ISO/IEC 42001 Alignment CRAGE Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A company is preparing for its first ISO/IEC 42001 certification audit. The audit team has requested evidence of top management commitment. Which piece of evidence would best satisfy this requirement?

   • AAn email from the CIO stating that the AI team is responsible for compliance.
   • BA budget line item for AI compliance training.
   • CSigned policy documents and meeting minutes showing the board reviewed AI risk reports and approved the AI management system.
   • DA certificate of completion from an ISO/IEC 42001 training course for the compliance officer.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is the primary purpose of conducting a gap analysis when aligning with ISO/IEC 42001?

   • ATo evaluate the financial return on investment of AI projects.
   • BTo identify differences between current AI governance practices and the requirements of the standard.
   • CTo compare the organization's AI performance against industry competitors.
   • DTo determine which AI projects should be cancelled due to technical limitations.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A financial services firm has an established AI governance framework based on NIST AI RMF and internal policies. The board wants to pursue ISO/IEC 42001 certification. The compliance team is asked to identify the gaps between the current framework and the standard. Which approach best aligns with the ISO/IEC 42001 gap analysis process?

   • AReplace the current NIST AI RMF framework with ISO/IEC 42001 to avoid duplication and simplify the certification audit.
   • BReview only the AI models that are in production and document their performance metrics to satisfy the standard's requirements.
   • CMap existing controls and policies against each ISO/IEC 42001 clause, noting missing or partially addressed requirements, then prioritize remediation based on risk.
   • DConduct a penetration test of all AI systems to identify security vulnerabilities and use the results as the gap analysis report.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Why is it beneficial to integrate ISO/IEC 42001 with other management system standards like ISO/IEC 27001?

   • AIt allows for a unified approach to managing related risks and processes, reducing duplication.
   • BIt makes the AI management system the only system needed for all organizational processes.
   • CIt eliminates the need for any other compliance activities.
   • DIt ensures that AI systems are fully automated without human oversight.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   An organization is preparing for an ISO/IEC 42001 certification audit. The internal audit team has completed a pre-audit and found that several AI system risk assessments are outdated. What should the organization do to prepare for the certification audit?

   • AWait for the certification auditor to point out the gaps during the audit.
   • BDelete the outdated risk assessments to avoid auditor scrutiny.
   • CPostpone the certification audit until the next quarter without updating the risk assessments.
   • DUpdate all AI system risk assessments to reflect the current state and document the changes.
   Reveal Solution Discussion Select an answer first