AAISM AI governance and program management
AI Governance and Program Management is worth 31% of AAISM — around 28 of the 90 questions. ISACA describes it as advising stakeholders on implementing AI security solutions through appropriate and effective policy, data governance, programme management and incident response.
If you hold CISM, the discipline is yours already. What is new is everything AI-specific inside it, and the temptation to skim this domain because the headings look familiar is the main risk.
Stakeholders, frameworks and regulation
AI adoption has more stakeholders than most security topics: the business unit that wants it, legal, privacy, risk, the data owners, and whoever will be accountable when it goes wrong. Part of this domain is knowing who must be consulted and what each needs from you.
On frameworks and regulatory requirements, you are not expected to recite clauses. You are expected to know the shape of what they consistently demand:
- An inventory of AI systems, classified by risk
- Impact assessment before deployment, proportionate to that risk
- Human oversight of consequential decisions
- Documentation of data sources, limitations and testing
- Transparency toward people affected by automated decisions
- Records that support an audit afterwards
Higher-risk uses — employment, credit, health, anything affecting rights — attract heavier obligations. A scenario that names a sensitive domain is signalling more governance, not less.
Strategies, policies and procedures
Know what an AI policy set actually contains: acceptable use, model approval, data use in training, third-party model use, human oversight requirements, and what staff may and may not put into a public tool.
The recurring exam pattern is sequence. A policy written before you know what is in use will not fit reality. Inventory first, then policy.
AI asset and data lifecycle management
The most distinctly new part of the domain. Treat models and training data as assets:
| Stage | The governance question |
|---|---|
| Identification | What AI assets exist, including shadow use? |
| Classification | How sensitive is this model, this dataset? |
| Provenance | Where did this data or model come from? |
| Integrity | Has it been altered? |
| Retention | How long do we keep training data, and why? |
| Disposal | What does deleting a model that learned from data mean? |
That last row is genuinely hard and worth thinking about before the exam: deleting a record from a dataset does not remove its influence from a model already trained on it.
Programme development and management
Building an AI security programme, not just writing policy: scope, ownership, resourcing, metrics, reporting lines, and how it integrates with the security programme you already run. ISACA credentials always care about who is accountable, and this domain is where that is tested most directly.
Business continuity and incident response
AI incidents are not all outages. Know the categories: the model behaves harmfully, it leaks data, it was poisoned, it drifted into unreliability, or a third-party model provider fails. Each has a different response, and “roll back” is more complicated when behaviour comes from data and weights rather than from code.
Sample questions
Question 1. An organisation is writing its first AI acceptable use policy. Which should be completed FIRST?
- A. An inventory of AI systems in use and the data they process
- B. A draft policy circulated to business unit heads for comment
- C. Selection of an industry AI governance framework
- D. Awareness training for all staff on AI risks
Show answer
Answer: A
An inventory of AI systems and their data flows establishes what the policy must actually govern, including existing unapproved use. Drafting a policy, selecting a framework or scheduling training before knowing what is in use produces a policy that does not match reality.
Question 2. A customer exercises their right to have personal data deleted. That data was included in a training set used to build a model now in production. Which is the MOST accurate statement for the security manager to give legal?
- A. Deleting the record from the dataset completes the request
- B. Models are out of scope for data deletion requests
- C. The dataset can be updated, but the trained model retains influence from that data and must be addressed separately
- D. Encrypting the record is equivalent to deleting it
Show answer
Answer: C
Removing a record from the dataset does not remove its influence from a model already trained on it, so the response must address the model as well as the stored data. Claiming the deletion is complete once the dataset is updated is inaccurate, models are not inherently outside the scope of the request, and encryption does not constitute deletion.
Question 3. A generative AI assistant has begun producing responses that disclose internal project names to external users. Which should the security manager do FIRST?
- A. Begin a root cause analysis of the training data
- B. Contain the exposure by restricting the affected capability
- C. Report the incident to the board at the next scheduled meeting
- D. Update the AI acceptable use policy to prohibit internal names
Show answer
Answer: B
Containing the exposure by restricting the affected capability stops ongoing disclosure while the cause is investigated, which is the standard incident response sequence of contain then investigate. A root cause analysis, a board report and a policy update all follow containment rather than preceding it.
What to practise
Write the six framework expectations from memory — inventory, impact assessment, oversight, documentation, transparency, records. Then take one AI system you know and answer every row of the asset lifecycle table for it. Any row you cannot answer is a governance gap, and gaps are exactly what this domain asks about.