ISO/IEC 42001 Alignment CRAGE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company has been ISO/IEC 42001 certified for a year. The AI governance committee meets quarterly and reviews risk assessments, but the internal audit team has not been involved. The certification body's surveillance audit is approaching. What is the most important action to take?

   • AEnsure the internal audit program has been executed according to the planned schedule and that audit findings have been reviewed by management.
   • BAsk the certification body to waive the internal audit requirement for this year.
   • CConduct a new gap analysis to replace the internal audit.
   • DUpdate the AI policy to include a statement about internal audits.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company has been ISO/IEC 42001 certified for two years. During a surveillance audit, the auditor notes that the AI risk assessment has not been updated since the initial certification, even though new AI features were deployed. What is the most appropriate corrective action?

   • AExplain to the auditor that the new features are minor and do not require a risk assessment.
   • BPerform a new risk assessment for the new features and update the AI management system documentation accordingly.
   • CWait for the next surveillance audit to update the risk assessment.
   • DRemove the new features from the AI management system scope to avoid the requirement.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A financial services firm has an existing AI governance framework based on the NIST AI Risk Management Framework. The board wants to pursue ISO/IEC 42001 certification without discarding the current framework. During the initial assessment, the AI governance team finds that the NIST-based framework covers risk identification and mitigation thoroughly but lacks formal documented AI policies and defined roles for AI oversight. What should the team do first to align with ISO/IEC 42001?

   • AConduct a gap analysis comparing current practices against ISO/IEC 42001 clauses, then map NIST RMF artifacts to the corresponding ISO/IEC 42001 requirements.
   • BSchedule an external certification audit to identify nonconformities and use the audit findings as the gap analysis.
   • CImmediately draft new AI policies and assign roles before reviewing the current framework, since ISO/IEC 42001 requires these regardless of existing practices.
   • DReplace the NIST AI RMF framework with ISO/IEC 42001 and archive all existing documentation to avoid conflicting controls.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a typical output of a gap analysis for ISO/IEC 42001 alignment?

   • AA detailed technical design for AI algorithms.
   • BA prioritized list of actions needed to meet the standard's requirements.
   • CA list of all AI-related laws in every country.
   • DA certification certificate from an accredited body.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A government agency has an AI governance framework that is heavily based on the OECD AI Principles and the EU AI Act requirements. The agency is now considering ISO/IEC 42001 certification. The gap analysis reveals that the agency has strong ethical principles and regulatory compliance processes but lacks a formal AI management system with documented policies and internal audit mechanisms. Which approach should the agency take to align with ISO/IEC 42001?

   • AAbandon the OECD and EU AI Act frameworks and build a completely new AI management system from scratch to avoid conflicts.
   • BDelay ISO/IEC 42001 certification until the EU AI Act is fully enforced, then align the management system with the final regulatory requirements.
   • CUse the EU AI Act compliance documentation as the sole basis for ISO/IEC 42001 certification without adding any management system components.
   • DMap the existing OECD and EU AI Act compliance artifacts to ISO/IEC 42001 clauses, then develop the missing management system components such as policy, roles, and internal audit.
   Reveal Solution Discussion Select an answer first