PECB Real Dumps Practice Exam Questions by Dumpswarp

ISO/IEC 42001:2023 Artificial Intelligence Management System Lead Auditor Exam Questions and Answers

Question 1

Question:

What does sampling error refer to in the context of the audit?

Options:

The auditor’s bias in selecting samples that reflect personal expectations rather than random selection

The discrepancy between the auditor’s findings from a selected sample and the true conditions of the entire population

The systematic selection of samples from only specific parts of the population, presumed to be more compliant

Question 2

What type of audit evidence did Augustine gather when he collected management review records? Refer to scenario 3.

Scenario 3: Heala specializes in developing Al-driven solutions for the healthcare sector. With a keen focus on leveraging Al to revolutionize patient care, diagnostics,

and treatment planning, the company has implemented an artificial intelligence management system AIMS based on ISO/IEC 42001. After a year of having the AIMS in

place, the company decided to apply for a certification audit.

It contracted a local certification body, who established the audit team and assigned the audit team leader. Augustine, the designated audit team leader, has a wide

range of skills relevant to various auditing domains. His proficiency encompasses audit principles, processes, and methods, as well as standards for management

systems and additional references. Furthermore, he is knowledgeable about the Heala’s context and relevant statutory and regulatory requirements.

Augustine first gathered management review records, interested party feedback logs, and revision histories for Heala's AIMS. This crucial step laid the groundwork for

a deeper investigation, which included conducting comprehensive interviews with key personnel to understand how feedback from interested parties directly

influenced updates to the AIMS and its strategic direction. Augustine's thorough evaluation process aimed to verify Heala's commitment to integrating the needs and

expectations of interested parties, a critical requirement of ISO/IEC 42001.

Augustine also integrated a sophisticated Al tool to analyze large datasets for patterns and anomalies, and thus have a more informed and data driven audit process.

This Al solution, known for its ability to sift through vast amounts of data with unparalleled speed and accuracy, enabled Augustine to identify irregularities and trends

that would have been nearly impossible to detect through manual methods. The tool was also helpful in preparing hypotheses based on data.

During the audit. Augustine failed to fully consider Heala’s critical processes, expectations, the complexity of audit tasks, and necessary resources beforehand. This

oversight compromised the audit integrity and reliability, reflecting a significant deviation from the diligence and informed judgment expected of auditors.

Options:

Confirmative

Mathematical

Documentary

Observational

Question 3

Question:

During a combined audit, if an auditor identifies a finding linked to one criterion, should they consider its potential impact on corresponding or related criteria of other management systems?

Options:

Yes, the auditor should consider the other criteria only if the finding is deemed significant

Yes, the auditor should consider the possible impact on the corresponding or similar criteria of the other management system

No, in such cases the auditor should always focus on the specific criterion identified

Question 4

A tech company has decided to apply ISO/IEC 42001 specifically to integrate the AIMS with existing management systems, such as the Information Security Management System and the Business Continuity Management System. Which part of ISO/IEC 42001 should the company use as guidance on aligning the AIMS with these systems to ensure cohesive objectives, streamlined processes, and unified documentation?

Options:

Annex B

Annex C

Annex D

Question 5

Based on Scenario 6, which aspect of assigning roles and responsibilities to the audit team is incorrect?

Scenario 6: AfrinovAl, based in Nairobi, Kenya, develops Al tools to improve agriculture in Africa. The company uses Al to address challenges faced by African farmers,

offering tools for analyzing satellite images to monitor crop health, predicting pest and disease outbreaks, and automating irrigation to use water more efficiently.

AfrinovAl has implemented an artificial intelligence management system AIMS based on ISO/IEC 42001, reflecting its commitment to ethical and effective

management practices in its Al solutions.

AfrinovAl is undergoing a certification audit to obtain certification against ISO/IEC 42001. Samuel, an expert in Al technologies and management systems, is heading

the audit team. Before initiating the audit process, Samuel reviewed and approved the audit plan, which served as a basis for the agreement between the certification

body and the auditee.

During the stage 1 audit, the audit team focused on a detailed evaluation of AfrinovAI's documented information, critically assessing both their format and content.

Samuel held a meeting with his team to prepare for the stage 2 audit. During this meeting, responsibilities were allocated among team members, assigning specific

processes, functions, sites, areas, or activities based on each auditor's expertise and the audit requirements. He also assigned auditing roles to technical experts to

leverage their specialized knowledge in specific areas.

