AAIA Practice Questions

This statement is false. While HITL is a crucial control, it does not eliminate accountability issues. Humans can suffer from 'automation bias,' where they overly trust the AI's recommendation and approve it without proper scrutiny. This can lead to a diffusion of responsibility, where it's unclear whether the AI or the human is accountable for a bad outcome. Therefore, HITL mitigates but does not eliminate accountability risk.

Process mining directly analyzes vast amounts of data (event logs) to provide objective evidence about how processes actually operate, including deviations from the designed workflow. This allows auditors to test controls on the entire population of transactions and gather strong evidence of control effectiveness or failures. It is a powerful tool for the evidence collection and testing phase.

The most effective control is to eliminate the need to use raw production data in non-production environments. By establishing a process to provide data scientists with high-quality, statistically representative data that has been properly anonymized, masked, or synthetically generated, the organization can mitigate privacy and security risks while still enabling effective model development.

The board's primary responsibility is governance and strategic oversight. To be effective, audit findings must be communicated in the language of business risk. The auditor should explain how a technical issue (e.g., model bias) could lead to tangible business consequences (e.g., lawsuits, fines, customer churn, or reputational damage).

The greatest challenge for an auditor is that ethical principles are abstract. To audit them, they must be translated into specific, testable control objectives. For example, 'fairness' must be defined with specific metrics (e.g., demographic parity, equalized odds), and 'transparency' must be linked to concrete deliverables like model cards or explainability reports. Without this operationalization, the principles are not auditable.

The most critical risk is the potential for unauthorized and malicious changes to the trading algorithm's logic. Given the direct financial implications of an algorithmic trading model, an undetected modification could trigger erroneous trades, leading to immediate and substantial financial losses. This represents a direct and high-impact operational risk.

Even when protected attributes like race or gender are removed, other features (proxies) can be highly correlated with them. For example, ZIP codes, income levels, or certain types of employment can inadvertently act as proxies for demographic groups, allowing the model to learn and perpetuate historical biases present in the data.

The data processing agreement (DPA) and terms of service are legally binding documents that outline how the vendor will handle the organization's data, including data ownership, usage rights, security controls, and compliance with privacy regulations like GDPR. This is a primary source of evidence for assessing privacy risk.

A crucial internal control to mitigate third-party privacy risk is to minimize the data shared. Verifying that the organization has a process to scrub PII before sending data to the vendor's service directly reduces the risk of a data breach or misuse of customer PII by the third party.

AI systems introduce unique failure modes not found in traditional IT systems. These include model drift, performance degradation, generation of harmful or biased outputs, and adversarial attacks. An effective incident response plan must include specific playbooks for identifying, containing (e.g., taking the model offline, reverting to a previous version), and remediating these AI-specific incidents.

According to standard audit practices, the first step in planning any audit is to understand the context: what the system is supposed to achieve (business objectives) and what could go wrong (high-level risks). For a generative AI chatbot, risks include reputational damage from inappropriate responses, data leakage, and inaccurate information. This understanding drives the entire audit scope and approach.