An IS auditor is evaluating an organization's incident management program to ensure it is sufficiently prepared to manage AI-related incidents. Which of the following is MOST important for the…

Mandating retraining after every incident is overly prescriptive and may not always be appropriate; the program should assess whether retraining is needed rather than require it universally.

Using past incidents to categorize current ones is a useful practice but reflects reactive categorization rather than proactive readiness for AI-specific incident types.

AI systems are subject to unique threats including model drift (where model performance degrades over time as real-world data changes) and data integrity attacks (where adversarial actors manipulate training or input data). An incident management program must include specific detection and response procedures for these AI-specific scenarios to be considered adequately prepared. Without these, the program cannot effectively address the most distinctive and consequential AI incident types.

Prioritizing incidents by alignment with industry leading practices is a general approach that does not address the specific technical risks unique to AI systems.