ISO/IEC 42001 Alignment CRAGE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company is implementing ISO/IEC 42001 and has completed the gap analysis. The company has a documented AI policy and defined roles, but lacks a formal risk assessment process and internal audit program. The company wants to achieve certification within 6 months. What should the company do next in its implementation roadmap?

   • AConduct the certification audit immediately and use the findings to develop the risk assessment process.
   • BDevelop and implement a risk assessment process, then establish an internal audit program, and conduct a management review before the certification audit.
   • CSkip the internal audit program and rely on the certification audit to verify compliance.
   • DEstablish the internal audit program first, then develop the risk assessment process, and then conduct the certification audit.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A government agency is aligning its AI governance with ISO/IEC 42001. They have strict data residency requirements and use a mix of on-premises and cloud AI systems. The agency's legal team insists that all AI data must remain within the country. How should the agency align with ISO/IEC 42001 while respecting data residency?

   • AUse only on-premises systems for all AI, even if it is inefficient, because the standard requires it.
   • BMove all AI systems to a public cloud region outside the country to simplify management, ignoring the data residency law.
   • CDocument the data residency requirement as a legal and regulatory constraint in the AI management system's context and scope, and ensure risk assessments and controls address it.
   • DExclude all AI systems that process personal data from the ISO/IEC 42001 scope to avoid conflict.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A telecommunications company has a mature AI governance framework that includes a custom AI risk scoring model, a data ethics committee, and compliance with GDPR. The company is now considering ISO/IEC 42001 certification. The gap analysis reveals that the company has no formal AI policy document, no defined AI management system scope, and no internal audit program. What should the company do to align with ISO/IEC 42001?

   • ADelay ISO/IEC 42001 certification until the company can build a completely new AI governance framework from scratch.
   • BUse GDPR compliance documentation as the basis for the AI management system, since GDPR already covers data protection aspects.
   • CReplace the custom risk scoring model with the ISO/IEC 42001 risk assessment process to ensure full compliance.
   • DMap the existing risk scoring model and data ethics committee outputs to ISO/IEC 42001 clauses, then develop the missing policy, scope, and internal audit program.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is the role of management review in the continuous improvement of an ISO/IEC 42001-aligned AI management system?

   • ATo ensure that the AI management system remains unchanged over time.
   • BTo approve all AI model changes without further analysis.
   • CTo periodically evaluate the system's performance and identify opportunities for improvement.
   • DTo replace the internal audit process entirely.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A mid-sized company has a limited compliance team and wants to achieve ISO/IEC 42001 certification within a year. The gap analysis reveals major deficiencies in documentation, risk assessment, and internal audit. The budget allows for either hiring one full-time compliance specialist or purchasing an AI governance software tool. Which strategy is most likely to succeed?

   • ADelay certification by two years to allow the team to gradually address gaps without extra resources.
   • BPurchase the software tool first and rely on it to automate the entire compliance process without additional staff.
   • CHire the compliance specialist to lead the implementation and use the software tool only if budget remains after the specialist is hired.
   • DApply for certification immediately and use the audit findings as a gap analysis.
   Reveal Solution Discussion Select an answer first