Advanced in AI Risk - AAIR
Security Governance and Responsible AI
Apply security, privacy, compliance, and responsible AI controls to exam scenarios.
Official Scope and Verification
This lesson is mapped to the verified Advanced in AI Risk - AAIR outline. Official sources and public status were rechecked on 2026-07-13. Provider pages remain authoritative for late-breaking blueprint, availability, scheduling, price, language, delivery, and retake changes.
Current ISACA AAIR certification with official domain percentages, subtopics, and other skills tested.
Official Objectives Emphasized Here
| Domain or objective area | Published weight | Key objective groups | Official source |
|---|---|---|---|
| AI Risk Governance and Framework Integration | 37% | AI Models, Frameworks, Strategies, and Use Cases; AI Organizational Processes and Alignment; AI Ownership, Oversight, and Accountability; AI Policies, Procedures, and Organizational Training; AI Regulatory Compliance and Legal Considerations; AI Trustworthiness, Ethical and Societal Implications | ISACA official AAIR exam content outline |
| AI Life Cycle Risk Management | 21% | AI Design, Development/Procurement, and Documentation; AI Model Training, Testing, and Validation; AI Implementation, Maintenance, and Decommissioning; AI Data and Asset Management | ISACA official AAIR exam content outline |
| AI Risk Program Management | 42% | AI Risk Scenario Identification and Assessment; AI Risk Treatment Strategies; AI Controls Management; AI Risk Metrics, Monitoring, and Reporting; AI Supply Chain Risk Management; AI Incident Response, BIA, Business Continuity, and Disaster Recovery | ISACA official AAIR exam content outline |
| Other Skills Tested | Published without a scored percentage | Evaluate risk related to AI models and solutions including design, suitability, algorithms, training, drift, and AI life cycle; Facilitate integration of AI risk management into an enterprise risk management framework and risk programs; Develop and implement an AI risk management framework, including roles, accountability, policies, procedures, and risk tolerance; Conduct risk assessments to identify and classify risks associated with AI; Develop and recommend risk treatment strategies for identified AI risks; Assess compliance with applicable AI-related regulations, laws, frameworks, standards, and guidelines; Integrate AI risk considerations into existing governance programs; Integrate AI risk considerations into existing risk register and control taxonomies; Evaluate AI use cases based on the organization's risk appetite; Monitor and test organizational processes to identify AI risks; Collaborate with stakeholders to develop and integrate AI risk concepts into enterprise-wide awareness training; Capture AI risk considerations in enterprise risk metrics and reporting, including board, management, and operations reporting; Conduct or evaluate threat and vulnerability assessments on AI projects and programs; Collaborate with stakeholders to integrate AI risk scenarios into the enterprise incident management program; Continuously assess and monitor the risk landscape for emerging AI risk; Evaluate controls to manage AI-related risk within the organization's risk tolerance; Advise on AI-related risk within contracts and service agreements, including data usage and intellectual property; Evaluate AI risk as part of supply chain risk management; Collaborate with stakeholders to address AI trustworthiness and impacts including ethics, bias, privacy, safety, and environmental, social, and governance implications; Leverage AI to support the risk management program, including risk profile, reporting, evaluation, risk models, and analysis; Integrate AI-related risk considerations into the change management process; Incorporate AI-related risk considerations into incident response, BIAs, the BCP, and DRP; Assess human oversight controls at critical decision points for risk and AI impact | ISACA official AAIR exam content outline |
Authoritative Sources for This Scope
- ISACA official AAIR exam content outline - Official source; accessed 2026-07-13.
Security, governance, and responsible AI questions ask whether the solution can be trusted, controlled, and explained. For Advanced in AI Risk - AAIR, treat governance as part of the design, not a separate cleanup task after the model works.
Controls To Recognize
| Control area | What it protects | What to look for in a scenario |
|---|---|---|
| Identity and access | Systems, documents, tools, models, and administrative actions. | Least privilege, role-based access, service identities, approval boundaries, and separation of duties. |
| Data protection | Training data, prompts, uploaded files, retrieved documents, logs, and outputs. | Classification, encryption, masking, retention, residency, and deletion requirements. |
| Output quality and safety | Users, customers, business decisions, and public trust. | Grounding, citations, evaluations, content filters, policy checks, and human review. |
| Responsible AI | Fairness, transparency, accountability, and social impact. | Bias testing, explainability, consent, documentation, stakeholder review, and appeal paths. |
| Auditability | Evidence that the system was governed and operated responsibly. | Logs, versioning, approvals, risk registers, control tests, and incident records. |
Provider-Specific Risk Lens
Assess access, data handling, model governance, third-party dependencies, change management, incident response, and monitoring.
For ISACA, a governance answer is strongest when it uses the credential's risk language, control vocabulary, lifecycle model, and evidence expectations instead of vague statements like "be ethical" or "monitor the model."
Track-Specific Risk Checks
- privacy leakage through prompts, files, logs, retrieved documents, or generated outputs
- hallucinated or ungrounded answers used without review
- unclear accountability when an AI recommendation affects people, money, security, or compliance
- missing AI owner
- unreviewed high-impact use case
- weak evidence for control effectiveness
- vendor or model change without reassessment
Responsible AI Scenario Checklist
- Purpose: Is the use case appropriate, useful, and clearly bounded?
- People: Who is affected, who can challenge the output, and who owns the decision?
- Data: Was the data collected, used, stored, and shared appropriately?
- Model behavior: Are hallucination, bias, toxicity, privacy leakage, and misuse tested?
- Operations: Are monitoring, incident response, change control, and retirement plans defined?
Example: Prompt Injection And Data Leakage
Scenario: an AI assistant can read internal knowledge articles and call workflow tools. A user tries to make it ignore its instructions and reveal restricted information. The best answer is not just 'write a better prompt.' It should combine access control, tool permission limits, input and output filtering, retrieval permissions, logging, testing, and human escalation for sensitive actions.
How To Study Governance
- Write one governance control for each lifecycle stage: design, data, build, test, deploy, monitor, and retire.
- Practice rejecting answers that rely on user trust, prompt wording, or policy documents without enforcement.
- Use NIST AI RMF and OWASP GenAI security resources as general reference points, then map them back to the provider-specific credential objectives.
Useful Links
- ISACA Credentialing - Official ISACA credential catalog.
- ISACA Advanced in AI Audit - Official AAIA credential page.
- ISACA Advanced in AI Risk - Official AAIR credential page.
- ISACA Advanced in AI Security Management - Official AAISM credential page.
- NIST AI Risk Management Framework - General reference for AI risk management practices.
- OWASP GenAI Security Project - General reference for LLM and GenAI application risks.