ISACA Advanced in AI Audit (AAIA) practice questions.

An auditor is scoping an AI audit for a high-risk AI system used to triage insurance claims. The auditee follows ISO/IEC 42001. Which evidence artifact best demonstrates that the auditee has met ISO/IEC 42001's planning requirement (clause 6) for AI risks and opportunities?

An auditor is sampling decisions made by a high-risk AI hiring tool. Population is 12,000 decisions over six months. Which sampling approach best balances coverage of protected-class subgroups with audit effort?

An auditor is testing the controls around training-data provenance for a fine-tuned LLM. The auditee provided model cards but no record of how the fine-tuning dataset was assembled. What is the appropriate finding classification?

The four-fifths rule is the EEOC-published threshold for disparate-impact analysis. What does the rule state?

Under the EU AI Act, what is required of a provider of a high-risk AI system before the system is placed on the EU market?

An auditor finds that the auditee runs ongoing fairness monitoring on production AI decisions and has triggered three model retrains in the past year based on drift signals. Which control category does this evidence?

An auditor is scoring inherent risk for a generative-AI customer-service chatbot using the NIST AI 600-1 taxonomy. Which named risk category best matches the scenario where the chatbot may produce fluent-sounding but factually wrong policy answers (as in the Air Canada chatbot ruling)?

Mobley v. Workday, Inc. is a 2024 federal-court ruling significant to AI hiring audit. What did the July 12, 2024 ruling by Judge Rita F. Lin hold?