ISACA AAIR flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

AI governance definition

The enterprise system of policies, roles, decision rights, and oversight that directs and controls AI use, defining who decides, who is accountable, and how compliance is evidenced.

AI risk appetite

The amount and type of AI risk the enterprise is willing to accept in pursuit of its objectives, approved by the board or executive committee and translated into tolerance thresholds.

AI governance committee

A cross-functional body of risk, legal, security, data, business, and audit representatives that converts risk appetite into standards and approves high-risk AI use cases.

Three lines model

An assurance structure where the business owns and operates AI controls, risk and compliance monitor them, and internal audit provides independent assurance without self-certification.

Policy hierarchy

The tiered structure of enterprise AI policy, then standards, then procedures, then control evidence, where lower tiers may never relax a requirement set at a higher tier.

AI system inventory

A registry recording each AI system's owner, purpose, model type, data sources, affected populations, risk tier, and review dates, used to scope downstream controls.

Risk tiering rule

Classification based on potential harm to individuals and the enterprise plus autonomy and scale, where higher tiers trigger human oversight, independent validation, and pre-deployment approval.

Accountable AI owner

A named executive or business role with authority over a specific AI use case who is answerable for its risk decisions; collective labels such as the AI team are not acceptable.

Transparency obligation

The duty to tell affected users they are interacting with AI where required, disclose material limitations, and maintain model documentation for regulators and auditors.

Governance KRIs

Indicators such as percentage of AI systems inventoried, overdue model reviews, policy exceptions, incidents per system, and high-risk systems with completed independent validation.

AI life cycle stages

The sequence from intake and design through data sourcing, development, validation, deployment, monitoring, and decommissioning, each with entry criteria and required evidence.

Use case intake

The pre-development gate documenting intended and prohibited uses, affected stakeholders, data sources, and a preliminary risk tier before funding is approved.

Data provenance

Documented lineage of training and operational data covering origin, lawful basis, consent, transformations, and labeling quality, enabling audit of what the model learned from.

Bias testing

Evaluation of model outcomes across protected or sensitive groups to detect disparate performance or error rates, with results compared against pre-defined fairness acceptance criteria.

Model risk drivers

Factors that raise model risk: complexity, autonomy, data dependency, and decision impact; higher combinations require independent validation and challenger models before release.

Independent validation

Testing by parties separate from development that assesses accuracy, robustness, fairness, explainability, security, and oversight effectiveness against pre-agreed acceptance criteria.

Meaningful human oversight

Oversight that gives the reviewer authority, competence, information, and time to understand and override AI output, rather than a nominal click-through confirmation.

Shadow mode deployment

Running a model alongside existing decisions without acting on its output, allowing comparison of performance and risk before granting live decision authority.

Rollback plan

A documented, tested procedure to revert an AI system to a prior model version or manual process when deployment monitoring shows unacceptable performance or harm.

Data drift

Change in the statistical distribution of input data relative to training data, which can degrade model performance and should trigger review or retraining.

Concept drift

Change over time in the relationship between inputs and the target outcome, so a model that was accurate becomes stale even when input distributions look stable.

Model decommissioning

Retirement of a model and its data under retention policy, archiving validation evidence, notifying dependent systems, and confirming no residual automated decisions continue.

Residual AI risk

The risk remaining after controls are applied, compared against risk appetite to decide whether to accept, mitigate further, transfer, or reject the AI use case.

AI control library

A catalog of controls mapped to recognized frameworks such as NIST AI RMF or ISO/IEC 42001, making each control traceable to external expectations and auditable.

Third-party AI due diligence

Vendor assessment covering training data, security posture, model change notification, subprocessors, and contractual rights to audit, remediate, and exit.

AI incident management

A process for AI-specific events such as harmful output, bias incidents, model compromise, prompt injection, and data leakage, with severity, escalation, and root-cause analysis.

Risk posture reporting

Board and committee reporting that aggregates AI systems by tier, open findings and aging, incidents, exceptions, and remediation status against agreed timelines.

Control effectiveness testing

Periodic independent review that checks whether AI controls are designed appropriately and operate as intended, producing findings that feed back into policy and standards.

KRI breach response

The documented action taken when a key risk indicator exceeds threshold, naming a response, an accountable owner, and a completion date so the metric drives decisions.

AI risk taxonomy

A structured classification of AI risks such as safety, bias, privacy, security, legal, and reputational, used to score likelihood and impact consistently across the enterprise.

Program assurance independence

The principle that those who build or operate AI cannot provide their own assurance, so testing and reporting sit with separate risk or audit functions.

AI risk register

A maintained record of identified AI risks with owners, inherent and residual scores, linked controls, treatment plans, and review dates, feeding enterprise risk reporting.