ISACA Certified Artificial Intelligence Auditor (CAIA) — Question 39

An IS auditor learns that the organization’s AI solution is configured with web integration enabled. Which of the following is the MOST important control for the auditor to validate?

Answer options

• A. Data augmentation activities prior to model building
• B. Key performance indicator (KPI) metrics for model inference time
• C. Activity logging with integration to the organization’s SIEM system
• D. Separation of duties between the model creator and the model tester

Correct answer: C

Explanation

The most important control to validate is activity logging with integration to the organization’s SIEM system, as it ensures that all interactions with the AI solution are recorded for security monitoring. The other options focus on model performance and development processes but do not directly address the critical need for monitoring and detecting potential security issues related to web integrations.