ISO/IEC 42001 Alignment CRAGE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An insurance company has an established AI ethics board and a risk management framework aligned with ISO 31000. The company is now implementing ISO/IEC 42001. The AI governance lead wants to ensure that the AI ethics board's decisions are integrated into the ISO/IEC 42001 management system without creating conflicting processes. Which approach best achieves this integration?

   • AKeep the AI ethics board separate from the ISO/IEC 42001 management system to preserve its independence.
   • BUse ISO 31000 risk management documentation as the sole basis for ISO/IEC 42001 compliance without additional management system components.
   • CDefine the AI ethics board as a formal part of the AI management system, with its charter and decision records feeding into the management review and risk assessment processes.
   • DReplace the AI ethics board with the ISO/IEC 42001 management review committee to avoid duplication.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A manufacturing company is preparing for its ISO/IEC 42001 certification audit. The internal audit team has identified that the AI risk assessment for a new predictive maintenance system was not documented according to the company's procedure. The team has also found that the management review meeting minutes from the last quarter are missing. What should the company do to prepare for the certification audit?

   • AConduct a new risk assessment and management review immediately before the audit and present them as the original documents.
   • BPostpone the certification audit until the next internal audit cycle to allow time to recreate the documentation.
   • CExplain to the auditor that the documentation was lost due to a system migration and request that the audit proceed without it.
   • DReconstruct the missing risk assessment documentation and management review minutes, and implement corrective actions to prevent recurrence.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A software company is aligning with ISO/IEC 42001 while also complying with the EU AI Act. They have a product that is classified as high-risk under the EU AI Act. The compliance team notices that the EU AI Act requires specific technical documentation and risk management processes. How should they integrate these requirements with ISO/IEC 42001?

   • AUse ISO/IEC 42001 as the overarching management system and map the EU AI Act requirements as additional controls within that system.
   • BMaintain two separate compliance programs: one for ISO/IEC 42001 and one for the EU AI Act, with separate documentation.
   • CUse the EU AI Act's technical documentation as the sole basis for the ISO/IEC 42001 management system.
   • DPrioritize the EU AI Act and abandon ISO/IEC 42001 because the regulation is mandatory.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A multinational corporation already holds ISO 27001 (information security) and ISO 9001 (quality) certifications. They are now aligning with ISO/IEC 42001. The AI governance team notices overlapping requirements for risk assessment, documentation, and internal audit. What is the most effective integration approach?

   • AAdopt ISO/IEC 42001 as the umbrella standard and drop ISO 27001 and ISO 9001 certifications.
   • BRun three completely separate management systems to avoid any confusion during certification audits.
   • CCreate a unified management system that maps shared requirements across ISO 27001, ISO 9001, and ISO/IEC 42001, and use a single internal audit program.
   • DUse the ISO 27001 risk assessment results unchanged for AI-specific risks without additional analysis.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the first step in developing an implementation roadmap for ISO/IEC 42001?

   • AApplying for certification from an accredited body.
   • BConducting a gap analysis to assess the current state of AI governance.
   • CTraining all employees on AI ethics.
   • DPurchasing AI governance software tools.
   Reveal Solution Discussion Select an answer first