AI Lifecycle and Model Controls
Controls follow the AI lifecycle through development, approval, testing, validation, change management, deployment, rollback, monitoring, and retirement.
How to study for ISACA AAISM
Treat each item as a management decision: identify the AI asset and stakeholder, assess risk, select governance or control action, then document evidence and accountability.
Core concepts
Concept 1
AI lifecycle controls should govern intake, design, data preparation, training or tuning, testing, approval, deployment, change, and retirement.
Exam cue: Validate model behavior before deployment and after material change.
Concept 2
Model validation should check performance, safety, bias, robustness, security, drift, and fitness for intended use.
Exam cue: Use change management when prompts, data, models, or tools change.
Concept 3
Change management should track model, prompt, dataset, configuration, control, and dependency changes.
Exam cue: Use rollback when a production change degrades safety or control effectiveness.
Risk pitfalls and guardrails
Approving a model once and ignoring drift or use-case changes.
Guardrail: Avoid treating AI security as only a technical scan, accepting risk without authority, or leaving prompts and data outside governance.
Changing prompts outside release and validation controls.
Guardrail: Avoid treating AI security as only a technical scan, accepting risk without authority, or leaving prompts and data outside governance.
Treating a model card as a substitute for testing evidence.
Guardrail: Avoid treating AI security as only a technical scan, accepting risk without authority, or leaving prompts and data outside governance.
Memory anchors
Lifecycle Control
A lifecycle control governs AI assets from intake through design, testing, approval, deployment, monitoring, and retirement.
Model Validation
Model validation tests whether model behavior is safe, reliable, secure, fair, and fit for intended use.
Change Record
A change record documents what changed, why, who approved it, test evidence, risk, and rollback plan.
Prompt Change
A prompt change modifies instructions, constraints, examples, variables, or output rules and needs control.
Rollback Plan
A rollback plan defines how to return to a prior approved version if a change fails.
Drift
Drift is a change in data, behavior, performance, or risk over time.
Approval Gate
An approval gate blocks deployment until required evidence, review, and risk decisions are complete.
Model Card
A model card documents model purpose, limitations, performance, data, intended use, and risk considerations.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
An AI project defines accuracy goals but no security, privacy, robustness, or abuse requirements. Which control is MOST appropriate?
Which evidence BEST demonstrates that controls over security requirements operated throughout the review period?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”