I85PREP
⌘ K
ISO 42001 Lead Auditor study materials
ISO 42001 Lead Auditor study resources

ISO 42001 Lead Auditor practice questions

One question at a time. Build your ISO 42001 Lead Auditor understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of an AI management system

What is the primary purpose of an AI management system (AIMS) as defined in ISO/IEC 42001?

  1. To prescribe the model architectures that developers are permitted to use
  2. To certify that individual AI products are safe for their intended use
  3. To set the minimum accuracy that every deployed model must reach
  4. To set policies, objectives and processes for managing AI risks and opportunities Correct answer.

Explanation

A management system is a set of interrelated elements an organization uses to establish policy and objectives and the processes needed to achieve them. In an AIMS those elements are directed at AI-related risks and opportunities. ISO/IEC 42001 is technology-neutral and does not prescribe architectures, accuracy thresholds or product safety certification.

Question 2Fundamental principles and concepts of an AI management system

In the Plan-Do-Check-Act cycle applied to an AIMS, which activities belong to the 'Check' phase?

  1. Implementing the risk treatment plan and operational controls
  2. Establishing the AI policy and defining AI objectives
  3. Assigning roles and providing resources for the AIMS
  4. Monitoring, measuring and reporting on AIMS performance Correct answer.

Explanation

The Check phase covers performance evaluation: monitoring, measurement, analysis, internal audit and management review. Establishing policy and objectives belongs to Plan, while implementing controls and providing resources belongs to Do.

Question 3Fundamental principles and concepts of an AI management system

According to ISO/IEC 42001, which organizations can establish an AIMS?

  1. Only organizations that develop AI models in-house
  2. Only organizations operating in regulated industry sectors
  3. Any organization providing or using AI-based products or services Correct answer.
  4. Only organizations that exceed a defined employee headcount and revenue level

Explanation

The standard is generic and intended for use by any organization, regardless of size, type or nature, that provides or uses products or services making use of AI systems. It is not restricted by sector, size or whether development happens internally.

Question 4Fundamental principles and concepts of an AI management system

ISO/IEC 42001 adopts the definition of an AI system as an engineered system that:

  1. replaces human judgement in every task for which it has been configured
  2. operates autonomously in physical environments without any human-defined goals or oversight
  3. generates predictions, recommendations or decisions for human-defined objectives Correct answer.
  4. processes data using statistical methods to report results to decision makers

Explanation

An AI system is defined by the outputs it produces, such as content, forecasts, recommendations or decisions, for a given set of human-defined objectives. The definition does not require autonomy, physical embodiment, or the replacement of human judgement.

Question 5Fundamental principles and concepts of an AI management system

How must an organization's AI policy be maintained under ISO/IEC 42001?

  1. As an oral briefing repeated whenever new staff join the AI team
  2. As a public statement filed with the national AI regulator before use
  3. As a confidential annex available only to the certification body
  4. As documented information, communicated and available to interested parties Correct answer.

Explanation

The AI policy is required to be established, maintained and made available as documented information. It must be communicated within the organization and be available to interested parties as appropriate.

Question 6Fundamental principles and concepts of an AI management system

What does Annex A of ISO/IEC 42001 contain?

  1. Implementation guidance for each clause of the standard
  2. Templates for AI system technical documentation
  3. A reference set of controls and control objectives related to AI Correct answer.
  4. A list of mandatory performance metrics for AI models

Explanation

Annex A provides the reference control set, organized into control objectives, from which organizations select controls through risk treatment. Implementation guidance for the clauses and controls is found in a separate informative annex.

Question 7Fundamental principles and concepts of an AI management system

Which of the following best illustrates an interested party for an AIMS?

  1. A group of people whose eligibility decisions are made by the AI system Correct answer.
  2. An auditor employed by a different certification body
  3. A competitor that markets a similar AI product
  4. A journalist who has never interacted with the organization or its systems

Explanation

Interested parties are those who can affect, be affected by, or perceive themselves to be affected by a decision or activity. People whose opportunities or treatment depend on AI outputs are directly affected and therefore central to AI-specific considerations.