In the stage 2 audit, Samuel and his team held an opening meeting during which Samuel explained how the audit activities will be undertaken. AfrinovAI's also

participated in the meeting. Afterward, the audit team conducted on-site activities to closely inspect the physical locations of the audited processes. The interviewed

individuals from the auditee's personnel regarding the AIMS and observed some of the operations of the auditee. They also used sampling and technical verification to

assess the implementation of Al-related controls, verify compliance with established procedures, and identify any gaps in adherence to the AIMS requirements. They

skipped the review of documented information related to the AIMS since some documents had already been reviewed during the stage 1 audit. This comprehensive

approach ensured a thorough evaluation of AfrinovAI's AIMS against the ISO/IEC 42001.

Options:

Assigning team members based on their expertise

Assigning auditing roles to technical experts

Not including guides during the assignment of roles and responsibilities

Assigning functions based on audit scope

Question 6

In which step are the audit findings, including nonconformities, documented and reviewed?

Options:

Initiating the audit

Conducting the audit

Closing meeting

Audit reporting

Question 7

Based on Scenario 5, which of the following should NOT be Jonathan's responsibility?

Scenario 5: Alterhealth is a mid-sized technology firm based in Toronto. Canada. It develops Al systems for healthcare providers, focusing on improving patient care,

optimizing hospital workflows, and analyzing healthcare data for insights that can improve health outcomes. To ensure responsible and effective use of Al in its

operations, Alterhealth has implemented an artificial intelligence management system AIMS based on ISO/IEC 42001. After a year of having the AIMS in place, the

company decided to apply for a certification audit to obtain certification against ISO/IEC 42001.

The company contracted a certification body to conduct the audit, who assembled the audit team and appointed the audit team leader. The audit team leader had

conducted a certification audit at Alterhealth in the past. The top management of Alterhealth decided to reject the appointment of this auditor because they believed

that they would not receive added value from the audit. In response, the certification body appointed Jonathan, an independent auditor with no prior engagements with

Alterhealth, as the new audit team leader. Jonathan's introduction marked the beginning of a collaborative process aimed at evaluating the conformity of the AIMS to

ISO/IEC 42001 requirements.

The certification body determined the audit scope, which included only specific departments essential to the integration and application of Al, such as the Al Research,

Machine Learning Applications, and Al Ethics and Compliance Departments, and did not cover all of the departments covered by the AIMS scope. Meanwhile,

Alterhealth determined the audit time, setting the necessary time frame for planning and conducting a thorough and effective review to ensure all aspects of the AIMS

within the selected departments were meticulously reviewed.

Afterward, Jonathan received a detailed offer from the certification body, outlining his role and including information related to the audit, such as the audit's duration,

team members, their responsibilities, the limits to the audit engagement, and their salary compensation. With a clear mandate, Jonathan was tasked with a multitude

of responsibilities: defining the audit objectives and criteria, planning the audit process, identifying and addressing audit risks, managing communication with

Alterhealth, overseeing the audit team, and ensuring a smooth and conflict free execution.

With Jonathan's leadership and a well-defined audit framework in place, the certification audit proceeded with a structured and objective evaluation of Alterhealth's

AIMS.

Options:

Identifying and addressing audit risks

Determining audit objectives and criteria

Managing conflicts during the audit

Determining the audit scope

Question 8

Question:

While preparing for an AIMS audit, a technology company faced an issue: the auditor lacked a required security clearance for accessing sensitive information related to government contracts.

The company requested a replacement auditor. Is this acceptable?

Options:

Yes, the auditor not holding the security clearance required by the auditee is a valid reason to request the replacement of the auditor

No, the auditee can request the replacement of the auditor only if the auditor is in a conflict of interest situation

No, the auditee can request the replacement of the auditor only if the auditor has audited the company in the past

Question 9

During a certification audit, the audit team reviewed the defined roles and responsibilities within the auditee and conducted interviews with key personnel. They also evaluated whether the roles and responsibilities were aligned with the AI policy and objectives, examined reporting mechanisms for concerns, and reviewed the reporting frequency and response time for AI-related matters. The implementation of which control of ISO/IEC 42001 is being verified in this case?

Options:

A.3 Internal organization

A.4 Resources for AI systems

A.5 Assessing impacts of AI systems

A.6 External context and stakeholder engagement

Question 10

A software development company is well-known for its innovative practices and collaborative work environment. The CEO, Alex, has fostered a work culture where team input is highly valued in shaping the company’s strategic direction. Alex often organizes brainstorming sessions and workshops, inviting employees from various departments to share their insights and suggestions on new projects, company policies, and workflow improvements. While Alex ensures that every team member feels heard and valued, the final decisions on project directions, key company policies, and strategic initiatives rest with Alex. Which type of leadership does Alex most closely embody?

