AI Control Selection and Design

Overview
AI Control Selection and Design is the stage of the AI risk program where identified and assessed AI risks are translated into concrete safeguards. Having completed risk identification, analysis and evaluation, the organization must decide which controls to implement, how they should be designed, where in the AI lifecycle they belong and who owns them. In the ISACA Advanced in AI Risk (AAIR) body of knowledge this topic sits within the AI Risk Program Management domain and connects risk treatment decisions to day-to-day operational practice.

Why It Is Important
AI systems introduce risks that traditional IT controls were never designed to address: model drift, data poisoning, prompt injection, hallucination, algorithmic bias, opacity and the inability to fully predict emergent behaviour. If controls are selected generically (for example, simply applying a classic change-management policy) they will leave AI-specific exposures untreated. Conversely, over-controlling a low-risk AI use case wastes resources and slows innovation. Good control selection and design therefore:
• Ensures risk is reduced to a level within the organization's risk appetite and tolerance.
• Demonstrates regulatory alignment (EU AI Act, sector regulators, privacy laws) and framework alignment (NIST AI RMF, ISO/IEC 42001, ISO/IEC 23894, COBIT).
• Supports trustworthy AI principles: fairness, transparency, accountability, robustness, safety, privacy and security.
• Provides the evidence base for assurance, audit and board reporting.
• Creates a defensible, documented link between each significant risk and the safeguard that treats it.

What It Is
Control selection is the process of choosing safeguards that address a specific AI risk scenario, based on the risk treatment decision (mitigate, transfer, avoid or accept). Control design is the detailed specification of how a chosen control will operate: its objective, trigger, frequency, owner, inputs, outputs, evidence and metrics. Together they answer two questions: Are we doing the right things? (selection) and Are we doing them the right way? (design).

Key concepts examiners expect you to know:
• Control objective – the outcome the control is meant to achieve (e.g., 'model outputs are free from unlawful discriminatory bias').
• Control categories by function – preventive (stop the event), detective (identify the event), corrective (restore after the event), plus deterrent, compensating and directive controls.
• Control categories by nature – administrative/managerial (policies, governance committees, training), technical (access controls, guardrails, monitoring tooling), and physical (secure data centres, hardware isolation).
• Compensating control – an alternative safeguard used when the primary control is not feasible, delivering equivalent risk reduction.
• Key control – a control whose failure would most likely result in a material risk event; these receive priority in testing.
• Inherent vs residual risk – controls are selected to move inherent risk toward an acceptable residual risk.
• Defence in depth / layered controls – multiple complementary controls so no single failure exposes the organization.
• Control baseline – a minimum set of controls applied to every AI system, supplemented by risk-based additional controls.

How It Works – The Selection and Design Process
1. Start from the risk register and treatment decision. Each risk scenario carries a likelihood, impact, risk owner and treatment choice. Only risks selected for mitigation (or partial transfer) require new or enhanced controls. Controls must map explicitly to the risk they address; orphan controls and untreated risks are both red flags.

2. Determine the AI system's risk tier. Most frameworks (EU AI Act, NIST AI RMF profiles, ISO/IEC 42001 Annex A) are risk-tiered. High-risk uses (credit decisions, hiring, medical, critical infrastructure, biometric identification) demand stronger, more frequent and more independent controls than low-risk uses (internal document summarization). Proportionality is a core AAIR principle.

3. Consult authoritative control catalogues. Candidates should recognize common sources: NIST AI RMF (Govern, Map, Measure, Manage functions), NIST AI 600-1 Generative AI Profile, ISO/IEC 42001 Annex A controls, ISO/IEC 23894 guidance, ISO/IEC 27001 Annex A for security, COBIT management objectives, OWASP Top 10 for LLM Applications, and sector regulatory expectations. Catalogues speed selection and improve defensibility, but controls still need tailoring.

4. Map controls across the AI lifecycle. Examiners frequently test lifecycle placement:
• Design / use-case approval – AI use-case intake, ethical impact assessment, legal and privacy review, go/no-go gates, defined acceptable use.
• Data – data provenance and lineage, consent and lawful basis, data quality checks, representativeness and bias testing, data minimization, poisoning defences, access control.
• Model development – documented model cards, feature-selection review, fairness and robustness testing, adversarial testing, explainability techniques, version control, segregation of duties between developers and approvers.
• Validation / pre-deployment – independent model validation, red teaming, acceptance criteria, performance thresholds, human-oversight design, fallback and kill-switch mechanisms.
• Deployment / operation – guardrails and output filters, prompt-injection defences, rate limiting, logging, continuous performance and drift monitoring, bias monitoring, incident response, user disclosure and transparency notices, human-in-the-loop or human-on-the-loop review.
• Monitoring / retirement – periodic re-validation, retraining triggers, model inventory maintenance, decommissioning and data disposal.

5. Address third-party and supply-chain AI. When models, APIs or training data come from vendors, controls shift toward due diligence, contractual clauses (audit rights, transparency, incident notification), SBOM/model-provenance review, independent testing of vendor outputs and exit strategies. You cannot outsource accountability, only the activity.

