Isaca ISACA Advanced in AI Risk AAIR Question # 9 Topic 1 Discussion
AAIR Exam Topic 1 Question 9 Discussion:
Question #: 9
Topic #: 1
A business unit must implement and start using an AI system immediately and cannot follow the usual approval process. Which of the following is the BEST course of action?
A.
Refer the issue to the legal department to obtain a single approval covering all AI solutions.
B.
Initiate a pilot program to ensure use of the solution does not increase operational risk.
C.
Obtain approval from the risk owner for an exception to the policy.
D.
Meet with senior leadership and recommend changes to the AI strategy.
Within the ISACA Advanced in AI Risk framework, governance decisions should align AI use with policy, accountability, stakeholder expectations, risk appetite, and applicable legal or ethical obligations. An urgent need does not justify bypassing governance without authorization. A formal exception approved by the risk owner preserves accountability and ensures the deviation, conditions, and residual risk are documented and accepted by the proper authority. This makes option C, Obtain approval from the risk owner for an exception to the policy, the strongest answer. The other choices describe narrower technical, operational, performance, or administrative considerations and do not address the primary risk-management objective in the scenario as directly. A risk practitioner should select the response that most effectively reduces the stated exposure while preserving appropriate oversight, traceability, and alignment with organizational risk tolerance and business requirements.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit