AAIA Question of the Day: Audit Trail Requirements

Quiz Yazan Ibrahim
AI audit training by expert Yazan Abu Ghosh for auditors with certifications.

AAIA exam practice question — AAIA Question of the Day: Audit Trail Requirements

AAIA exam practice question: daily practice for the ISACA Advanced in AI Audit (AAIA) exam — domain: AI Governance and Risk.

Question

A financial services firm uses an automated AI system to approve small-business loan applications. During a compliance review the audit team requests controls that ensure decisions are auditable and non-repudiable. Which governance control is most appropriate to meet these requirements?

  • A. Maintain immutable, timestamped, versioned logs that record inputs, outputs, model version, and operator actions for each automated decision.
  • B. Produce periodic manual summary reports of decision outcomes and aggregate metrics stored in a central repository.
  • C. Record only the deployed model version and final decision outcome, relying on version control for traceability.
  • D. Preserve snapshots of training datasets and model artifacts offline, without detailed per-decision logging.
Show the answer and explanation

Correct answer: A. Maintain immutable, timestamped, versioned logs that record inputs, outputs, model version, and operator actions for each automated decision.

Option 1 is best because immutable, timestamped, and versioned per-decision logs capture the runtime inputs, outputs, model instance, and any human interventions — providing the evidence needed for reproducibility, forensics, and non-repudiation. Option 2 is inadequate because periodic summaries lose per-case detail and are vulnerable to aggregation errors or manipulation. Option 3 is insufficient since recording only model version and outcome omits the input context and operator actions required to reconstruct or explain a specific decision. Option 4 is relevant for model provenance but does not provide the per-decision runtime evidence needed for audit or dispute resolution.

Want more practice?

Prepare for the ISACA Advanced in AI Audit (AAIA) exam with AI Audit & Compliance Framework: Practical Methods & Evaluation.