Chapter 2 of 3 · ISACA AAISM
AI Risk Management
AI risk assessment, thresholds and treatment, the AI threat landscape, testing and vulnerability management, and AI vendors.
- 4topics
- 22 minfast track
- 2diagrams and exhibits
- 31%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1AI Risk Assessment, Impact Assessment and TreatmentAssessing AI risk within enterprise risk management: risk tiers, impact assessments, thresholds, treatment, residual risk and…Diagram6 min
- 2The AI Threat LandscapeAI threats at concept level: poisoning, evasion, extraction, inference, prompt injection, the OWASP Top 10 for LLM Applications…5 min
- 3AI Testing, Red Teaming and Vulnerability ManagementDesigning AI security testing: robustness and safety evaluation, red teaming rules, model and dependency scanning, AI…5 min
- 4AI Vendor and Supply Chain ManagementManaging AI vendors and supply chain: model providers, embedded SaaS AI, open-source models, due diligence, contract terms…Diagram6 min
About this chapter
What this chapter covers
AI Risk Management is 31% of the ISACA AAISM exam. It is about assessing and managing the risks, threats, vulnerabilities and supply chain issues that come with enterprise-wide adoption of AI, and keeping AI risk inside the organization's appetite as models, data, threats and regulation change.
The domain covers AI risk assessment, thresholds and treatment (2A), AI threat and vulnerability management (2B), and AI vendor and supply chain management (2C).
The exam has 90 multiple choice questions, and candidates must already hold CISM or CISSP.
Questions are scenarios from the security manager's viewpoint. You choose what the manager should do FIRST, what is the BEST treatment, or what is MOST important before relying on a model or vendor. Expect the AI twist on familiar risk ideas: impact assessments, reassessment triggers, red teaming and the many third parties behind a single AI feature.
How the topics fit together
Risk assessment sets the context and thresholds, threat and vulnerability work shows how AI could be attacked or fail, and testing confirms whether controls hold. Because most AI depends on outside models, data and services, vendor and supply chain management runs alongside every step.
The business owner accepts AI risk, within the appetite senior management sets. The security manager facilitates the assessment, advises on treatment and reports. When AI risk exceeds appetite, escalate; do not accept it on the business's behalf.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISACA AAISM question bank has 747 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.