ISO/IEC 42001 Alignment CRAGE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization is preparing for its ISO/IEC 42001 certification audit. The audit team has requested a list of all AI systems in scope. The organization has several AI systems, including some that are in development and some that are retired. Which systems should be included in the scope?

   • AOnly AI systems that have been approved by the board.
   • BAll AI systems that are in development, in production, and recently retired, as long as they are within the defined scope of the AI management system.
   • COnly AI systems that are currently in production and generating revenue.
   • DOnly AI systems that are subject to external regulations.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is preparing for its ISO/IEC 42001 certification audit. The internal audit team has completed a pre-audit and found that the AI system inventory is incomplete, and some AI systems are not included in the risk assessment. What should the company do to prepare for the certification audit?

   • AUpdate the AI system inventory to include all AI systems, conduct risk assessments for the missing systems, and document the updates.
   • BExplain to the auditor that the missing systems are low-risk and do not require risk assessment.
   • CPostpone the certification audit until the next internal audit cycle to allow more time to complete the inventory.
   • DRemove the missing AI systems from the inventory to avoid having to assess them.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When integrating ISO/IEC 42001 with an existing governance framework, what is a common challenge?

   • AAligning terminology and processes between different standards.
   • BEliminating all documentation to simplify the management system.
   • CMaking the AI management system completely independent from other systems.
   • DEnsuring that AI systems are used for every business process.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company has been ISO/IEC 42001 certified for two years. During a management review, the AI governance team identifies that the AI risk assessment criteria are outdated and do not reflect new types of AI applications being developed. What should the team do to maintain alignment with ISO/IEC 42001?

   • AUpdate the risk assessment criteria to cover the new AI applications and document the change in the management review minutes.
   • BKeep the existing risk assessment criteria unchanged to maintain consistency with the original certification.
   • CConduct a new gap analysis to determine if the management system is still aligned with ISO/IEC 42001.
   • DStop developing new AI applications until the risk assessment criteria are updated.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following best describes the scope of ISO/IEC 42001?

   • AIt applies only to public sector organizations that deploy AI for government services.
   • BIt applies only to organizations that are legally required to comply with AI regulations.
   • CIt applies only to large enterprises that develop AI algorithms for commercial sale.
   • DIt applies to any organization, regardless of size or type, that develops, provides, or uses AI systems.
   Reveal Solution Discussion Select an answer first