Compliance Auditing CRAGE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   After corrective actions are implemented, what is the next step in the follow-up process?

   • AClose the audit without further review
   • BUpdate the audit report to remove all findings
   • CVerify the effectiveness of the remediation efforts
   • DImmediately schedule a full re-audit of all systems
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An organization is preparing for an external compliance audit of its AI-based recommendation system. The audit team must ensure that the audit is conducted according to key principles. Which practice best aligns with the principles of compliance auditing?

   • AEnsure the audit team has access to all relevant documentation and system logs, and that the audit is conducted independently of the system's development team.
   • BLimit the audit to a review of the system's user interface to minimize disruption.
   • CAllow the system's developers to guide the audit and provide their own interpretation of compliance requirements.
   • DConduct the audit using only publicly available information about the system.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company has implemented an AI-based supply chain optimization system. The regulatory environment is evolving, and the company wants to maintain compliance without conducting full audits too frequently. Which approach best supports continuous compliance monitoring?

   • AConduct a full compliance audit every year, regardless of regulatory changes or system updates.
   • BWait for a regulatory inspection to identify any compliance gaps.
   • CRely on the system's vendor to provide compliance updates and assume the system remains compliant.
   • DImplement automated monitoring of key compliance indicators and schedule periodic targeted reviews based on risk and regulatory changes.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An auditor is assessing an AI system that recommends personalized content. The organization claims it has implemented a data retention policy. Which evidence would be most reliable to verify this claim?

   • ALogs showing automated deletion of user data after the retention period.
   • BA signed copy of the data retention policy document.
   • CA screenshot of the policy page on the company's intranet.
   • DAn interview with the data protection officer confirming the policy is followed.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An audit of an AI system that predicts employee performance found that the system uses gender as a feature, which is prohibited by local law. The audit report must be communicated to the board of directors. What is the most appropriate way to present this finding?

   • AClearly state that the system violates the law, explain the impact, and recommend immediate corrective action.
   • BRecommend that the system be decommissioned immediately without further discussion.
   • CInclude the finding in a separate confidential report to avoid embarrassment.
   • DPresent the finding as a technical issue with the model's feature set, without mentioning the legal violation.
   Reveal Solution Discussion Select an answer first