Options:

Autocratic

Laissez-faire

Democratic

Bureaucratic

Question 11

Which aspect of the previous certification of VeridicAI is NOT correct? Refer to scenario 8.

Scenario 8: VeridicAI. based in San Francisco. USA, specializes in market research using Al technologies to analyze customer behavior. Founded in 2023, the company

employs natural language processing, machine learning, and predictive analytics to provide real time insights to a range of businesses. VeridicAI has implemented an

artificial intelligence management system AIMS based on ISO/IEC 42001 to manage its Al technologies effectively. The AIMS scope includes select departments within

the company, for which it has received a four-year certification against ISO/IEC 42001. Committed to transparency. VeridicAI publicly shares details of this certification.

As the certification nears its end, VeridicAI is preparing for an audit to renew its certification.

The audit process was led by Sharona, the audit team leader, who is a full-time employee of the certification body. Sharona and the audit team undertook all planned

audit activities. Afterward, they organized the closing meeting with VeridicAl’s management. During the meeting, Sharona and the team made a recap on audit

objectives and scope, presented the audit findings and conclusions, presented identified nonconformities, and organized a session for questions and answers for the

auditee.

VeridicAI received a conditional recommendation for certification, underscoring its compliance with the industry's standards. Sharona confirmed that the company met

the essential requirements but noted some identified minor nonconformities. In response, VeridicAI compiled and submitted a comprehensive action plan that

addresses all identified nonconformities within a designated timeframe. Because of the comprehensive action plan, Sharona did not see the need for an additional on-

site visit to verify the effectiveness of the action plan.

Sharona played an integral role in the certification decision process. Her thorough understanding of VeridicAI's operations, gained from the audit, guided the

certification body towards a well-informed certification decision.

Options:

The AIMS certification was valid for a four-year period

The certification details were made public, allowing access to all interested parties

The certification was issued for specific departments within the company

Question 12

Which among the following is NOT a level of AI?

Options:

Artificial Narrow Intelligence

Artificial Machine Intelligence

Artificial General Intelligence

Artificial Super Intelligence

Question 13

Question:

Which of the following describes a joint audit?

Options:

When two or more auditing organizations cooperate to audit a single auditee

When two or more management systems are audited together at a single auditee

When an internal audit and a third-party audit are conducted simultaneously

When audits are conducted back-to-back for efficiency

Question 14

Which core element of AIMS is defined as: “Organizations are responsible for the development, deployment, and use of AI systems, and their potential impacts”?

Options:

Accountability

Responsibility

Commitment

None of the above

Question 15

What does the 'Human-Centered Design' core element prioritize in AI development?

Options:

Maximizing profit

Designing AI systems that prioritize human needs and values

Increasing automation

Minimizing user interaction

Question 16

During an audit, the auditor uncovers sensitive data regarding the AI system's algorithms and their decision-making processes. Which principle must the auditor adhere to when handling this information?

Options:

Evidence-Based Approach

Integrity

Confidentiality

Fair Presentation

Question 17

Based on Scenario 1, which AI principle did NeuraGen fail to apply?

Scenario: NeuraGen, founded by a team of AI experts and data scientists, has gained attention for its advanced use of artificial intelligence. It specializes in developing personalized learning platforms powered by AI algorithms. MindMeld, its innovative product, is an educational platform that uses machine learning and stands out by learning from both labeled and unlabeled data during its training process. This approach allows MindMeld to use a wide range of educational content and personalize learning experiences with exceptional accuracy. Furthermore, MindMeld employs an advanced AI system capable of handling a wide variety of tasks, consistently delivering a satisfactory level of performance. This approach improves the effectiveness of educational materials and adapts to different learners' needs.

NeuraGen skillfully handles data management and AI system development, particularly for MindMeld. Initially, NeuraGen sources data from a diverse array of origins, examining patterns, relationships, trends, and anomalies. This data is then refined and formatted for compatibility with MindMeld, ensuring that any irrelevant or extraneous information is systematically eliminated. Following this, values are adjusted to a unified scale to facilitate mathematical comparability. A crucial step in this process is the rigorous removal of all personally identifiable information (PII) to protect individual privacy. Finally, the data is subjected to quality checks to assess its completeness, identify any potential bias, and evaluate other factors that could impact the platform's efficacy and reliability.