Question 8Fundamental principles and concepts of an AI management system

In ISO/IEC 42001, 'top management' refers to:

  1. the manager who holds the largest budget for AI projects in the organization
  2. the external certification body's lead auditor who assesses the AIMS once a year
  3. the person or group that directs and controls the organization at the highest level Correct answer.
  4. the head of the data science department, who owns all deployed models

Explanation

Top management is the person or group of people who directs and controls an organization at the highest level. Leadership requirements such as establishing the AI policy and integrating it into business processes are assigned to this level.

Question 9Fundamental principles and concepts of an AI management system

Under ISO/IEC 42001, when must the AI risk assessment be repeated?

  1. Only when a regulator formally requests the assessment results
  2. Only once, during the initial certification audit
  3. Each time a new member joins the AI development team
  4. At planned intervals and when significant changes are proposed or occur Correct answer.

Explanation

The standard requires the AI risk assessment to be performed at planned intervals and whenever significant changes are proposed or occur. This keeps the assessment aligned with the current context, systems and risks.

Question 10Fundamental principles and concepts of an AI management system

An AI system impact assessment required by ISO/IEC 42001 focuses primarily on:

  1. the processing speed of the AI system under peak load
  2. the consequences for individuals, groups or society of the AI system Correct answer.
  3. the technical accuracy of the model on a held-out test set
  4. the financial return the AI system generates for the organization and its shareholders

Explanation

The impact assessment addresses the potential consequences of the AI system for individuals, groups of individuals or society, including in situations the organization did not anticipate. It complements the risk assessment rather than duplicating technical or financial evaluation.

Question 11Fundamental principles and concepts of an AI management system

What is the purpose of the Statement of Applicability in an AIMS?

  1. It records the training data sources used to build each deployed model
  2. It declares the organization's compliance with national AI legislation
  3. It identifies the applicable Annex A controls and justifies any exclusions Correct answer.
  4. It lists the employees and roles that are authorized to approve changes to AI systems

Explanation

The Statement of Applicability records which Annex A controls the organization has determined necessary and why, together with a justification for any control that is excluded. It is the link between the risk treatment decisions and the implemented control set.

Question 12Fundamental principles and concepts of an AI management system

How does ISO/IEC 42001 require responsibilities and authorities for the AIMS to be handled?

  1. They are left to each team to decide informally during project work
  2. They are held exclusively by the external AI ethics consultant
  3. They are assigned and communicated within the organization Correct answer.
  4. They are defined once at the start and never revised afterwards

Explanation

Top management must ensure that responsibilities and authorities for relevant roles are assigned and communicated within the organization. Clear assignment supports accountability across the AI system life cycle and interactions with third parties.

Question 13Fundamental principles and concepts of an AI management system

Training data for a hiring model is found to contain outdated records that disadvantage one group of applicants. Which Annex A control objective is most directly concerned?

  1. Data for AI systems, covering acquisition, quality and provenance Correct answer.
  2. Internal organization, covering roles, responsibilities and reporting lines
  3. Policies related to AI, covering the overall direction set by management
  4. Information for interested parties, covering transparency and communication

Explanation

The data control objective addresses how data used by AI systems is acquired, prepared, qualified and documented, including provenance and suitability for the intended use. Defects such as outdated or unrepresentative records are handled there.

Question 14Fundamental principles and concepts of an AI management system

Which of the following is an awareness requirement of ISO/IEC 42001?

  1. All staff must be able to explain the Annex A controls verbatim
  2. Every employee must be trained to build machine learning models
  3. Managers must hold an accredited AI certification before supervising AI projects
  4. Workers must understand how they contribute to the effectiveness of the AIMS Correct answer.

Explanation

Persons doing work under the organization's control must be aware of the AI policy, their contribution to the effectiveness of the AIMS, and the implications of not conforming with requirements. The standard does not mandate model-building skills or formal AI credentials for all staff.

