Last updated:
AAISM preparation guide
AAISM monitoring trap: who acts after go-live?
Direct answer
Validation shows an AI system met its acceptance criteria under the conditions tested. The trap is treating that as enough and adding monitoring later. AI behaviour can drift and be misused after release, so the stronger answer names, before go-live, who owns live performance, which thresholds trigger action, and who acts when one is crossed.
ISACA's outline covers this in 3E, security controls and monitoring, with links to 1D, the AI security program.
Monitoring with no owner is a dashboard, not a control.
Start AAISM baselineMonitoring that works
| Trap | Why it feels right | What the stronger answer does |
|---|---|---|
| Go live, monitor later | Validation passed | Sets owners and thresholds before go-live |
| Alerts to a shared inbox | Everyone can see them | Routes alerts to someone accountable |
| Watching accuracy only | Accuracy is the headline figure | Watches drift, misuse and changes in inputs too |
Original teaching example
A hospital is about to deploy a sepsis-alert model that passed validation. No one owns its performance after launch, and alerts about the model's performance would go to a shared inbox.
Validation passed, but operation has no owner. The stronger answer, before go-live, names an owner, sets performance and drift thresholds, decides who acts when a threshold is crossed, and sends alerts to someone accountable.
Validation is a point in time
It shows the system met its criteria when tested, not after release.
Data, users and attackers change. Monitoring is how the organization learns that the model no longer fits.
Owner, threshold, response
Each needs a name before go-live.
An owner reviews the signals, a threshold says when to act, and a response plan says what happens, including rollback or human fallback.
What to monitor
Performance, drift, misuse and input changes.
Accuracy alone can hide failure in the cases that matter. Break results down by the conditions the model meets in service.
Where this appears in the outline
3E, security controls and monitoring, and 1D, the program.
Incident response (1E) depends on monitoring that someone owns.
Sources and fact check
Source checked: 2026-10-12
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
Can monitoring be added after launch?
It can, but the stronger answer sets the owner and thresholds before go-live.
What is model drift?
A change in the data a model sees (data drift) or in how inputs relate to outcomes (concept drift) after training. Either can reduce performance, so monitoring watches inputs as well as results.
Who should own AI monitoring?
Someone accountable for the system in operation, with authority to act on the signals.
Which domain does this trap belong to?
Mainly Domain 3, with links to Domain 1.
How do I spot it in a question?
Look for a system that passed testing but has no named owner or threshold for operation.