NeuraGen has implemented an advanced artificial intelligence management system (AIMS) based on ISO/IEC 42001 to support its efforts in AI-driven education. This system provides a framework for managing the life cycle of AI projects, ensuring that development and deployment are guided by ethical standards and best practices.

NeuraGen's top management is key to running the AIMS effectively. Applying an international standard that specifically provides guidance for the highest level of company leadership on governing the effective use of AI, they embed ethical principles such as fairness, transparency, and accountability directly into their strategic operations and decision-making processes.

While the company excels in ensuring fairness, transparency, reliability, safety, and privacy in its AI applications, actively preventing bias, fostering a clear understanding of AI decisions, guaranteeing system dependability, and protecting user data, it struggles to clearly define who is responsible for the development, deployment, and outcomes of its AI systems. Consequently, it becomes difficult to determine responsibility when issues arise, which undermines trust and accountability, both critical for the integrity and success of AI initiatives.

Options:

Fairness

Transparency

Accountability

Question 18

Which of the following is NOT a guide’s responsibility?

Options:

Establishing contacts and timing for interviews

Witnessing the audit activities on behalf of the client

Drafting and communicating the conclusions of the audit

Assisting with access and facilitating communication

Question 19

Scenario 7 (continued):

Scenario 7: ICure, headquartered in Bratislava, is a medical institution known for its use of the latest technologies in medical practices. It has introduced groundbreaking Al-driven diagnostics and treatment planning tools that have fundamentally transformed patient care.

ICure has integrated a robust artificial intelligence management system AIMS to manage its Al systems effectively. This holistic management framework ensures that ICure's Al applications are not only developed but also deployed and maintained to adhere to the

highest industry standards, thereby enhancing efficiency and reliability.

ICure has initiated a comprehensive auditing process to validate its AIMS's effectiveness in alignment with ISO/IEC 42001. The stage 1 audit involved an on-site evaluation by the audit team. The team evaluated the site-specific conditions, interacted with ICure's personnel,

observed the deployed technologies, and reviewed the operations that support the AIMS. Following these observations, the findings were documented and communicated to ICure. setting the stage for subsequent actions.

Unforeseen delays and resource allocation issues introduced a significant gap between the completion of stage 1 and the onset of stage 2 audits. This interval, while unplanned, provided an opportunity for reflection and preparation for upcoming challenges.

After four months, the audit team initiated the stage 2 audit. They evaluated AIMS's compliance with ISO/IEC 42001 requirements, paying special attention to the complexity of processes and their documentation. It was during this phase that a critical observation was made:

ICure had not fully considered the complexity of its processes and their interactions when determining the extent of documented information. Essential processes related to Al model training, validation, and deployment were not documented accurately, hindering effective control and management of these critical activities. This issue was recorded as a minor nonconformity, signaling a need for enhanced control and management of these vital activities.

Simultaneously, the auditor evaluated the appropriateness and effectiveness of the "AIMS Insight Strategy," a procedure developed by

ICure to determine the AIMS internal and external challenges. This examination identified specific areas for improvement, particularly in

the way stakeholder input was integrated into the system. It highlighted how this could significantly enhance the contribution of relevant

parties in strengthening the system's resilience and effectiveness.

The audit team determined the audit findings by taking into consideration the requirements of ICure, the previous audit records and

conclusions, the accuracy, sufficiency, and appropriateness of evidence, the extent to which planned audit activities are realized and

planned results achieved, the sample size, and the categorization of the audit findings. The audit team decided to first record all the

requirements met; then they proceeded to record the nonconformities.

Based on the scenario above, answer the following question:

Question:

Based on Scenario 7, the audit team conducted a Stage 2 audit after a considerable time from Stage 1. Is this recommended?

Options:

No, the gap between Stage 1 and Stage 2 audits should be minimal (usually two weeks) to ensure that the AIMS remains consistent and relevant during the audit process

Yes, a bigger gap between Stage 1 and Stage 2 audits allows the audit team time for reflection and preparation in addressing the findings

No, the Stage 2 audit should be conducted immediately after the Stage 1 audit to quickly address any identified issues

Question 20

What could require a stage 1 audit during a recertification audit?

Options:

Routine updates to documentation and procedures of the auditee

Significant changes to the auditee

Minor changes to internal processes of the auditee

Question 21

Scenario 9:

Scenario 9: Securisai, located in Tallinn. Estonia, specializes in the development of automated cybersecurity solutions that utilize AI systems. The company recently implemented an artificial intelligence management system AIMS in accordance with ISO/IEC 42001. In doing so, the company aimed to manage its Al-driven systems’ capabilities to detect and mitigate cyber threats more efficiently and ethically. As part of its commitment to upholding the highest standards of Al use and management, Securisai underwent a certification audit to demonstrate compliance with ISO/IEC 42001.

