ISO/IEC 42001 Alignment CRAGE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A multinational corporation is integrating ISO/IEC 42001 with its existing ISO 14001 (environmental) and ISO 45001 (occupational health and safety) management systems. The AI systems are used in manufacturing to optimize energy consumption and predict equipment maintenance. The integration team is concerned about the different risk assessment methodologies. What is the best approach?

   • AUse the ISO 14001 risk assessment for all AI systems because it already covers environmental impacts.
   • BOutsource the integration to a third-party consultant to avoid internal conflicts.
   • CKeep the risk assessment methodologies separate because each standard has unique requirements.
   • DAdopt a single risk assessment methodology that can be applied across all management systems, with specific criteria for AI, environmental, and safety risks.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A startup with 50 employees wants to implement ISO/IEC 42001 but has limited resources. They have a single AI product and a small engineering team. The CEO wants certification within six months. What is the most realistic roadmap?

   • AImplement the full set of controls from the standard's annex, including all possible AI risk controls, before applying for certification.
   • BWait until the company grows and has more resources before starting the implementation.
   • CFocus on the essential clauses: define scope, establish a simple AI policy, perform a risk assessment, and document key processes, then schedule a certification audit.
   • DHire a large consulting firm to build a comprehensive management system, even if it exceeds the budget.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   When aligning an organization's AI governance framework with ISO/IEC 42001, which of the following is a key requirement?

   • AFocusing only on AI systems that are externally facing, ignoring internal AI tools.
   • BDelegating all AI governance responsibilities to an external consultant.
   • CDemonstrating top management leadership and commitment to the AI management system.
   • DEnsuring that AI systems are developed without any documentation to protect intellectual property.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A bank is integrating ISO/IEC 42001 with its existing ISO 27001 information security management system. The bank's AI systems process customer data and are subject to data protection regulations. What is the best way to handle the overlap between information security and AI risk management?

   • AUse the ISO 27001 risk assessment as a baseline and add AI-specific risk criteria for ethical and societal impacts.
   • BOutsource the AI risk assessment to a third party to avoid integration complexity.
   • CConduct two completely separate risk assessments and never share results between teams.
   • DReplace the ISO 27001 risk assessment with the ISO/IEC 42001 risk assessment because it is more comprehensive.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   After achieving ISO/IEC 42001 certification, an organization wants to maintain alignment over time. The AI team regularly updates models and introduces new use cases. What ongoing practice best supports continuous improvement?

   • AConduct periodic internal audits and management reviews, updating the risk assessment whenever a new AI use case is introduced.
   • BFreeze all AI model changes until the next surveillance audit to maintain a stable baseline.
   • CRely on the certification body's annual surveillance audit to identify all necessary improvements.
   • DRe-certify every year by repeating the full initial gap analysis.
   Reveal Solution Discussion Select an answer first