AAIA Question of the Day: Residual Risk Acceptance

Quiz Yazan Ibrahim
AI audit training by expert Yazan Abu Ghosh for auditors with certifications.

AAIA exam practice question — AAIA Question of the Day: Residual Risk Acceptance

AAIA exam practice question: daily practice for the ISACA Advanced in AI Audit (AAIA) exam — domain: AI Governance and Risk.

Question

An internal audit report finds that, after applying mitigation controls, a deployed credit-scoring model still exhibits a small but persistent disparate impact across demographic groups. The model's business unit must decide whether to continue using the model. Who should formally accept the remaining (residual) risk for the model's use in production?

  • A. The model owner in the business unit responsible for the product, formally accepting the residual risk.
  • B. The organization's AI governance board, formally accepting the residual risk on behalf of the enterprise.
  • C. The Chief Risk Officer, formally accepting the residual risk on behalf of the firm.
  • D. The lead data scientist who developed the mitigation, formally accepting the residual risk.
Show the answer and explanation

Correct answer: A. The model owner in the business unit responsible for the product, formally accepting the residual risk.

The model owner (business unit) is accountable for the model’s business decisions and must formally accept residual risk or escalate per governance. They balance operational needs, legal/regulatory constraints, and mitigation costs. The AI governance board provides policy, oversight and may require escalation for high-severity cases but typically does not accept day-to-day business risk. The Chief Risk Officer advises and may require controls or escalation but ordinarily does not unilaterally accept a business unit’s operational residual risk. The lead data scientist is a technical expert and cannot formally accept organizational risk without business authority.

Want more practice?

Prepare for the ISACA Advanced in AI Audit (AAIA) exam with AI Audit & Compliance Framework: Practical Methods & Evaluation.