AAIA AI governance and risk explained
AI Governance and Risk is worth 33% of AAIA — around 30 of the 90 questions. ISACA breaks it into five areas, and for an auditor the useful framing is: what should exist, who owns it, and what would prove it exists.
AI models, considerations and requirements
You cannot audit what you cannot describe. This area asks for working literacy:
- What a model is, and that its behaviour derives from training data rather than written logic
- Training versus inference — two distinct stages with distinct risks and distinct evidence
- Why outputs are probabilistic, so “correct” is a threshold rather than a binary
- What requirements an AI solution should have defined before it was built: intended use, acceptable performance, limitations, and who it affects
The audit angle: requirements defined after deployment are not requirements. A scenario where nobody can state the intended use is a governance finding, not a technical one.
AI governance and programme management
Familiar discipline, AI-specific content. Expect to reason about:
- An inventory of AI systems, including unapproved use
- Ownership — a named accountable person, not a team
- Approval paths before deployment, proportionate to risk
- Oversight structures, and whether they have authority to stop something
- How the AI programme connects to existing governance rather than running beside it
AI risk management
The methodology is yours. Three AI-specific points recur:
Thresholds are measurements. Accuracy, fairness disparity, groundedness. “Secure” is not a threshold; “error rate below x%” is.
Risk moves on its own. Drift means the profile changes without anyone acting. Periodic reassessment is therefore a control you should expect to see, and its absence is a finding.
Acceptance is legitimate. A documented, owned, in-threshold accepted risk is a valid answer. Auditors trained to recommend mitigation everywhere lose marks here.
Privacy and data governance programmes
Where AI collides hardest with existing obligations:
| Concern | The audit question |
|---|---|
| Personal data in training sets | Was it lawfully obtained for this purpose? |
| Minimisation | Was more collected than the purpose required? |
| Retention | How long is training data kept, and why? |
| Deletion requests | What happens to a model already trained on that data? |
| Output leakage | Can the model reproduce personal data in responses? |
The deletion row is the one that separates prepared candidates from unprepared ones. Removing a record from a dataset does not remove its influence from a trained model. An organisation claiming a deletion request is complete because the row was dropped has not addressed the model.
Leading practices, ethics, regulations and standards
You are not expected to recite frameworks. You are expected to know what they consistently require, because that is what you audit against:
- An inventory, classified by risk
- Impact assessment before deployment
- Human oversight of consequential decisions
- Documentation of data sources, limitations and testing
- Transparency toward affected people
- Records sufficient to support later audit
Higher-risk uses — employment, credit, healthcare, anything touching rights — attract heavier expectations. A scenario naming a sensitive domain is signalling that more should exist, not less.
Sample questions
Question 1. An auditor finds that an AI system supporting recruitment decisions has no documented statement of intended use or known limitations. Which is the MOST appropriate finding?
- A. Governance gap: intended use and limitations were never defined, so appropriate use cannot be assessed
- B. The model’s accuracy has not been benchmarked against competitors
- C. Infrastructure costs for the system have not been forecast
- D. The vendor’s support agreement has not been renewed
Show answer
Answer: A
Without a documented intended use and limitations, nobody can determine whether the system is being used appropriately or assess its impact, which undermines the whole governance chain for a high-risk application. Model accuracy, infrastructure cost and vendor support are secondary or unrelated to this governance gap.
Question 2. A customer requests deletion of their personal data. The organisation removes the record from the dataset and reports the request complete. The model trained on that data remains in production. How should the auditor assess this?
- A. Satisfactory — removing the record from the dataset fulfils the request
- B. Satisfactory — trained models are outside the scope of deletion requests
- C. Incomplete — the trained model retains influence from that data and must be addressed
- D. Satisfactory provided the dataset is encrypted at rest
Show answer
Answer: C
The response is incomplete because a trained model retains influence from data it learned on, so the model itself must be addressed rather than only the stored dataset. Treating the removal as sufficient misstates the position, models are not out of scope, and encryption is not deletion.
Question 3. Management has formally accepted a documented, owned risk relating to minor inaccuracy in an internal AI assistant, and it sits within the enterprise's stated threshold. What should the auditor do?
- A. Raise a finding requiring the risk to be mitigated
- B. Verify the acceptance was properly authorised, documented and has a review date
- C. Escalate to the audit committee as an unresolved risk
- D. Require the assistant to be withdrawn until the risk is removed
Show answer
Answer: B
Acceptance within a documented threshold with a named owner is a legitimate treatment decision, so the auditor confirms the decision was properly made and recorded rather than challenging the choice itself. Raising a finding, requiring mitigation or escalating would substitute the auditor’s risk appetite for management’s.
What to practise
For each of the five areas above, write the single document or record you would ask for first. Inventory. Impact assessment. Risk register entry with owner. Data lineage. Oversight records. If you can name the artefact, you can answer most of this domain — and the habit carries directly into the operations domain, which is worth even more.