Last updated:
AAISM preparation guide
AAISM vendor trap: the provider's evidence is not yours
Direct answer
When an organization buys an AI service, it still owns the decision to use it. The trap is accepting the vendor's general testing as proof that the service fits this organization's use. The stronger answer keeps accountability inside: evidence for its own use, contract terms for audit evidence and change notice, and a named internal owner.
ISACA's outline covers this in 2C, AI vendor and supply chain management, which lists AI deployer considerations and the AI shared responsibility model among its topics.
A reputable vendor and a strong audit report are useful inputs. They are not the organization's own assessment.
Start AAISM baselineVendor evidence versus your evidence
| Trap | Why it feels right | What the stronger answer does |
|---|---|---|
| Relying on the vendor's audit | The vendor built the model and knows it best | Tests the service against the organization's own use and data |
| Transferring the risk by contract | The contract makes the vendor liable | Keeps the decision and its oversight with an internal owner |
| Waiting for the vendor to report problems | The vendor monitors its own service | Sets change notice, evidence rights and internal monitoring |
Original teaching example
An HR team buys a CV-screening AI service. The vendor provides a bias audit of its general model. The HR director wants to switch it on for all hiring next week.
The vendor's audit is about its general model, not this company's roles and applicants. The stronger answer tests the service for bias and adverse impact on the company's own roles with a representative sample and privacy approval. It checks the legal duties for AI in hiring, keeps human review of rejections, secures contract terms for audit evidence and change notice, names an internal owner, and starts with a limited rollout rather than all hiring.
Deployers keep accountability
Buying a service does not hand over the decision to use it.
The organization chooses where and how the AI is used, so it must judge whether the service fits that use.
What evidence to ask for
Evidence that matches your use, not only the vendor's.
Testing on representative data for your use, documentation of training data and limits, and notice of changes to the model.
Contracts help, but don't decide
Contract terms support oversight; they don't replace it.
Audit rights, change notice and incident reporting give the internal owner what they need to oversee the service.
Where this appears in the outline
2C, AI vendor and supply chain management.
Related outline areas are 1B (AI policy) and 2A (assessing the risk before approval).
Sources and fact check
Source checked: 2026-10-12
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
Is the vendor ever responsible?
Yes, for what the contract and service model assign to it and for duties that law places on AI providers. The organization still decides whether and how to use the service.
Is a third-party audit enough?
It is useful evidence, but it may not cover your use, your data or your population.
What should happen before go-live?
An assessment against your own use, the contract terms you need, and a named internal owner.
Does this apply to open-source models too?
Yes. A downloaded model is a supply-chain component; you still need evidence it fits your use.
Which domain does this trap belong to?
Mainly Domain 2, AI risk management.
