An IS auditor learns that an organization uses AI facial recognition technology for security purposes.

According to the ISACA AAIA™ Study Guide, facial recognition systems are prone to significant ethical risks related to fairness and bias. These systems often exhibit higher error rates for specific demographic groups—particularly based on race, gender, and age—due to non-representative training datasets. For an IS auditor, this represents a major compliance and reputational risk, as biased outcomes can lead to discriminatory access or false accusations. While data security (Option A) and the lack of standards (Option C) are relevant, the fundamental ethical imperative in AI governance is ensuring that biometric applications do not disproportionately disadvantage protected groups.