Compliance Auditing CRAGE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During an audit of an AI-based fraud detection system, the auditor finds that the system's model was retrained using data that included a protected attribute, and the retraining was not documented in the change management system. The auditor must classify this finding. Which classification is most appropriate?

   • AObservation because the auditor cannot prove that the protected attribute caused discrimination.
   • BOpportunity for improvement because the organization could improve its documentation process in the future.
   • CMajor non-conformity because the use of protected attributes may violate anti-discrimination laws and the lack of documentation indicates a process breakdown.
   • DMinor non-conformity because the model still functions correctly and the documentation gap is an administrative oversight.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During an AI compliance audit, the auditor needs to verify that an organization's credit-scoring model complies with the EU AI Act's transparency requirements. The model's documentation is incomplete, and the auditor must gather reliable evidence. Which action best demonstrates systematic evidence collection?

   • ACollect the model's version history, training logs, and the latest model card, and cross-reference them with the deployed model's behavior.
   • BRely on the model developer's verbal confirmation that the model is compliant and document that confirmation in the audit notes.
   • CUse the model's training data as the sole evidence of transparency because it reflects the model's design intent.
   • DRequest a single summary report from the compliance team and use it as the primary evidence for the audit.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of a compliance audit in the context of AI regulatory frameworks?

   • ATo replace the need for external regulatory oversight by providing self-certification
   • BTo identify and exploit potential security vulnerabilities in AI systems for penetration testing
   • CTo evaluate whether an organization's AI systems and processes adhere to applicable laws, regulations, and internal policies
   • DTo improve the performance and accuracy of AI models through iterative testing and tuning
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In a compliance audit, what is a non-conformity?

   • AA suggestion for improving AI model accuracy
   • BA risk that might occur in the future
   • CA failure to meet a specified regulatory or internal requirement
   • DA positive observation about the AI system's performance
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   During an audit of an AI-powered customer service chatbot, the auditor discovers that the chatbot does not disclose that it is an AI system, which is required by regulation. The organization argues that the chatbot's name 'Alexa' implies it is not human. How should the auditor classify this finding?

   • AAs a recommendation for improvement because the chatbot could be improved.
   • BAs a major non-conformity because the regulation explicitly requires disclosure and the chatbot does not provide it.
   • CAs an observation because the name 'Alexa' is a common AI name.
   • DAs a minor non-conformity because the chatbot's name may imply it is not human.
   Reveal Solution Discussion Select an answer first