Last updated:
AAISM preparation guide
AAISM life-cycle trap: the right control at the wrong stage
Direct answer
A sound control can still be the weaker answer. CertArc's technique: before choosing, name the stage of the AI life cycle the scenario is in (design, data, training, validation, deployment, monitoring or retirement) and the evidence gap it shows. Then prefer the control that closes that gap now, even when it sends work back to an earlier stage, over one that would only notice the problem later.
ISACA's outline gives the AI life cycle its own subarea, 3B, inside Domain 3, which is 38% of the exam.
Monitoring a live model, for example, is a strong control, but it cannot replace evidence that validation still lacks.
Start AAISM baselineSpot the stage before the control
| Trap | Why it feels right | What the stronger answer does |
|---|---|---|
| A later-stage control for an early gap | Monitoring or alerting sounds thorough | Fixes the gap at the stage where it was found |
| An earlier-stage control after go-live | Redesign sounds fundamental | Contains and manages the live risk first, then feeds lessons back |
| A generic control with no stage | Policy or training always sounds safe | Names the stage-specific control the scenario lacks |
Original teaching example
A logistics company's demand-forecasting model is in validation. A reviewer finds that the training data left out two regions the model will serve, and no results exist for those regions yet. One option is to approve it and add monitoring for those regions after launch.
The gap is missing evidence, not drift over time, so post-launch monitoring cannot stand in for it. The stronger answer validates the model on representative data from the two regions before sign-off. If it falls short, improve the data, retrain and revalidate, or limit the intended use to the regions covered.
Name the stage first
Read the scenario for where the system is now, not where it will be.
Words such as proposed, piloting, in validation or in production tell you the stage. Choose the control that closes the gap the scenario shows, given that stage.
Why later controls are tempting
They sound thorough and they are real controls.
But when a gap is already known, a control that only detects its effects after release is weaker than one that closes it first.
When the system is already live
Then the system is deployed and monitored, and the answer changes.
When a live system poses unacceptable risk, containing it comes first. Redesign may follow, but it does not protect users today.
Where this appears in the outline
Mostly 3B, the AI life cycle, with links to 1C, 3C and 3E.
1C covers the AI asset and data life cycle, 3C data management controls and 3E security controls and monitoring.
Sources and fact check
Source checked: 2026-10-12
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
What life-cycle stages does AAISM use?
ISACA's outline names the AI life cycle, with model selection, training and validation as examples. CertArc's questions use design, data, training, validation, deployment, monitoring and retirement.
Is monitoring ever the right answer?
Yes, when the system is deployed and the gap is something that appears over time, such as drift or misuse. Monitoring during training and validation has its place too.
Is this a rule that early controls always win?
No. The stronger control is the one that fits the stage the scenario describes.
Which domain does this trap belong to?
Mainly Domain 3, AI technologies and controls.
How do I practise it?
Before reading the options, write down the stage the scenario is in. Then check whether your chosen option acts at that stage.