Question 15Fundamental principles and concepts of an AI management system

How should an AIMS relate to the organization's other management systems?

  1. It should be kept completely separate so that AI risks stay confidential within the AI team
  2. It should be documented only for the duration of the certification audit cycle
  3. It should replace existing quality and information security systems
  4. It should be integrated with the organization's business and management processes Correct answer.

Explanation

The AIMS is intended to be part of the organization's overall management processes rather than a parallel structure. Integration lets AI-related risk and impact considerations feed into existing planning, operations and improvement activities.

Question 16Fundamental principles and concepts of an AI management system

Clause 9.1 of ISO/IEC 42001 expects the organization to determine, among other things:

  1. the names of the customers who will receive AI outputs
  2. the programming language used for each AI component
  3. the methods for monitoring, measurement, analysis and evaluation Correct answer.
  4. the exact commercial price of each AI service offered

Explanation

Performance evaluation requires the organization to decide what needs monitoring and measuring, the methods to be used, when monitoring and measurement are performed, who performs them, and when results are analysed and evaluated. Commercial and technical design choices fall outside this requirement.

Question 17Fundamental principles and concepts of an AI management system

An organization embeds a third-party foundation model in its own product. What does ISO/IEC 42001 expect in relation to the provider?

  1. Nothing, because the model is outside the organization's scope
  2. Full access to the provider's source code before deployment
  3. Transfer of all AI risk to the provider by contract
  4. Due diligence on the provider and defined responsibilities in the agreement Correct answer.

Explanation

The third-party and customer relationship controls require appropriate due diligence on providers and clarity about how responsibilities are divided across the AI system life cycle. Responsibilities should be agreed and reflected in the arrangements with the provider.

Question 18Fundamental principles and concepts of an AI management system

What does human oversight mean in the context of AI system use under ISO/IEC 42001?

  1. A human approves the budget for the AI system each quarter
  2. The AI system reports its decisions to a human after one year
  3. A human reviews every single output the AI system ever produces
  4. Competent people can monitor the system and intervene when needed Correct answer.

Explanation

Human oversight means that people with the necessary competence and authority can monitor the AI system and intervene or override its outputs where appropriate to the context. The level and form of oversight should be proportionate to the risks and impacts involved.

Question 19Fundamental principles and concepts of an AI management system

The control objective on information for interested parties is primarily about:

  1. keeping AI system documentation confidential at all times
  2. publishing the source code of every deployed model
  3. selling AI outputs to as many customers as possible
  4. providing suitable information about AI systems to those affected Correct answer.

Explanation

This control objective addresses transparency: giving interested parties appropriate information about the AI system, such as its nature, intended use and limitations, so that they can understand and respond to its effects. The depth of information is proportionate to the context.

Question 20Fundamental principles and concepts of an AI management system

How is 'risk' defined in ISO/IEC 42001?

  1. Any event that causes financial loss to the organization
  2. The probability that an AI model produces an incorrect output
  3. The likelihood of failing a certification audit
  4. The effect of uncertainty on objectives, which can be positive or negative Correct answer.

Explanation

Risk is defined in the standard as the effect of uncertainty on objectives, and effects can be positive as well as negative. This broad definition is why the AIMS addresses both threats and opportunities.

Question 21Fundamental principles and concepts of an AI management system

How do AI system impact assessments relate to the AI risk assessment in ISO/IEC 42001?

  1. Identified impacts inform the risk assessment and any needed risk treatment Correct answer.
  2. Impact assessments replace the risk assessment for high-risk AI systems
  3. The two are unrelated and managed by different external parties
  4. Impact assessments are performed only after a system is retired

Explanation

Impact assessments surface consequences for individuals and society that the organization may not otherwise consider. Those findings feed into the risk assessment and treatment so that the control set addresses the identified impacts.

Question 22Fundamental principles and concepts of an AI management system

An organization corrects a defective model release and records the fix. What else is required when handling a nonconformity?

