AI Data and Development Lifecycle
AAIA operations includes data sourcing, labeling, preprocessing, lineage, versioning, development, testing, approval, deployment, change, and retirement.
How to study for ISACA AAIA
Treat each item as an audit decision: understand AI risk, identify criteria, test evidence, assess control effectiveness, then report impact and follow-up.
Core concepts
Concept 1
AI lifecycle controls cover intake, data preparation, model development, testing, approval, deployment, monitoring, change, and retirement.
Exam cue: Follow data lineage from source through model input and output.
Concept 2
Data controls address provenance, quality, labeling, feature engineering, lineage, access, retention, and representativeness.
Exam cue: Check versioning for datasets, features, prompts, models, and code.
Concept 3
Auditors test whether development artifacts and approvals are traceable to requirements and risk controls.
Exam cue: Require approval evidence before production deployment.
Risk pitfalls and guardrails
Tracking model versions but not datasets or prompts.
Guardrail: Avoid treating AI audit as only a technical scan, accepting management assertions without evidence, or omitting prompts, data, vendors, and monitoring.
Testing development controls without checking deployment change control.
Guardrail: Avoid treating AI audit as only a technical scan, accepting management assertions without evidence, or omitting prompts, data, vendors, and monitoring.
Ignoring data representativeness and labeling quality.
Guardrail: Avoid treating AI audit as only a technical scan, accepting management assertions without evidence, or omitting prompts, data, vendors, and monitoring.
Memory anchors
Lifecycle Control
Lifecycle control governs intake, development, validation, deployment, monitoring, change, and retirement.
Data Provenance
Data provenance records where data came from and whether it is authorized for AI use.
Data Lineage
Data lineage shows how data changed from source through features, training, retrieval, prompts, and outputs.
Version Control
Version control records approved states for datasets, prompts, code, models, configurations, and releases.
Label Quality
Label quality measures whether training or evaluation labels are accurate, consistent, and governed.
Representativeness
Representativeness checks whether data reflects the populations and conditions where the model is used.
Deployment Approval
Deployment approval confirms required tests, reviews, risk decisions, and evidence before release.
Retirement Control
Retirement control removes or archives AI assets, data, credentials, and dependencies safely.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
An auditor cannot trace a production prediction back to its source data version. Which control is MOST clearly deficient?
A training dataset combines licensed and scraped content without source records. What is the PRIMARY concern?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”