Discuss Isaca AAISM Exam Topic 3 Question 4

After implementing a third-party generative AI tool, an organization learns about new regulations related to how organizations use AI. Which of the following would be the BEST justification for the organization to decide not to comply?

AThe AI tool is widely used within the industry

BThe AI tool is regularly audited

CThe risk is within the organization's risk appetite

DThe cost of noncompliance was not determined

Suggested Answer: C

The AAISM framework clarifies that compliance decisions must always be tied to an organization's risk appetite and tolerance. When new regulations emerge, management may choose not to comply if the associated risk remains within the documented and approved risk appetite, provided that accountability is established and governance structures support this decision. Other options such as widespread industry use, third-party audits, or lack of cost assessment do not justify noncompliance under the governance principles. The risk appetite framework is the only recognized justification under AI governance principles.

AAISM Study Guide -- AI Governance and Program Management

ISACA AI Risk Guidance -- Risk Appetite and Compliance Decisions

Get Premium AAISM Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

30 comments · newest first

Alonso 7 months ago

But what if the audits miss something? Compliance is safer.

Carman 7 months ago

Option B is solid too. Regular audits can help mitigate issues.

Adria 8 months ago

Exactly! Compliance is crucial, even if the risk is low.

Tashia 8 months ago

Option A seems weak. Just because others do it doesn't mean it's right.

Lawrence 8 months ago

Still, regulations are there for a reason. We shouldn't ignore them.

Jolene 8 months ago

I agree with Nickie. If it fits our risk appetite, we should be fine.

Jacinta 8 months ago

But what about option D? Not knowing the cost is risky!

Ivette 8 months ago

D) The cost of noncompliance was not determined? That's a huge red flag!

Karl 9 months ago

C) The risk is within the organization's risk appetite makes sense.

Brittni 9 months ago

Wait, is it really okay to ignore regulations just because others do?

Nicholle 9 months ago

I disagree, compliance is key no matter what!

Gabriele 9 months ago

A) The AI tool is widely used within the industry.

Kaycee 9 months ago

I recall that regular audits can help mitigate risks, but I’m not convinced that option B would be a solid justification for noncompliance.

Eun 9 months ago

I practiced a similar question where the cost of noncompliance was a factor, so I wonder if option D could be a valid reason too, but it feels a bit weak.

Nickie 10 months ago

I think option C is the best. If the risk is manageable, why comply?

Michael 10 months ago

I think option C makes sense because if the risk is within the organization's appetite, they might feel justified in not complying, but I’m not entirely confident.

Reta 10 months ago

I remember discussing how industry standards can sometimes influence compliance decisions, but I’m not sure if that’s a strong enough reason on its own.

Raelene 11 months ago

Audits are great, but they don't automatically make an AI tool compliant. Option B is not the best answer.

Kristeen 11 months ago

I'm not sure the industry-wide usage of the AI tool is a valid justification for noncompliance. Option A is a weak argument.

Catrice 11 months ago

Compliance is important, but the cost of noncompliance needs to be weighed carefully. Option D is the way to go.

Carman 11 months ago

Option C is the best choice. The organization's risk appetite should be the primary consideration.

Janine 12 months ago

I'm going to go with C. As long as the organization has carefully evaluated the risks and determined they are acceptable, that seems like the strongest justification here.

Pearly 12 months ago

I'm a bit confused on this one. I'll need to think through the pros and cons of each option and how they relate to the regulations. Might be good to consult with our legal team on this.

Josephine 12 months ago

I don't think A or B are good justifications. Just because something is widely used or audited doesn't mean you can ignore regulations. D also seems like a weak excuse.

Dannie 1 year ago

Hmm, I'm leaning towards C. If the risk is within the organization's appetite, that seems like a reasonable justification not to comply, as long as they've properly assessed the risk.

Elliot 1 year ago

I'm not sure about this one. I'll need to carefully review the regulations to see what the specific requirements are.

Ernest 6 months ago

↳ replying to Elliot

True, but if the tool is widely used, does that make it okay?

Lavina 7 months ago

↳ replying to Elliot

What if the cost of noncompliance is huge? That could change everything.

Kris 10 months ago

↳ replying to Elliot

But regulations are there for a reason. We should follow them.

Emogene 10 months ago

↳ replying to Elliot

I think option C makes sense. If the risk is manageable, why comply?

Isaca AAISM Exam - Topic 3 Question 4 Discussion