ISO/IEC 42001 Alignment CRAGE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which activity is part of the continuous improvement process for ISO/IEC 42001 alignment?

   • AFocusing only on external certification audits and ignoring internal feedback.
   • BRegularly updating the AI management system based on audit findings and changing requirements.
   • CDelegating all improvement activities to external auditors.
   • DKeeping the AI management system static to maintain certification.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A multinational corporation has a decentralized AI governance structure where each business unit manages its own AI systems. The corporation wants to achieve ISO/IEC 42001 certification for the entire organization. The gap analysis reveals that some business units have mature AI governance practices while others have minimal documentation. What should the corporation do to align with ISO/IEC 42001?

   • ACertify only the business units that already have mature AI governance practices to minimize effort.
   • BAllow each business unit to maintain its own separate AI management system and pursue individual certifications.
   • CImplement a single, uniform AI policy across all business units without any local adaptation.
   • DDefine a centralized AI management system scope that includes all business units, and develop a common AI policy with local implementation procedures.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a key preparation step for an ISO/IEC 42001 certification audit?

   • AConducting an internal audit to verify that the AI management system conforms to the standard.
   • BDeleting all audit records to protect confidential information.
   • CEnsuring that all AI systems are shut down during the audit.
   • DHiring an external consultant to run the AI systems during the audit.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company has been ISO/IEC 42001 certified for a year. During a surveillance audit, the auditor notes that the AI risk assessment process is not being applied to AI systems that were developed before the management system was implemented. The AI governance team wants to maintain certification. What should the team do?

   • AConduct risk assessments for all existing AI systems and update the AI management system to include a process for regularly reviewing legacy AI systems.
   • BDecommission all legacy AI systems to avoid the need for risk assessments.
   • CWait until the next certification audit to address the issue, as surveillance audits are only informational.
   • DArgue that legacy AI systems are out of scope because they were developed before the management system was implemented.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A financial institution has implemented ISO/IEC 42001 and also complies with the EU AI Act and GDPR. The AI governance team is now updating the risk assessment process to align with the EU AI Act's risk classification system. The team wants to ensure that the ISO/IEC 42001 certification remains valid while incorporating the new regulatory requirements. What should the team do?

   • AUpdate the AI risk assessment procedure to incorporate the EU AI Act risk categories, and document the change as part of the management system's continuous improvement process.
   • BMaintain two separate risk assessment processes: one for ISO/IEC 42001 and one for the EU AI Act, to avoid conflicts.
   • CReplace the ISO/IEC 42001 risk assessment process with the EU AI Act risk classification system entirely.
   • DWait for the EU AI Act to be fully enforced before making any changes to the ISO/IEC 42001 management system.
   Reveal Solution Discussion Select an answer first