Isaca ISACA Advanced in AI Risk AAIR Question # 1 Topic 1 Discussion
AAIR Exam Topic 1 Question 1 Discussion:
Question #: 1
Topic #: 1
A risk practitioner is assessing risk in a newly implemented AI system integrated into an organization's business processes. Which of the following is the MOST important consideration for the risk practitioner?
A.
Escalation and approval protocols for AI mitigation measures
B.
Level of existing business process automation prior to AI adoption
C.
AI expertise within the organization's risk management function
D.
Criticality and impact of decision-making driven by the AI system
AI risk assessment must be calibrated to the potential consequences of AI-driven decisions. The criticality and impact of AI-driven decisions directly determine the magnitude of risk exposure and the appropriate level of risk treatment.
Why D is Correct: According to ISACA AAIR principles, the most fundamental risk assessment consideration is the nature and impact of decisions driven by the AI system. Systems making high-stakes decisions—affecting employment, credit, healthcare, or public safety—carry significantly greater risk than those supporting low-impact tasks. Understanding decision criticality frames all other risk assessment activities and drives proportionate control selection.
Why A is Wrong: Escalation protocols are governance process elements that should be designed after understanding the risk profile. They are outputs of risk assessment, not inputs to the primary assessment consideration.
Why B is Wrong: Prior automation levels provide contextual background but do not determine the risk profile of the new AI system. The relevant risk driver is forward-looking, not historical.
Why C is Wrong: Internal expertise levels affect assessment capability but represent an organizational constraint rather than the primary risk consideration. The risk lies in the system's potential impact, not in who assesses it.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit