A risk practitioner learns that an organization's AI inventory includes separate listings of AI systems,...

An AI inventory that lists systems, models, and datasets separately without showing how they relate to each other creates significant governance blind spots. Understanding interdependencies is critical for comprehensive risk assessment and impact analysis.

Why A is Correct: The ISACA AAIR framework emphasizes that AI governance requires understanding how AI components interact. Mapping interdependencies reveals which datasets feed which models, which systems depend on which models, and how failures cascade across the AI ecosystem. Continuous mapping ensures this understanding remains current as the AI landscape evolves, enabling accurate risk assessment, change impact analysis, and incident response.

Why B is Wrong: Training frequency is a useful operational metric but represents a single attribute addition to inventory records. It does not address the fundamental governance gap of disconnected asset listings.

Why C is Wrong: Automating reconciliation improves inventory maintenance efficiency but does not resolve the architectural problem of separate, unlinked asset listings. An automated process applied to siloed data still produces siloed results.

Why D is Wrong: Assigning oversight to a committee addresses governance accountability but does not improve the quality or utility of the inventory itself. Oversight without integrated data still leaves governance gaps.