AAISM emphasizes systemic or structural bias as a high-impact risk because biased data leads directly to discriminatory insights or decisions when used for analytics or reporting. This risk affects fairness, compliance, and organizational reputation.

AAISM materials emphasize that the primary ethical concern with generative AI is the risk to information integrity. Generative models can create content that appears authentic but is fabricated, misleading, or manipulated. This undermines trust in information ecosystems and can have wide-reaching social, legal, and organizational impacts. While confidentiality breaches and bias are concerns, they are not the central ethical issue inherent to generative models. Availability is less relevant in this context. The most pressing concern is that generative AI may compromise the integrity of information.
References:
AAISM Study Guide - AI Risk Management (Ethical Risks of Generative AI) ISACA AI Security Management - Integrity Concerns in Generative Systems

According to the AAISM framework, the first step in drafting an acceptable use policy is defining the scope and intended use of the AI system. This ensures that governance, regulatory considerations, risk assessments, and alignment with organizational policies are all tailored to the specific applications and functions the AI will serve. Once scope and intended use are clearly defined, legal, regulatory, and risk considerations can be systematically applied. Without this step, policies risk being generic and misaligned with business objectives.
References:
AAISM Study Guide - AI Governance and Program Management (Policy Development Lifecycle) ISACA AI Governance Guidance - Defining Scope and Use Priorities

AAISM guidance states that when adopting AI, the most important step is to conduct a risk assessment and update the enterprise risk register. This ensures AI-specific risks are identified, documented, and integrated into the organization's existing governance structures. Benchmarking peers provides context but does not address internal risk. Implementing methodologies and frameworks are important, but they precede or follow the assessment process. The decisive step that connects adoption to enterprise risk governance is updating the risk register with AI-specific risks.
References:
AAISM Study Guide - AI Risk Management (Integration with Enterprise Risk Management) ISACA AI Security Management - Risk Assessment and Register Updates

The model owner has the deepest understanding of how the AI model was designed, trained, and behaves. This expertise is essential for investigating unusual or incorrect decisions, identifying root causes, and determining whether the issue stems from model logic, data, or configuration.