6. Design each control in detail. A well-designed control specifies: objective, risk(s) addressed, type (preventive/detective/corrective; manual/automated), frequency, trigger, owner and operator, inputs and outputs, evidence produced, exception handling, escalation path and performance metrics (KCIs/KRIs). Automated controls are generally preferred for high-volume, repeatable activities; manual controls are retained where judgement is required.

7. Perform cost-benefit and feasibility analysis. The cost of a control (financial, latency, accuracy trade-off, user friction) should not exceed the value of the risk reduction. Where a preferred control is impractical, document a compensating control or a formal risk acceptance by the appropriate authority.

8. Validate design before relying on it. Design effectiveness (would the control, if operated as intended, achieve the objective?) must be confirmed before operating effectiveness testing. Walkthroughs, tabletop exercises and pilot deployments are common techniques.

9. Document, assign ownership and integrate with monitoring. Controls are recorded in the control library and linked to the AI system inventory, the risk register and the assurance plan. Ownership is assigned to the first line, with second-line oversight and third-line independent assurance (three lines model).

Design Principles Frequently Tested
• Risk-based and proportionate – control strength follows risk tier.
• Layered – combine preventive, detective and corrective controls.
• Lifecycle-embedded – controls built in, not bolted on.
• Human oversight – meaningful human review proportionate to the consequence of error.
• Measurable – every control should produce evidence and a metric.
• Traceable – clear link from risk to control objective to control activity to evidence.
• Adaptive – AI risk changes with drift, new data and new threats, so controls require periodic review and continuous monitoring.
• Segregation of duties – developers should not approve their own models into production.
• Fail-safe – when a control or model fails, the system should default to a safe state or human fallback.

Common Pitfalls
• Selecting controls before completing risk assessment (control-first thinking).
• Applying a uniform control set regardless of risk tier.
• Relying solely on vendor assurances for third-party models.
• Designing detective controls without a corrective response path.
• Treating explainability or fairness as one-time pre-deployment tests rather than ongoing controls.
• Failing to assign a named owner, leading to controls that exist on paper only.
• Confusing design effectiveness with operating effectiveness.

Exam Tips: Answering Questions on AI Control Selection and Design
1. Follow the sequence. If a question asks what should happen first or before selecting controls, the answer is almost always to complete or review the risk assessment, confirm risk appetite, or understand the business context. ISACA consistently rewards risk-before-control logic.
2. Think proportionality. When options differ in intensity, pick the one that matches the stated risk level. The 'most stringent control everywhere' answer is usually a distractor, as is the 'accept the risk because controls are expensive' answer for a high-risk system.
3. Prefer the control that addresses root cause. If a model produces biased outcomes due to unrepresentative training data, the best control fixes data representativeness, not merely adding a disclaimer.
4. Match control type to the question verb. 'Prevent' points to preventive controls (input validation, access restriction, approval gates); 'identify' or 'detect' points to monitoring, logging and drift detection; 'recover' or 'respond' points to rollback, retraining and incident response.
5. Lifecycle placement matters. Questions often describe where a problem emerged. Controls should be positioned at the earliest practical lifecycle stage; for instance, data-quality controls belong before training, not after deployment.
6. Human oversight is a frequent correct answer for high-impact decisions. For consequential or irreversible decisions (health, employment, credit, legal), expect human-in-the-loop or meaningful human review to feature in the best answer.
7. Watch for compensating controls. If the scenario says the ideal control is infeasible, look for the answer that implements an alternative delivering equivalent risk reduction and documents it, rather than ignoring the gap.
8. Accountability cannot be outsourced. For third-party AI questions, the best answer involves due diligence, contractual rights and independent testing, not simply relying on the vendor's certification.
9. Documentation and ownership are not optional extras. If two answers both seem technically valid, the one that includes assigning an owner, defining metrics or recording the control in the register is usually preferred by ISACA.
10. Distinguish design from operation. If the question concerns whether a control 'would work if performed as described', it is design effectiveness; if it concerns whether it 'has actually been working over the period', it is operating effectiveness.
11. Eliminate absolute or one-time answers. Options containing words like 'eliminate all risk', 'test once before deployment' or 'no further monitoring needed' conflict with the adaptive nature of AI risk and are typically wrong.
12. Use the governance role lens. The AI risk professional recommends and designs controls and reports residual risk; the risk owner or appropriate governance body makes the acceptance decision. Answers that have the risk practitioner unilaterally accepting risk are usually incorrect.
13. Read for the 'BEST' or 'MOST' qualifier. Several options may be plausible; choose the one that is most directly linked to the specific risk described, most proportionate and most sustainable over time.

Quick Recap
AI Control Selection and Design converts risk treatment decisions into tailored, proportionate, lifecycle-embedded, measurable and owned safeguards. Select controls from recognised catalogues based on the assessed risk tier, layer preventive, detective and corrective mechanisms, design each control with clear objectives and evidence, validate the design, and keep controls under continuous review as the AI system, data and threat landscape evolve. In the exam, anchor every answer to the risk assessment, proportionality, lifecycle placement, root cause, human oversight where consequences are high and clear accountability.