AAIA Question 22

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C3

  Answer is A one time concern, while C is permanent and recurring concern: When a vendor's AI solution requires web integration to function, the system continuously pulls in external data from the internet in real time. This creates significant risk around data hallucinations and biases, because: The AI may fabricate or distort information drawn from unreliable, unvetted, or adversarially crafted web sources. External web content introduces uncontrolled biases — political, cultural, or commercial — that the organization cannot audit or mitigate. From an IS audit perspective, this directly undermines data integrity, reliability, and auditability — core control objectives

• Chose A1

  The correct answer is: ✅ A. AI training model environment Explanation: If the vendor’s AI solution requires web integration to function, this means the system may: Connect to external data sources or cloud-based APIs, and Potentially transmit internal or sensitive data outside the organization’s controlled environment. This introduces the greatest risk to the AI training and operational environment, as it could expose proprietary or confidential data to: Unauthorized access, Data leakage, or Unintended use in external AI model training. Thus, the IS auditor’s primary concern should be around data protection, privacy, and environment isolation — not the algorithms or workforce impacts.