For an IS auditor to effectively evaluate an AI system's algorithm, the most critical characteristic is its ability to provide transparent justification for its decisions. This concept, often referred to as explainability or interpretability, allows the auditor to understand the reasoning behind an output. It enables the assessment of the algorithm's logic, fairness, and adherence to organizational policies and regulations. Without transparency, the algorithm operates as a "black box," making it nearly impossible for an auditor to validate its internal workings, identify potential biases, or confirm its reliability beyond simple input-output testing.

A. The AI system algorithm uses training data to inform decision output. This is a fundamental definition of how most machine learning systems function, not a specific characteristic that aids in the evaluation of the algorithm's logic.

B. The AI system provides multiple options for model training. This feature relates to the flexibility during the development phase but does not help an auditor evaluate the logic of the final, deployed algorithm in operation.

D. The AI system uses archived transaction data to provide decisions. Similar to option A, this describes a common data source for an AI system but does not provide the insight needed to evaluate how the algorithm processes that data.

1. ISACA. (2021). Auditing Artificial Intelligence. "Explainability is the ability to explain the reasoning behind an AI model’s decision in an understandable way. This is a key requirement for building trust and confidence in AI systems and is a critical component of AI governance and audit." (Page 11).

2. National Institute of Standards and Technology (NIST). (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1. The "Explainable and Interpretable" characteristic is a core component of trustworthy AI

stating that systems should deliver "accompanying evidence

such as a confidence measure

or an explanation of how a decision was made." (Section 3.3

Page 13). https://doi.org/10.6028/NIST.AI.100-1

3. Jobin

A.

Ienca

M.

& Vayena

E. (2019). The global landscape of AI ethics guidelines. Nature Machine Intelligence

1(9)

389–399. The principle of "Transparency and Explainability" is identified as a primary convergent theme in global AI ethics guidelines

essential for accountability and audit. (Table 1

Page 391). https://doi.org/10.1038/s42256-019-0088-2

Using postal codes as a primary factor is the greatest concern because it can serve as a strong proxy for protected characteristics such as race and ethnicity. This can lead to a form of systemic bias known as "digital redlining," where credit decisions are unfairly influenced by an applicant's geographic location rather than their individual financial merit. This practice can perpetuate and amplify historical patterns of discrimination, posing significant ethical and legal risks. The other factors, while needing careful handling, are direct, standard indicators of an individual's financial history and capacity to repay, which are legitimate considerations in credit scoring.

A: An applicant's loan history is a direct and highly relevant measure of their past credit behavior, making it an appropriate and standard input for credit assessment.

B: Utilizing historical credit data is the fundamental principle of credit scoring models; it is the primary and most direct data for predicting future creditworthiness.

C: An applicant's income is a direct indicator of their financial capacity to repay a loan and is a legitimate and conventional factor in credit decisions.

1. O'Neil

C. (2016). Weapons of Math Destruction: How Big Data Increases Inequality and Threatens Democracy. Crown. (While a book

its concepts are foundational in university courses on AI ethics). Chapter 1 discusses how zip codes are used as proxies for race

leading to discriminatory outcomes in models for insurance

credit

and parole.

2. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0). NIST AI 100-1. Section 4.3.2

"Systemic and Human Biases

" discusses how proxy variables that correlate with protected classes can introduce harmful bias into AI systems.

3. Barocas

S.

& Selbst

A. D. (2016). Big Data's Disparate Impact. California Law Review

104(3)

671-732. Page 677 discusses how seemingly neutral variables

such as zip codes

can function as proxies for protected classes like race

leading to discriminatory outcomes that may violate anti-discrimination laws.

4. Hardt

M. (2018). CS 294: Fairness in Machine Learning. University of California

Berkeley. Lecture 1 notes discuss the sources of bias and discrimination in machine learning

including the use of proxy variables like zip codes in credit scoring as a classic example of redlining. Available from UC Berkeley course materials.

Developing an AI policy is the most critical foundational step before allowing end-user access. A policy establishes the organization's governance framework for AI, defining acceptable use, data privacy requirements, ethical guidelines, and security protocols. This directive control is a prerequisite for managing legal, reputational, and operational risks associated with AI. It provides the necessary structure upon which all other activities—such as risk assessments, disaster recovery planning, and performance monitoring—are based. Without a policy, AI use would be uncontrolled, exposing the organization to significant and unmanaged risks.

B: Determining the impact on the DRP is a necessary risk management activity, but it follows the policy which defines the AI tool's criticality and intended use.

C: Implementing performance metrics is an operational task to measure effectiveness and efficiency, which occurs after the rules for permissible use have been established by a policy.

D: Obtaining cybersecurity insurance is a risk transference strategy. It is considered after risks are identified and mitigated through primary controls, such as a formal policy.

