Audit Readiness CRAGE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A financial technology company is preparing for an audit against a new AI governance regulation. The gap analysis revealed that the company lacks a formal model risk assessment process and does not have a documented procedure for handling AI incidents. The company has a small compliance team and a tight deadline before the audit. Which remediation strategy is most appropriate given the constraints?

   • ADevelop a minimal viable model risk assessment process and an AI incident response procedure, focusing on the core requirements of the regulation.
   • BDelay the audit until the company can fully remediate all gaps.
   • CAttempt to fully implement a comprehensive AI governance framework, including all best practices, before the audit.
   • DHire an external consultant to handle all remediation, without involving internal staff.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which activity is part of continuous readiness monitoring?

   • AWaiting for an audit to be announced before preparing any documentation.
   • BConducting a one-time gap analysis and never revisiting it.
   • CDeleting old audit logs to free up storage.
   • DPeriodically reviewing and updating audit documentation to reflect new regulatory requirements.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A food delivery company uses AI to predict delivery times. During an audit preparation, the team realizes that the evidence for model validation is stored in an email thread and may be incomplete. What is the best practice for maintaining this evidence?

   • ATransfer the validation records to a formal document management system with version control
   • BAsk the auditor if they will accept the email thread as evidence
   • CKeep the email thread as is because it is the original record
   • DRecreate the validation records from memory
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A large e-commerce company has an AI-based recommendation system. The company's audit readiness program is updated annually. A new data protection regulation is expected to take effect in six months, and it will require that AI systems provide explanations for automated decisions. The company's current system does not generate explanations. The compliance team must decide how to update the readiness program. What is the most appropriate action?

   • ABegin a project to design and implement an explanation generation capability, and update the audit readiness program to include the new requirement immediately.
   • BUpdate the audit readiness program to note the upcoming requirement, but delay the implementation until after the next annual review.
   • CWait until the regulation is officially published, then update the program and start the project.
   • DAsk the external auditor to advise on how to meet the new regulation, and follow their recommendations.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A non-profit organization uses an AI system to screen job applicants. They have been invited to participate in a voluntary AI ethics audit by an industry consortium. The organization has no formal AI governance framework. What is the most important benefit of achieving audit readiness in this context?

   • AIt guarantees that the AI system will be free of bias
   • BIt reduces the cost of the AI system's operation
   • CIt eliminates the need for future regulatory audits
   • DIt demonstrates the organization's commitment to responsible AI and builds trust with stakeholders
   Reveal Solution Discussion Select an answer first