The audit process comprised two main stages: the initial or stage 1 audit focused on reviewing Securisai's documentation, policies, and procedures related to its AIMS. This review laid the groundwork for the stage 2 audit, which involved a comprehensive, on-site evaluation

of the actual implementation and effectiveness of the AIMS within Securisai's operations. The goal was to observe the AIMS in operation, ensuring that it not only existed on paper but was effectively integrated into the company's daily activities and cybersecurity strategies.

After the audit, Roger, Securisai's internal auditor, addressed the action plans devised to rectify nonconformities identified during the certification audit. He developed a long term strategy, highlighting key AIMS processes for triennial audits. Roger's internal audits play a

key role in advancing Securisai's goals by employing a systematic and disciplined method to assess and boost the efficiency of risk

management, governance processes, and strategic decision-making. Roger reported his findings directly to Securisai's top management.

Following the successful rectification of nonconformities, Securisai was officially certified against ISO/IEC 42001.

Recently, the company decided to transfer its ISO/IEC 42001 certification registration from one certification body to another despite being initially bound by a long-term agreement with the current certification body. This decision was motivated by the desire to partner with a certification body that offers deeper insights and expertise in the rapidly evolving field of artificial intelligence in cybersecurity.

To ensure a smooth transition and uphold its certification status, Securisai is diligently compiling the required documentation for submission to the new certification body. This includes a formal request, the most recent audit report underscoring its adherence to ISO/IEC 42001, the latest corrective action plan that highlights its continuous efforts toward improvement, and a copy of its current valid certification registration.

A year following Securisai's initial certification audit, a subsequent audit was carried out by the certification body on its AIMS. The

purpose of this audit was to assess compliance with ISO/IEC 42001 and verify the ongoing improvement of the AIMS. The audit team

concluded that Securisai's AIMS consistently meets the requirements set by ISO/IEC 42001.

Question:

Roger followed up on action plans resulting from external audits. Is this acceptable?

Options:

No, it is the responsibility of the external auditor to follow up on action plans resulting from external audits

Yes, the internal auditor should follow up on action plans submitted during internal and external audits

No, the internal auditor should follow up on action plans submitted in response to nonconformities resulting only from internal audits

Question 22

Audit evidence must be:

Options:

Verifiable

Physical

Refutable

Structured

Question 23

During a combined audit, if an auditor identifies a finding linked to one criterion, should they consider its potential impact on corresponding or related criteria of other management systems?

Options:

Yes, the auditor should consider the other criteria only if the finding is deemed significant

Yes, the auditor should consider the possible impact on the corresponding or similar criteria of the other management system

No, in such cases the auditor should always focus on the specific criterion identified

Question 24

Which of the following is NOT a common feature shared by AI systems?

Options:

Interactive

Contextual

Infallible

Question 25

Which control in Annex A of ISO 42001:2023 focuses on the need for stakeholder engagement in AI system development?

Options:

Continuous Improvement

Stakeholder Consultation

Risk Assessment

Data Management

Question 26

Scenario 9:

key role in advancing Securisai's goals by employing a systematic and disciplined method to assess and boost the efficiency of risk

management, governance processes, and strategic decision-making. Roger reported his findings directly to Securisai's top management.

Following the successful rectification of nonconformities, Securisai was officially certified against ISO/IEC 42001.

A year following Securisai's initial certification audit, a subsequent audit was carried out by the certification body on its AIMS. The

purpose of this audit was to assess compliance with ISO/IEC 42001 and verify the ongoing improvement of the AIMS. The audit team

concluded that Securisai's AIMS consistently meets the requirements set by ISO/IEC 42001.

During an AIMS audit at a cybersecurity company, the team found a major nonconformity — ineffective access controls for sensitive data.

Question:

Given this situation, what is the appropriate next step?

Options:

Conduct another full audit of the auditee’s entire AIMS

Promptly revoke the auditee’s certification without further examination

Conduct an audit follow-up before the company is recommended for certification

Question 27

Question:

Can the work assignments of audit team members be changed during the audit?

Options:

Yes, changes can be made to ensure the achievement of audit objectives

No, changes cannot be made once the audit starts

Yes, but only if the changes are approved by the auditee

Question 28

What does ISO 19011 provide?

