practice-test percentages are not equivalent to an official ISACA scaled score.

How should I use AAIA practice questions?

Use mixed questions to find broad knowledge gaps, then use domain practice to review the concepts and explanations behind incorrect answers. FlashGenius readiness thresholds are study guidance, not official ISACA passing scores.

Which AAIA domain has the greatest weight?

AI Operations has the largest listed weight at 46%, followed by AI Governance and Risk at 33% and AI Auditing Tools and Techniques at 21%.

Explore AAIA Tests