Compliance Auditing CRAGE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   During audit execution, which activity is used to verify that technical controls are implemented as documented?

   • ASending out compliance surveys to employees
   • BPerforming technical testing, such as examining system configurations
   • CConducting interviews with stakeholders
   • DReviewing policies and procedures
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An auditor is testing whether an AI-based insurance pricing system complies with the requirement to provide explanations for adverse decisions. The organization states that the system generates an explanation for every denial. Which audit procedure provides the strongest evidence?

   • AReview the system's design documentation to confirm that an explanation feature was included.
   • BInterview the customer service team to ask if they have seen explanations for denials.
   • CSelect a sample of denied cases and verify that each has an explanation stored in the system's logs, and that the explanation is understandable.
   • DTest the system with a single synthetic case to see if an explanation is generated.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An audit of an AI-based hiring system has identified a non-conformity: the system's bias testing was not performed on the final deployed model. The audit team must communicate this finding to the organization's stakeholders, including non-technical management. Which communication approach is most effective?

   • AReport the finding only to the data science team, since they are responsible for model testing.
   • BState that the system is non-compliant and that the technical team will fix it, without further explanation.
   • CExplain the finding in business terms, describe the potential impact on hiring decisions, and recommend a corrective action with a timeline.
   • DProvide the detailed technical logs and code snippets that show the bias testing was skipped.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a key output of the audit planning and scoping phase?

   • AA list of audit findings and non-conformities
   • BAn audit plan that defines objectives, scope, criteria, and resources
   • CA final audit report distributed to stakeholders
   • DA corrective action plan for remediating identified issues
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   When assessing the severity of a non-conformity, which factor is most important to consider?

   • AThe cost of fixing the issue
   • BThe potential impact on regulatory compliance and stakeholders
   • CThe number of employees involved in the process
   • DThe age of the AI system
   Reveal Solution Discussion Select an answer first