Options:

Guidance for auditors on AI management system

Fundamental principles of auditing

Requirements for bodies providing audit

Guidance for practitioners on AI management system

Question 29

Scenario 8 (continued):

Scenario 8:

Scenario 8: InnovateSoft, headquartered in Berlin, Germany, is a software development company known for its innovative solutions and commitment to excellence. It specializes in custom software solutions, development, design, testing, maintenance, and consulting, covering both mobile apps and web development. Recently, the company underwent an audit to evaluate the effectiveness and

compliance of its artificial intelligence management system AIMS against ISO/IEC 42001.

The audit team engaged with the auditee to discuss their findings and observations during the audit's final phases. After evaluating the evidence, the audit team presented their audit findings to InnovateSoft, highlighting the identified nonconformities.

Upon receiving the audit findings, InnovateSoft accepted the conclusions but expressed concerns about some findings inaccurately reflecting the efficiency of their software development processes. In response, the company provided new evidence and additional information to alter the audit conclusions for a couple of minor nonconformities identified. After thorough consideration, the audit team leader clarified that the new evidence did not significantly alter the core conclusions drawn for the nonconformities. Therefore, the certification body issued a certification recommendation conditional upon the filing of corrective action plans without a prior visit.

InnovateSoft accepted the decision of the certification body. The top management of the company also sought suggestions from the audit team on resolving the identified nonconformities. The audit team leader offered solutions to address the issues, fostering a collaborative effort between the auditors and InnovateSoft. During the closing meeting, the audit team covered key topics to enhance transparency. They clarified to InnovateSoft that the audit evidence was based on a sample, acknowledging the inherent uncertainty. The method and time frame of reporting and grading findings were discussed to provide a structured overview of nonconformities. The certification body's process for handling nonconformities, including potential consequences, guided InnovateSoft on corrective actions. The time frame for presenting a plan for correction was

communicated, emphasizing urgency. Insights into the certification body’s post-audit activities were provided, ensuring ongoing support.

Lastly, the audit team briefed InnovateSoft on complaint and appeal handling.

InnovateSoft submitted the action plans for each nonconformity separately, describing only the detected issues and the corrective actions planned to address the detected nonconformities. However, the submission slightly exceeded the specified period of 45 days set by the certification body, arriving three days later. InnovateSoft explained this by attributing the delay to unexpected challenges encountered during the compilation of the action plans.

During the closing meeting, the audit team covered key topics including sampling uncertainty, timelines for corrections, and complaint/appeals procedures.

Question:

Based on Scenario 8, was the concluding meeting comprehensive in addressing all essential components of the audit?

Options:

Yes, it addressed all necessary aspects

No, it should not have involved the assessment of audit findings

No, it should not have involved the post-audit activities of the certification body

Question 30

Was the involvement of Ms. Rebecca Hayes, the internal auditor, necessary for the audit at ImoAI? Refer to scenario 9.

Scenario 9: ImoAl, headquartered in California. USA, provides Al solutions for various industries such as finance, healthcare, retail, and manufacturing. Its clients

include major financial institutions seeking Al powered fraud detection systems, healthcare providers leveraging Al for diagnostics and patient care, retailers

optimizing supply chain management with Al forecasting, and manufacturers enhancing production efficiency through Al-driven automation.

ImoAl has recently undergone a certification audit to ensure that its artificial intelligence management system AIMS is in compliance with ISO/IEC 42001. During the

audit, a major nonconformity related to data security protocols was identified, requiring urgent resolution. ImoAl swiftly initiated corrective actions to address the

major nonconformity. The audit follow-up, in agreement with the auditee, was scheduled six weeks after the initial audit. As part of exploring alternatives to audit

follow-up, the audit team leader chose to verify the effectiveness of the actions taken by the auditee by scheduling a specific visit to ImoAI's premises.

The follow-up audit involved a thorough evaluation of the effectiveness of these actions. The audit team leader thoroughly examined the corrections, corrective actions,

and root cause analysis conducted by ImoAl to assess whether they adequately addressed the nonconformity identified during the initial audit.

In conjunction with the external audit follow-up, ImoAl engaged its internal auditing team to oversee the progress of corrective actions. The AIMS manager of ImoAl

updated Ms. Rebecca Hayes, the internal auditor, on the status of corrections and corrective actions prompted by the nonconformity identified during the external

audit. Subsequently, Ms. Hayes thoroughly reviewed these measures, analyzing the corrections, root causes, and effectiveness of the implemented actions.

Upon satisfactory validation of the action plans, ImoAl was recommended for certification.

