ISO/IEC 42001 Alignment CRAGE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A healthcare organization is planning to implement ISO/IEC 42001. They have a mature quality management system (QMS) and a data governance program. The project sponsor wants a step-by-step roadmap that minimizes disruption. Which first step is most appropriate?

   • AConduct a gap analysis against ISO/IEC 42001 requirements, leveraging the existing QMS and data governance documentation.
   • BImmediately hire external consultants to build a standalone AI management system from scratch.
   • CApply for certification immediately to establish a deadline and force compliance.
   • DTrain all employees on ISO/IEC 42001 before any analysis is done.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A multinational manufacturing company operates under ISO 9001 (quality management), ISO/IEC 27001 (information security), and ISO 14001 (environmental management). The company is now implementing ISO/IEC 42001 for its AI-based quality inspection systems. The AI governance lead wants to avoid duplicating audits and documentation. Which approach best integrates ISO/IEC 42001 with the existing management systems?

   • AAdopt ISO/IEC 42001 only for the AI quality inspection system and leave the other management systems unchanged without any cross-referencing.
   • BReplace the existing ISO 9001 and ISO/IEC 27001 certifications with ISO/IEC 42001 to reduce the number of management systems.
   • CUse the Annex SL high-level structure to map ISO/IEC 42001 clauses to the existing ISO 9001, ISO/IEC 27001, and ISO 14001 clauses, and create a unified management system manual.
   • DMaintain ISO/IEC 42001 as a separate, standalone management system with its own documentation and audit schedule to avoid conflicts with existing standards.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A manufacturing company is conducting a gap analysis for ISO/IEC 42001. They have a robust quality management system (ISO 9001) but no formal AI risk management process. The gap analysis team is categorizing findings. Which finding should be classified as a major gap?

   • AThe internal audit schedule is not aligned with the calendar year.
   • BSome AI system documentation is stored in a shared drive without version control.
   • CNo documented AI risk assessment process exists for any AI system.
   • DThe AI policy is not signed by the CEO.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A logistics company is implementing ISO/IEC 42001. They have identified that their AI systems include route optimization and demand forecasting. The implementation team is developing a roadmap. Which activity should be completed before the others?

   • ADefine the scope of the AI management system, including the AI systems and processes covered.
   • BApply for certification with a certification body.
   • CConduct an internal audit of the AI systems.
   • DDevelop an AI policy.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A retail company is preparing for its first ISO/IEC 42001 certification audit. The internal audit team has completed a gap analysis and remediated most nonconformities. However, the team has not yet conducted a management review meeting, and some employees are unsure about their AI-related responsibilities. What should the company do before the certification audit?

   • AConduct a management review meeting and provide role-specific training on AI governance responsibilities.
   • BRequest the certification audit to be rescheduled until after the next quarterly business review.
   • CAssign AI responsibilities informally through email without updating the documented roles and responsibilities.
   • DSkip the management review and focus only on updating the AI policy document.
   Reveal Solution Discussion Select an answer first