Try 12 free ISACA AAIA practice questions

Answer: B. AI-based document repositories depend on properly classified data to enforce appropriate access controls, protection requirements, and compliance obligations across the AI lifecycle. Data classification is foundational: it determines how data is handled, who can access it, how long it must be retained, and what regulatory obligations apply. An IS auditor reviewing the governance update would look first at whether a robust classification scheme is in place before assessing downstream controls.

• A: Retention policy is important but is subordinate to classification, which determines the rules that retention policies then apply to specific data categories.
• C: Data enrichment is a technique for improving data quality and utility; it is not a governance priority when the core concern is ensuring proper handling and protection of existing documents.
• D: Qualitative data collection is a research methodology concept unrelated to the governance framework adjustments triggered by an AI repository deployment.

Answer: A. Decreased accuracy for specific population groups is a classic symptom of training data that underrepresents those groups, producing a biased model. Retraining with a more representative dataset directly corrects the source of the disparity by ensuring the model learns patterns applicable across all relevant populations. An AI auditor evaluating this system would expect the organization to remediate bias at its root cause, which is the data, rather than masking it through anonymization or tuning unrelated parameters.

• B: Synthetic data generation can introduce its own distributional biases and does not guarantee demographic coverage; replacing all real data discards valid signal without addressing the representativeness problem.
• C: Hyperparameter optimization adjusts model configuration but does not change what the model learned from imbalanced training data; it treats a symptom rather than the cause.
• D: Anonymizing demographic identifiers reduces transparency and may make bias harder to detect and audit; it does not make the underlying data more representative.

Answer: C. ROUGE measures the quality of text generation by comparing a model's output against reference summaries using recall-based overlap of n-grams and sequences. It is the standard evaluation metric for NLP tasks such as summarization and translation, directly addressing output reliability for the document summarization use case. An IS auditor recommending KPIs for an NLP system should select metrics aligned to the modality and task type.

• A: Landmark localization error is a computer vision metric used to evaluate the positional accuracy of features in images; it has no applicability to text-based NLP models.
• B: The ROC curve measures binary classification model performance by plotting true positive rate against false positive rate; it is not applicable to generative or summarization tasks.
• D: Mean squared error measures the average squared difference between predicted and actual numerical values; it is suited to regression models, not text generation quality assessment.