Options:

Yes, the internal auditor should follow up on the action plans that have been submitted

No, as permission from the external auditor should have been required

No, as it falls outside the scope of the internal auditor’s responsibilities

Question 31

What is one of the key objectives of conducting an audit according to ISO 19011?

Options:

Issuing certificates of compliance

Imposing penalties on non-compliant organizations

Training employees on audit techniques

Evaluating the effectiveness of the management system

Question 32

Question:

Which of the following competencies must at least one of the audit team members possess?

Options:

Teamwork and communication skills

Knowledge of the risk-based approach to auditing

Knowledge of the auditee's language

Question 33

Which of the following should be considered when determining the feasibility of the audit?

Options:

The auditee's ability to negotiate the terms and conditions

The auditee's cooperation

The motivation of the audit team members

The number of audit days requested by the auditee

Question 34

Scenario 4: Finalogic leads the application of artificial intelligence in the financial services sector, which is used to improve risk assessment, fraud detection, and customer service. The company has implemented an artificial intelligence management system (AIMS) based on ISO/IEC 42001 to ensure operational quality, ethical AI use, regulatory compliance, and transparency, allowing for consistent oversight and structured governance.

This month, Finalogic is undergoing an audit to obtain certification against ISO/IEC 42001, a critical step in demonstrating its commitment to responsible AI. To evaluate Finalogic's conformity to the audit criteria, the audit team adopted a comprehensive, evidence-based approach. The gathered evidence ranged from analyses of unquantifiable information to analyses of samples related to determining the audit criteria—including internal reports generated by Finalogic's own AI system—which assert successful integration and compliance with the standard.

Additionally, presentations by the company’s AI team during the audit highlighted the system’s success in customer service enhancements and fraud detection, emphasizing improved efficiency, decision-making accuracy, and user trust. An evaluation report prepared by an independent third-party firm specializing in AI systems also provided an objective review of Finalogic's AIMS. It assessed the system's effectiveness, bias, and compliance through a thorough examination.

During the audit, the audit team applied the same level of effort and utilized the same techniques across all audit areas, regardless of their risk level. This strategy ensured a consistent and thorough evaluation of the AIMS, uncovering any latent weaknesses or inefficiencies that might otherwise go unnoticed.

Despite Finalogic's advanced AIMS and adherence to ISO/IEC 42001 for ethical AI practices, there remains a risk of AI algorithms inadvertently perpetuating bias or making inaccurate predictions due to unforeseen flaws in training data or algorithmic models. This could lead to unfair loan rejections or approvals, potentially causing financial losses or damaging the company’s reputation for fairness and accuracy in its financial services. By acknowledging these risks, Finalogic remains committed to refining its AI governance, implementing bias mitigation strategies, and enhancing transparency to uphold its reputation as a leader in AI-driven financial services.

What type of audit is Finalogic undergoing?

Options:

First party

Second party

Third party

Internal review

Question 35

Scenario 6 (continued):

Scenario 6: HappilyAI is a pioneering enterprise dedicated to developing and deploying artificial intelligence Al solutions tailored to enhance customer service experiences across various industries. The company offers innovative products like virtual assistants, predictive analytics tools, and personalized customer interaction platforms. As part of its commitment to operational excellence and innovation, HappilyAI has implemented a robust Al management system AIMS to oversee its Al operations effectively. Currently. HappilyAI is undergoing a comprehensive audit process of its AIMS to evaluate its compliance with ISO/IEC 42001.

Under the leadership of Jess, the audit team began the audit process with meticulous planning and coordination, setting the groundwork for the extensive on-site activities of the stage 1 audit. This initial phase was marked by a comprehensive documentation review. The audit scope encompassed a critical review of HappilyAI's core departments, including Research and Development (R&D), Customer Service, and Data Security, aiming to assess the conformity of HappilyAI's AIMS to the requirements of ISO/IEC 42001.

Afterward, Jess and the team conducted a formal opening meeting with HappilyAI to introduce the audit team and outline the audit activities. The meeting set a collaborative tone for the subsequent phases, where the team engaged in information collection, executed audit tests, identified findings, and prepared draft nonconformity reports while maintaining a strict quality review process.

In gathering evidence, the audit team employed a sampling method, which involved dividing the population into homogeneous groups to ensure a comprehensive and representative data collection by drawing samples from each segment. Furthermore, the team employed observation to deepen their understanding of the Al management processes. They verified the availability of essential documentation, including Al-related policies, and evaluated the communication channels established for reporting incidents.

