Audit Readiness CRAGE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company has an AI system that has been in production for two years. The system was developed before the company established a formal AI governance program. The company is now preparing for its first external audit. The audit will assess the system's compliance with current regulations. The company has limited historical documentation. What is the most appropriate approach to achieve audit readiness?

   • ADecommission the AI system and build a new one with proper documentation
   • BArgue that the system is exempt from current regulations because it was developed earlier
   • CRecreate the development process as if it had followed the current governance framework
   • DConduct a retrospective gap analysis and create documentation that reflects the system's actual development and operation
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A credit union is preparing for its first external audit of its AI-based loan approval system. The audit will assess compliance with fair lending laws and the credit union's internal AI governance policy. The credit union has a small staff and has never undergone an AI audit. The compliance officer wants to ensure the organization is ready. What is the most important first step in establishing audit readiness?

   • AConduct a self-assessment against the fair lending laws and the internal AI governance policy to identify gaps in documentation and processes.
   • BBegin collecting all possible documentation, including emails and meeting notes, to ensure nothing is missed.
   • CHire an external auditor to conduct a pre-audit and provide a report of findings.
   • DPurchase an AI governance software platform to automate evidence collection.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A manufacturing company has implemented an AI-based predictive maintenance system. The compliance team has established an audit readiness program, but the program is reviewed only once a year. A new regulation is announced that will require additional documentation for AI systems used in safety-critical applications. What should the compliance team do to maintain continuous readiness?

   • AEstablish a process to monitor regulatory changes and update the audit readiness program when new requirements are identified.
   • BConduct a one-time gap analysis against the new regulation and document the results.
   • CWait until the regulation is fully in force, then update the program to meet the new requirements.
   • DAsk the external auditor to interpret the new regulation and provide a compliance roadmap.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A global bank is preparing for a dual audit: an internal audit focused on model risk management and an external regulatory audit focused on fair lending. The internal audit uses the bank's own model risk framework, while the regulatory audit uses the fair lending examination procedures. The two audits have different scopes, criteria, and evidence requirements. The bank's audit readiness team has limited resources and must prepare for both simultaneously. What is the most effective approach?

   • ACreate a unified evidence repository that maps each piece of evidence to both audit frameworks, identifying overlaps and unique requirements.
   • BAsk the internal audit team to adopt the regulatory audit's criteria to simplify the process.
   • CAssign separate teams to each audit, with no coordination between them, to avoid confusion.
   • DPrepare for the regulatory audit first, as it has legal consequences, and then address the internal audit later.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In the context of AI governance and assurance, what does 'audit readiness' primarily refer to?

   • AThe final report issued by auditors after completing an AI system assessment.
   • BThe process of conducting an internal audit to identify non-compliance issues before an external audit.
   • CThe state of being prepared to undergo an AI audit, with documented policies, processes, and evidence readily available for review.
   • DThe automated tooling used to continuously monitor AI model performance in production.
   Reveal Solution Discussion Select an answer first