Audit Readiness CRAGE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An insurance company is preparing for an audit of its AI claims processing system. The audit will cover both regulatory compliance and internal policy adherence. The company has multiple departments, each with its own documentation. What is the most effective way to define the audit scope?

   • AInvolve representatives from legal, compliance, IT, and business units to jointly define the scope
   • BFocus only on the IT department's documentation
   • CLet the external auditor define the scope based on their standard checklist
   • DUse the audit scope from the previous year without changes
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An autonomous vehicle company is preparing for a safety audit. The audit will require evidence that the AI system's decisions can be traced to specific sensor inputs and that any overrides by safety drivers are logged. The company's current logging system records sensor data and decisions, but does not record when a safety driver takes manual control. What is the most critical improvement to the audit trail?

   • AAdd an event log that records when the safety driver overrides the AI, including the reason and the resulting action.
   • BStore the sensor data in a separate database to improve performance.
   • CIncrease the frequency of sensor data logging from 10 Hz to 100 Hz.
   • DRetain the sensor data for a longer period, such as five years.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A retail company's AI governance team has performed a gap analysis against the organization's AI risk management framework. They found that the model validation process is not consistently followed, and that there is no formal procedure for documenting model changes. The team has limited resources and must decide which gaps to address first. What is the most appropriate prioritization criterion?

   • APrioritize gaps that were identified first in the gap analysis.
   • BPrioritize gaps that are most visible to senior management.
   • CPrioritize gaps that are easiest to fix, regardless of their impact.
   • DPrioritize gaps that pose the highest risk to regulatory compliance and to the safety or fairness of the AI system.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A healthcare AI startup is preparing for its first SOC 2 audit. The audit will assess the design and operating effectiveness of controls over the AI system that triages patient messages. The engineering team has been keeping informal notes in a shared chat channel about model updates and incident responses. The compliance lead needs to establish a defensible evidence collection process. What should the compliance lead do first?

   • AAsk the engineering team to export the chat logs and organize them into folders by date.
   • BWait until the auditor provides a detailed evidence request list, then collect everything at that time.
   • CCreate a simple spreadsheet listing all model changes and incidents, and share it with the auditor.
   • DDefine a formal evidence repository with versioned documents, access controls, and a retention policy aligned to the audit period.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A telecommunications company is preparing for an audit of its AI-based customer churn prediction system. The audit will verify that the system was developed and deployed in accordance with the company's AI governance policy. The company has a policy document, but the actual development process was not consistently followed. What is the most important aspect of audit readiness in this situation?

   • ABeing able to demonstrate that the development process actually followed the policy, or to explain and remediate any deviations.
   • BEnsuring that the audit team has access to the policy document and the system's source code.
   • CHaving a well-written policy document, even if it was not followed in practice.
   • DPreparing a presentation that explains the policy and the system's features to the auditor.
   Reveal Solution Discussion Select an answer first