A risk practitioner is concerned that an AI model's responses have become more inaccurate over...

Incident response for AI model degradation should follow a structured diagnostic process. Before implementing any corrective action, the scope and nature of the accuracy issues must be understood to ensure the response is appropriate and targeted.

Why D is Correct: According to ISACA AAIR incident response guidance, the first step when AI model accuracy deteriorates is to assess the impact—understanding which specific features are affected, how model outputs have changed, and what the business consequences are. This diagnostic step informs all subsequent decisions about whether to retrain, add validation cycles, or take the system offline. Acting without this assessment may waste resources on inappropriate responses or leave critical issues unaddressed.

Why A is Wrong: Adding validation review cycles is a process change that may be appropriate but cannot be determined without first understanding the nature and scope of the accuracy problem. Reviews address a symptom without diagnosing the cause.

Why B is Wrong: Taking the model offline and backing it up is a drastic operational measure that may be disproportionate to the actual issue. This decision requires understanding the severity and scope of the problem, which requires impact assessment first.

Why C is Wrong: Full model retraining is resource-intensive and may not address the root cause if the problem is not training data staleness. Impact assessment must precede the decision to retrain.