Audit Readiness CRAGE Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A financial services firm is preparing for an external audit of its AI-based credit scoring system. The auditor has stated that the audit will focus on compliance with the EU AI Act's requirements for high-risk AI systems and the firm's internal model risk management policy. The compliance team has been asked to assemble the necessary documentation. Which action best aligns the audit preparation with the stated scope and criteria?

   • ARequest the auditor to narrow the scope to only the model's accuracy metrics, as other aspects are not material.
   • BGather all data processing logs from the last five years, regardless of relevance, to ensure no information is missing.
   • CPrepare a summary of the model's outputs for the last quarter, as the audit is only concerned with current performance.
   • DCollect the model's development documentation, validation reports, and the internal policy that defines the model risk management process.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A financial services firm is preparing for an audit of its AI-driven credit scoring model. The audit team will need to verify that the model's decisions are traceable and that the evidence is authentic. The firm currently stores audit logs in a shared network drive where any administrator can modify them. What is the most appropriate action to improve audit readiness?

   • AExport the logs to a spreadsheet and store it on the same shared drive
   • BDelete old logs to reduce the amount of evidence the auditor must review
   • CImplement a tamper-evident logging solution with access controls and regular integrity checks
   • DGrant all administrators full access to the logs to ensure they are complete
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A hospital uses an AI system for patient diagnosis support. The system's audit logs are stored on-premises, but the hospital is considering moving to a cloud-based logging solution to reduce costs. The hospital's compliance officer is concerned about data privacy and the ability to produce logs during an audit. What is the most important consideration when deciding on the logging solution?

   • AChoose the cheapest cloud provider to minimize costs
   • BAllow the cloud provider to manage all access to the logs
   • CEnsure the cloud provider offers data residency in the required jurisdiction and guarantees log immutability
   • DKeep logs on-premises because cloud is never compliant for healthcare
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   After identifying deficiencies in AI governance, what should be included in a remediation plan?

   • AA summary of the audit findings without any actions.
   • BSpecific actions, responsible owners, and timelines for addressing each gap.
   • CA budget for marketing the AI system.
   • DA list of all AI projects that were cancelled.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A technology company is preparing for an ISO/IEC 42001 audit of its AI management system. The audit will require evidence that the AI system's performance is monitored and that corrective actions are taken when needed. The company currently stores monitoring reports in a shared drive with no version control. What is the most important improvement to make to the evidence management process?

   • AStore the reports in a cloud storage service with a longer retention period.
   • BImplement a document management system that records version history, approval dates, and access permissions.
   • CIncrease the frequency of monitoring reports from monthly to weekly.
   • DAsk the monitoring team to sign each report manually to prove authenticity.
   Reveal Solution Discussion Select an answer first