Additionally, they scrutinized specific monitoring tools designed to track the performance of data acquisition processes, ensuring these tools effectively identify and respond to errors or anomalies. However, a notable challenge emerged as the team encountered a lack of access to documented information that describes how tasks about AIMS are executed. In addition to this, the team identified a potential nonconformity within the Sales Department. They decided not to record this as a nonconformity in the audit report but only communicated it to the HappilyAI's representatives.

During the stage 2 audit, the certification body, in collaboration with HappilyAI, assigned the roles of technical experts within the audit team. Recognized for their specialized knowledge and expertise in artificial intelligence and its applications, these technical experts are tasked with the thorough assessment of the AIMS framework to ensure its alignment with industry standards and best practices, focusing on areas such as data ethics, algorithmic transparency, and Al system security.

Question:

During the stage 2 audit, the certification body and the company assigned the roles of technical experts. Is this acceptable?

Options:

No, the roles of technical experts must be assigned by the certification body prior to conducting the audit

No, the company must assign the roles of technical experts independently of the certification body's involvement

Yes, the role of technical experts must be agreed upon by the certification body and the company during the audit process

Question 36

Scenario 2 (continued):

Empsy HR Solutions is a human resources consulting company that provides innovative HR solutions to diverse industries. Recognizing the significant impact of artificial intelligence Al in HR processes, including its ability to automate repetitive tasks, analyze vast amounts of data for insights, improve recruitment and talent management strategies, and personalize employee experiences, the company has initiated the implementation of an artificial intelligence management system AIMS based on ISO/IEC 42001.

Initially, the top management established an Al policy that was aligned with the company's objectives. The Al policy provided a framework for defining Al objectives, a commitment to meeting relevant requirements, and a dedication to continually improve the AIMS. However, it

did not refer to other organizational policies, although some were relevant to the AIMS. Afterward, the top management documented the policy, communicated it internally, and made it accessible to interested parties.

The top management designated specific individuals to ensure that the AIMS meets the standard's requirements. Additionally, they ensured that these individuals were responsible for overseeing the AIMS, reporting its performance to the top management, and facilitating continual improvement. Moreover, in its awareness sessions, the company focused exclusively on ensuring that all personnel

were informed about the Al policy, emphasizing their role in ensuring the effectiveness of the AIMS and the benefits of enhanced Al performance.

The company also planned, implemented, and monitored processes to meet AIMS requirements. Additionally, it set clear criteria and implemented controls based on them, ensuring effective operation, alignment with organizational objectives, and continual improvement. Empsy HR Solutions decided to implement strict measures to control changes to documented information within the AIMS. To ensure the integrity and accuracy of documentation, the company adopted version control practices. Each document update was tracked using a versioning system, with clear records of what was modified, who made the changes, and when the updates occurred. Access to make changes was restricted to authorized personnel, and any proposed modifications required approval from the designated management team before being implemented.

Moreover, considering past experiences where the company encountered unforeseen risks, Empsy HR Solutions established a comprehensive Al risk assessment process. This process involved identifying, analyzing, and evaluating Al risks to determine if it is necessary to implement additional controls than those specified in Annex A. The company also referred to Annex B for guidance on implementing controls and, ultimately, produced a Statement of Applicability So A. The SoA contained the necessary controls, including all the controls of Annex A and justifications for their inclusion or exclusion.

Lastly. Empsy HR Solutions decided to establish an internal audit program to ensure the AIMS conforms to both the company's requirements and ISO/IEC 42001. It defined the audit objectives, criteria, and scope for each audit, selected auditors, and ensured objectivity and impartiality during the audit process. The results of the first audit were documented and reported only to the top

management of the company.

Question:

Based on Scenario 2, has Empsy HR Solutions established a suitable internal audit program?

Options:

No, results of audits should also be reported to the relevant managers

Yes, the internal audit program was established in accordance with ISO/IEC 42001 requirements

No, the company should outsource the internal audit function to ensure objectivity and impartiality

Yes, provided results are communicated only to top management

Question 37

Question:

Which of the following does NOT represent the purpose of managing and maintaining audit program records?

Options:

To address information security and confidentiality needs for audit records

To demonstrate the implementation of the audit program

To focus on the competence and performance evaluation of the audit team members

Question 38

How are auditors expected to handle conflicts of interest during an audit?

Options:

By disclosing any potential conflicts and avoiding auditing the affected area

By excluding the affected area from the audit scope

By assigning an external auditor to handle the conflict

By ignoring conflicts to maintain impartiality

Question 39