Audit Readiness CRAGE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A multinational corporation operates AI systems in multiple regions, each subject to different data protection regulations. An internal audit readiness review found that the AI governance framework is centralized but does not account for regional variations. The company has limited resources to update the framework. What is the most effective approach to remediate this gap?

   • AAdopt the strictest regional regulation as the global standard for all regions
   • BFocus only on the region with the largest operations and ignore others
   • CCreate separate governance frameworks for each region independently
   • DDevelop a tiered governance framework that sets global minimum standards and allows regional adaptations
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A bank is preparing for a regulatory audit of its AI-based anti-money laundering (AML) transaction monitoring system. The audit will assess the system's effectiveness and compliance with AML regulations. The bank's compliance officer, data science team, and IT operations team all need to contribute. The compliance officer is unsure how to divide the work. Which approach best clarifies stakeholder roles?

   • AAsk the external auditor to specify exactly who should provide each piece of evidence.
   • BLet the data science team handle all audit requests because they understand the model best.
   • CCreate a responsibility assignment matrix that maps each audit requirement to a specific owner and supporting team.
   • DHave the IT operations team compile all evidence because they control the systems.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A mid-sized insurance company is planning to undergo its first external audit of its AI underwriting system. The audit will assess compliance with the company's internal AI ethics policy and applicable insurance regulations. The company has never prepared for an AI audit before. What is the primary purpose of establishing an audit readiness program in this context?

   • ATo ensure that the organization can demonstrate, through documented evidence, that its AI system operates in accordance with the defined policies and regulations.
   • BTo guarantee that the AI system will pass the audit without any findings.
   • CTo replace the internal audit team with an external auditor for all future assessments.
   • DTo automate the AI system's decision-making so that manual review is no longer required.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A fintech company has an AI system for loan approvals. The company is subject to both GDPR and local financial regulations. The compliance team has implemented a continuous readiness monitoring process, but the process is manual and relies on quarterly reviews. A new local regulation is expected to take effect in two months, requiring additional audit logs. What is the most effective way to adapt the monitoring process?

   • AWait until the regulation takes effect and then update the monitoring process
   • BRely on the external auditor to inform the company of new requirements
   • CUpdate the monitoring process to include automated alerts for regulatory changes and a faster review cycle
   • DConduct a one-time review of the new regulation and update the audit plan
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A logistics company uses an AI system to optimize delivery routes. During an internal audit, the auditor asks to see evidence that the system's decisions are traceable and that any changes to the model are documented. The company's logging system records the route recommendations but does not log when the model is updated or which version was in use. What is the most important missing element in the audit trail?

   • AA log of customer complaints about delivery times.
   • BA log of model version changes, including timestamps, the person who made the change, and the reason for the change.
   • CA log of the delivery routes that were actually taken by drivers.
   • DA log of the weather conditions on each delivery day.
   Reveal Solution Discussion Select an answer first