Discuss Isaca AAIA Exam Topic 3 Question 18

Which of the following is MOST important for an IS auditor to consider when identifying AI risk in a know your customer (KYC) application within a banking organization?

AIntellectual property leakage and invalidation

BBenchmarking against peer organizations

CIncident response plan

DBusiness disruption and financial impact

Suggested Answer: D

In high-stakes financial applications like KYC, the primary concern is the potential business and regulatory impact of an AI error---such as false customer rejection or failure to detect fraudulent accounts. The AAIA Study Guide emphasizes aligning AI risk assessments with business impact and regulatory exposure.

''In financial institutions, the most material risk of AI errors lies in operational disruption and regulatory fines. KYC models must be assessed for how errors can lead to compliance failures or reputational harm.''

Benchmarking (B) supports best practice alignment, and incident response (C) is part of mitigation, but D addresses the most critical consequence of AI risks in banking.

Get Premium AAIA Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

22 comments · newest first

Nada 2 days ago

I agree, D shows real consequences.

Nobuko 7 days ago

I think D is the most important. Financial impact matters a lot.

Lamonica 12 days ago

Overall, D covers the broader implications. Can't ignore that.

Cristal 17 days ago

B is less critical. Benchmarking doesn't address immediate risks.

Elbert 23 days ago

I lean towards C. An incident response plan is vital.

Nell 28 days ago

A is important too. Intellectual property is at risk.

Lavera 1 month ago

Agreed, D makes sense. Financial impact is key.

Alverta 1 month ago

I think D is crucial. Business disruption can be costly.

Kenneth 1 month ago

C should not be ignored, incident response is vital!

Josphine 2 months ago

Wait, is benchmarking really that important? Seems secondary.

Aliza 2 months ago

Totally agree with D, financial impact is key!

Shaquana 2 months ago

I think A is super important too, can't overlook IP issues.

Sanda 2 months ago

D is definitely the most critical factor.

Alpha 2 months ago

Totally agree with D! Business disruption can sink a bank fast.

Maurine 2 months ago

Wait, is benchmarking really that important? Seems less urgent.

Ruthann 3 months ago

C is essential! Without a solid incident response, you're in trouble.

Paris 3 months ago

I think A is really important too. Can't overlook IP issues.

Herman 3 months ago

D is definitely the most critical factor. Financial impact is huge!

Pedro 3 months ago

I lean towards the financial impact being crucial, especially since KYC failures can lead to significant losses, but I could be overthinking it.

Twanna 3 months ago

I practiced a question similar to this where incident response was highlighted, but I wonder if it really applies here as the top priority.

Cecil 4 months ago

I feel like benchmarking against peer organizations could be relevant, but it seems more like a secondary consideration compared to immediate risks.

Keena 5 months ago

I think I remember discussing the importance of business disruption in KYC applications, but I'm not entirely sure if it's the most critical factor.

Isaca AAIA Exam - Topic 3 Question 18 Discussion