Compliance Auditing CRAGE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the purpose of a corrective action plan in response to audit findings?

   • ATo assign blame to responsible individuals
   • BTo outline the steps to remediate identified non-conformities
   • CTo provide a timeline for the next audit
   • DTo document the audit findings for regulatory submission
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization has implemented a corrective action plan to address an audit finding that its AI-based chatbot does not provide users with the option to speak to a human. The audit team must verify the effectiveness of the remediation. Which verification method is most appropriate?

   • AConfirm that the corrective action plan has been marked as 'closed' in the tracking system.
   • BTest the chatbot with a series of user interactions to confirm that the option to speak to a human is consistently presented.
   • CReview the chatbot's design documentation to confirm that the human handoff feature was added.
   • DInterview the customer service team to ask if they have received more handoff requests.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   After a compliance audit, an organization must address a finding that its AI chatbot does not provide users with the option to speak to a human, as required by regulation. The corrective action plan includes adding a 'Talk to an agent' button. What is the most important next step to verify the effectiveness of the remediation?

   • AUpdate the audit report to indicate that the finding is closed.
   • BSchedule a re-audit in six months to check if the button is still working.
   • CConfirm that the button is visible in the production environment and that it successfully connects users to a human agent.
   • DTrain customer support staff on how to handle calls from the chatbot.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A healthcare organization is preparing for a compliance audit of its AI-based patient triage system. The system processes protected health information and is subject to both GDPR and HIPAA. The audit team has limited resources and must prioritize which AI systems to include. Which approach best aligns with audit planning and scoping principles?

   • ADefer the audit until all AI systems are fully documented and mapped to every regulation.
   • BInclude all AI systems in the organization, regardless of their data processing, to ensure complete coverage.
   • CAudit only the patient triage system because it is the only system mentioned in the scenario.
   • DScope the audit to the patient triage system and other AI systems that process personal or protected health data, using a risk-based prioritization.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An audit of an AI-based fraud detection system found that the model's training data was not properly anonymized, leading to a potential privacy breach. The audit report must be communicated to stakeholders. Which approach best aligns with audit reporting principles?

   • AReport the finding only to the legal department to avoid alarming other stakeholders.
   • BInclude the finding in the report with a clear description, the regulatory requirement violated, and a recommended corrective action.
   • CDelay the report until the issue is fully resolved to present a positive outcome.
   • DPresent the finding as a minor observation to minimize reputational risk.
   Reveal Solution Discussion Select an answer first