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0). The "Govern" function is described as a cross-cutting activity foundational to an effective risk management program. It states

"Policies

processes

and procedures for AI risk management are established

communicated

and managed" (Section 4.1

GOVERN). This highlights policy as a primary

overarching requirement.

2. ISACA. (2023). Auditing Artificial Intelligence. The guide emphasizes the necessity of an AI governance framework

stating

"An AI governance framework should be established to ensure that AI systems are developed and used in a responsible and ethical manner... This framework should include policies

procedures and standards for AI development

deployment and use" (Chapter 2: AI Governance).

3. Russell

S.

& Norvig

P. (2021). Artificial Intelligence: A Modern Approach (4th ed.). While a broad textbook

chapters on the societal and ethical implications of AI (e.g.

Chapter 28) implicitly support the need for institutional policies to guide the application of AI technology responsibly

which must precede widespread use.

4. Stanford University Human-Centered Artificial Intelligence (HAI). (2021). Building a National AI Research Resource. Reports from institutions like Stanford HAI consistently emphasize the importance of governance structures and policies to guide AI development and deployment to ensure it aligns with societal values and organizational goals

establishing this as a prerequisite step.

Data usage agreements are the foundational legal documents that stipulate the permissible use of data, including any restrictions related to intellectual property (IP), privacy, and licensing. For an IS auditor, reviewing these agreements is the most direct and critical step to verify that the organization has the legal right to use the data for training, testing, and deploying the AI system. This review confirms compliance with contractual obligations and data rights, which is the central focus of the question.

A. Data performance metrics: These metrics evaluate the quality and effectiveness of the data for model training (e.g., accuracy, completeness), not the legal rights to use it.

C. Use of open-source intellectual property: While a component of IP compliance, this is narrower than data rights. Data usage agreements cover the core asset (the data), which is often more sensitive and legally complex.

D. Model runtime efficiency logs: These logs measure the computational performance and resource consumption of the AI model, which is an operational concern, not a legal or compliance issue.

1. ISACA. (2023). Artificial Intelligence Audit Framework. Section 2.2

Data Governance. The framework emphasizes that a key audit step is to "verify that data acquisition and usage are in accordance with legal

regulatory

and contractual requirements

" which are documented in data usage agreements.

2. ISACA. (2023). Auditing Artificial Intelligence. Chapter 3: AI Data and Governance. This chapter details the importance of auditing data sourcing and licensing

stating auditors must "review data-sharing and data use agreements to ensure that the organization has the right to use the data for the intended purpose."

3. Mittelstadt

B. (2019). "Principles alone cannot guarantee ethical AI." Nature Machine Intelligence

1

501–507. https://doi.org/10.1038/s42256-019-0114-4. This article discusses the governance of AI

implicitly highlighting that legal frameworks and agreements (data usage agreements) are essential mechanisms for ensuring data is used ethically and legally

a core concern for auditors.

Data cleaning is the most critical task during the data gathering and preparation phase of the AI system development process. The principle of "garbage in, garbage out" (GIGO) is fundamental to AI and machine learning; the quality of the input data directly dictates the performance, accuracy, and reliability of the resulting model. Raw data is often incomplete, inconsistent, or contains errors. Without a rigorous cleaning process to address these issues, any subsequent steps, including model training and validation, will be built on a flawed foundation, leading to a biased or ineffective AI system.

A. Stratifying the data: This is a sampling technique used to ensure representative data subsets. It is an important step but is secondary to ensuring the fundamental quality and accuracy of the data itself.

B. Isolating the system: This relates to security or operational deployment (e.g., sandboxing) and is not a task within the data gathering and preparation phase of the AI development lifecycle.

D. Training the system: Training is a distinct, subsequent phase in the AI lifecycle that relies on the successful completion of data gathering, cleaning, and preparation.

1. Zhang

Z.

Zhao

Z.

Zheng

Y.

Cui

Z.

& Chen

E. (2023). A Survey on Data Quality for Trustworthy AI. IEEE Transactions on Knowledge and Data Engineering

1-21. DOI: https://doi.org/10.1109/TKDE.2023.3324511. The paper emphasizes that high-quality data is a cornerstone for building trustworthy AI

and data cleaning is a primary method to improve data quality.

2. Bishop

C. M. (2006). Pattern Recognition and Machine Learning. Springer. In Chapter 1

the text introduces the machine learning workflow

highlighting the essential nature of a "pre-processing" stage (p. 4) to transform raw data into a suitable format

which includes cleaning and normalization

before any model training can occur.

3. Hastie

T.

Tibshirani

R.

& Friedman

J. (2009). The Elements of Statistical Learning: Data Mining

Inference

and Prediction. Springer. The book implicitly and explicitly discusses the need for data preparation and handling issues like missing values throughout its chapters

establishing it as a foundational step before applying learning algorithms.