Compliance Auditing CRAGE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An audit found that an AI system for resume screening was not providing the required transparency about its use of automated decision-making. The organization has implemented a fix by adding a disclosure statement. What is the most appropriate follow-up action?

   • AVerify that the disclosure appears in the live system and that users can access it before submitting their resume.
   • BClose the audit finding immediately because the fix has been implemented.
   • CUpdate the audit report to note that the finding is resolved.
   • DSchedule a re-audit in one year to check the disclosure.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An auditor is collecting evidence for an AI compliance audit and needs to verify that the AI system's training data was collected with proper consent. The organization has provided a data governance policy and a sample of consent records. Which additional evidence would most strengthen the audit?

   • AA summary report of the number of data subjects who provided consent.
   • BA copy of the consent form template used by the organization.
   • CA statement from the data collection team confirming that consent was obtained for all data subjects.
   • DA log from the data collection system showing that consent was recorded for each data subject at the time of collection.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A financial institution has implemented an AI system for loan approvals. After a successful initial compliance audit, the regulatory environment is evolving, and the institution wants to ensure sustained compliance. Which mechanism best supports continuous compliance monitoring?

   • AAssign a compliance officer to manually review all AI decisions on a monthly basis.
   • BRely on the initial audit report as evidence of compliance until the next scheduled audit.
   • CConduct a full re-audit only when a new regulation is enacted.
   • DEstablish automated logging of model changes and periodic reviews against updated regulatory requirements.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A multinational corporation is planning a compliance audit for its AI-based resume screening tool. The tool is used in multiple countries, each with different AI regulations. The audit team has limited resources and must prioritize. Which scoping decision is most appropriate?

   • AAudit only the AI model's technical performance, because regulatory compliance is the same across all countries.
   • BInclude all countries equally in the audit scope to ensure complete coverage.
   • CPrioritize the countries with the most stringent AI regulations and the highest volume of applicants, and document the rationale for excluding other regions.
   • DAudit only the country where the company's headquarters is located, because that is the primary regulatory jurisdiction.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An auditor is verifying that an AI-based medical diagnosis system complies with the EU AI Act's requirements for robust and accurate performance. The organization claims the system has been validated. Which audit procedure provides the most reliable evidence?

   • AInterview the system's developers to confirm that they followed best practices during development.
   • BAccept the organization's internal validation report as sufficient evidence of compliance.
   • CReview the validation study design, including the dataset used, and independently run a subset of test cases through the system to confirm accuracy.
   • DCheck that the system has received regulatory approval in another country.
   Reveal Solution Discussion Select an answer first