ISO/IEC 42001 Alignment CRAGE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company has been ISO/IEC 42001 certified for three years. During a surveillance audit, the auditor notes that the AI risk assessment process is not being consistently applied across all business units, and some units have not conducted risk assessments for new AI projects. What should the company do to maintain certification?

   • ARevoke the certification because the process is not being followed consistently.
   • BIgnore the issue because the surveillance audit is not a full certification audit.
   • CSimplify the risk assessment process to make it easier for business units to comply.
   • DInvestigate why some business units are not applying the risk assessment process, provide additional training, and update the process to address the root cause.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A logistics company wants to implement ISO/IEC 42001 for its AI-based route optimization system. The company has limited resources and wants to achieve certification within 9 months. The gap analysis shows that the company has no formal AI policy, no defined AI risk criteria, and no internal audit process. Which implementation roadmap should the company follow?

   • ADevelop the AI policy and scope, define AI risk criteria, implement the risk assessment process, conduct an internal audit, and then schedule the certification audit.
   • BSkip the internal audit and go directly to the certification audit to save time and resources.
   • CImplement the risk assessment process first, then develop the AI policy, and then conduct the internal audit.
   • DConduct the certification audit first to identify gaps, then develop the AI policy and risk criteria based on the audit findings.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company has implemented ISO/IEC 42001 and also uses the COBIT framework for IT governance. The AI governance team notices that the COBIT-based IT risk management process overlaps with the AI risk assessment process required by ISO/IEC 42001. The team wants to avoid duplication and ensure cohesive governance. What should the team do?

   • AMaintain separate risk assessment processes for COBIT and ISO/IEC 42001 to ensure each framework's requirements are met exactly.
   • BReplace the COBIT framework with ISO/IEC 42001 to eliminate the overlap.
   • CUse the COBIT risk management process as the sole basis for ISO/IEC 42001 compliance without any modifications.
   • DMap the COBIT risk management process to the ISO/IEC 42001 risk assessment requirements and create a unified risk assessment procedure that satisfies both frameworks.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is typically required to achieve ISO/IEC 42001 certification?

   • AProving that the organization has no AI-related incidents in the past year.
   • BDemonstrating that the AI management system is fully implemented and effective through documented evidence.
   • CPublishing all AI algorithms as open source.
   • DObtaining approval from a government regulatory body.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An organization is aligning its AI governance framework with ISO/IEC 42001. They currently have a risk management process that only covers cybersecurity threats. The standard requires a broader risk perspective. What is the most appropriate adjustment?

   • AReplace the risk management process with a compliance checklist based on AI regulations.
   • BOutsource risk assessment to an external vendor to ensure objectivity.
   • CExpand the risk assessment criteria to include ethical, societal, and legal risks related to AI systems.
   • DKeep the cybersecurity-only risk process because it is already certified under ISO 27001.
   Reveal Solution Discussion Select an answer first