Pass the Isaca Advanced in AI Audit AAIA Questions and answers with CertsForce

Predictive analytics is the most effective method for identifying high-risk transactions because it uses statistical models, anomaly detection, and machine learning to:

Rank transactions by inherent and residual risk

Detect hidden patterns that auditors cannot manually identify

Highlight unusual transaction profiles, outliers, and red flags

Prioritize transactions that require deeper inspection

AAIA’s audit domain emphasizes risk-based sampling enhanced by AI , where predictive models significantly improve coverage and accuracy.

NLP (A) extracts insights from text—not ideal for transaction risk scoring.

OCR (B) digitizes documents but does not identify risk.

Rule-based analytics (C) only catches known patterns; predictive analytics uncovers unknown or emerging risks .

When generative AI produces generic or " vague " summaries, it is often because it lacks the specific context of the meeting. " Prompt engineering and contextual anchoring " involve providing the AI with clear instructions (e.g., " focus on control exceptions " ) and anchoring the request in specific data (e.g., " refer only to the attached meeting transcript " ). According to ISACA, this technique directs the model ' s attention and reduces the likelihood of hallucinations or omissions. Increasing " temperature " (Option A) would actually make the model more random and less reliable. Anchoring ensures the AI stays grounded in the actual facts of the audit walkthrough.

The most objective evidence of bias control is " Performance Parity " . If the accuracy, precision, and recall are " Similar across various demographic groups, " it demonstrates that the model is functioning equitably for all users. While having a policy definition (Option B) is good governance, it doesn ' t prove the model is fair in practice. Restricting training to " Real-world human decisions " (Option C) often introduces bias, as it simply automates historical human discrimination. Transparency (Option D) is necessary for auditing but does not, on its own, prevent a model from being biased.

In machine learning, " Data Typing " is foundational. If a numerical field (like Grade Percent) is stored as an " Object " (string/text), the AI model cannot perform mathematical operations on it, such as calculating correlations or averages. According to the AAIA™ manual, this is a " Data Quality " failure that leads to " Feature Exclusion, " where the model simply ignores the variable or treats each number as a unique text label, losing all quantitative meaning. The other formats (Integer, Float, Boolean) are appropriate for their respective data types.

Natural Language Processing (NLP) is the specific branch of AI focused on the interaction between computers and human language. For tasks involving the review, summarization, and extraction of insights from unstructured text documents like legal contracts, NLP is the most suitable technology. It allows the system to understand semantic meaning, identify clauses, and detect inconsistencies within a legal context. While NLP often utilizes Deep Learning (Option A) and Neural Networks (Option B), those are the underlying " architectures, " whereas NLP is the specialized " application " required for document analysis. ML (Option D) is a broad category that includes NLP but lacks the specificity required for linguistic processing.

Periodic monitoring is the MOST critical governance mechanism for protecting privacy and data security in AI systems, especially those handling sensitive or personal data. ISACA’s AAIA guidance emphasizes that data governance must be continuous because AI systems evolve, data drifts, risk exposures shift, and privacy threats increase over time.

Periodic monitoring ensures:

Detection of unauthorized access

Identification of anomalous data use

Confirmation that privacy controls remain effective

Early detection of data misclassification or leakage

Verification of compliance with retention, deletion, and minimization requirements

Options A and C do not protect privacy. Acceptable use policies (B) provide guidelines but do not enforce ongoing protection. Continuous monitoring is the operational safeguard that enforces privacy and security controls at all times.

False positives in fraud detection AI systems often stem from poorly optimized hyperparameters. Hyperparameters control aspects of the model’s learning process such as the learning rate, decision thresholds, and complexity penalties. When these parameters are not tuned correctly, the model can become overly sensitive and flag normal behavior as suspicious, leading to customer complaints.

“Hyperparameter tuning is essential to balance sensitivity and specificity in AI models. Improper tuning can result in a high rate of false positives or negatives, particularly in systems like fraud detection that require nuanced pattern recognition.”

Options A and B relate to data governance but do not directly cause false positives in predictions. Option C (compute scale training) may affect model efficiency, not accuracy. Thus, D is the most appropriate answer.

AI models are not " static " systems; they are reflections of the data they were trained on. In dynamic environments, data patterns change constantly (e.g., market trends or new fraud tactics). Frequent testing and retraining ensure the model is " updated with current data, " which prevents performance degradation and " data drift. " While testing can assess attacks (Option A), the primary operational reason for a recurring retraining schedule is to maintain the model ' s relevance and accuracy against the most recent real-world behaviors.

Precision measures the proportion of positive predictions that were actually correct. When avoiding false positives is the priority (e.g., fraud accusations, security alerts, loan denials), precision is the critical metric because:

High precision = very few false positives

Low precision = many false positives

AAIA stresses using appropriate performance metrics depending on risk context.

Accuracy (B) can mask imbalances.

Recall (D) relates to false negatives.

F1 (C) balances precision and recall but does not emphasize false positives specifically.

Supervised learning is a foundational type of machine learning in which the model is trained on a labeled dataset. According to the AAIA™ Study Guide, labeled data includes input features along with the correct output, enabling the model to learn the mapping function accurately.

“In supervised learning, models learn from input-output pairs provided in the training data. This method enables predictive modeling tasks such as classification and regression.”

Unlabeled data (A) is used in unsupervised learning; clustered data (B) is a technique rather than a data type; and randomized data (D) refers to distribution strategy, not labeling. Hence, labeled data is the correct answer.