  1. A public apology issued to all interested parties
  2. Analysis of the cause and action to prevent recurrence Correct answer.
  3. Replacement of the entire AI development team
  4. Immediate withdrawal from the certification scheme

Explanation

Correcting the immediate problem is only a correction. The organization must also evaluate the need for action to eliminate the cause, so that the nonconformity does not recur or appear elsewhere, and retain documented information on the results.

Question 23Fundamental principles and concepts of an AI management system

Which of the following is a required input to the management review of an AIMS?

  1. The salary bands of the AI development team
  2. Results of AI system impact assessments and status of previous actions Correct answer.
  3. The stock price of the organization's technology suppliers
  4. The marketing plan for the organization's AI products

Explanation

Management review inputs include the status of actions from previous reviews, changes in internal and external issues, feedback from interested parties, monitoring and measurement results, audit results, and information about AI risks, impacts and opportunities. Commercial and personnel data are not prescribed inputs.

Question 24Fundamental principles and concepts of an AI management system

What does certification of an organization against ISO/IEC 42001 demonstrate?

  1. That the organization's AI products meet all applicable safety regulations
  2. That every deployed AI model has been independently tested for bias
  3. That an AIMS conforming to the standard is in place for the defined scope Correct answer.
  4. That the organization's AI systems have achieved a defined accuracy level

Explanation

Certification attests that the management system has been assessed as conforming to the standard within a defined scope. It says nothing directly about the technical performance, bias testing or regulatory approval of any particular AI system.

Question 25Fundamental principles and concepts of an AI management system

What does the AI system life cycle control objective require of an organization?

  1. Controls across the whole life cycle, including retirement of the system Correct answer.
  2. Controls that end once the model is deployed to production
  3. Controls limited to the data collection phase of development
  4. Controls that apply only while the model is being trained

Explanation

The life cycle controls are expected to cover all phases, from conception and development through deployment and operation to decommissioning and retirement. Risks and impacts can arise at any phase, so restricting controls to one stage leaves gaps.

Question 26Fundamental principles and concepts of an AI management system

Which of the following best describes an 'AI system' as the term is used in ISO/IEC 42001?

  1. A software package that stores and retrieves organizational records so that they can be analysed later by staff
  2. An engineered system that produces outputs such as predictions or decisions for defined objectives Correct answer.
  3. A set of documented procedures that govern how technology is deployed across the organization
  4. A hardware platform that provides the computing capacity used for large-scale data processing activities

Explanation

The standard adopts the widely used definition of an AI system as an engineered system that generates outputs such as predictions, content, recommendations or decisions for a given set of objectives. The defining characteristic is the generation of such outputs to serve defined objectives, not the storage of records, the provision of computing capacity, or the existence of procedures.

Question 27Fundamental principles and concepts of an AI management system

In ISO/IEC 42001, the term 'documented information' covers:

  1. Only the AI system documentation supplied by an external vendor or supplier
  2. Both documents that must be maintained and records that must be retained Correct answer.
  3. Only records produced as evidence that AIMS processes have been carried out
  4. Only the AI policy and the objectives established for the AIMS

Explanation

The standard uses the harmonized-structure term 'documented information' to cover both documents the organization maintains (for example the AI policy and scope) and records it retains as evidence (for example risk assessment results). Individual requirements indicate whether information is to be maintained, retained, or both.

Question 28Fundamental principles and concepts of an AI management system

Which of the following best describes continual improvement of an AIMS under ISO/IEC 42001?

  1. Extending the AIMS scope so that it eventually covers every software system in the organization
  2. Repeatedly enhancing the suitability, adequacy and effectiveness of the AIMS Correct answer.
  3. Restoring the AIMS to its planned performance after a nonconformity has been identified
  4. Replacing the deployed AI model with a newer version whenever one becomes commercially available

Explanation

Continual improvement is about enhancing the suitability, adequacy and effectiveness of the management system itself, and it is a recurring activity driven by performance evaluation and management review. It is broader than remedying a single nonconformity and is not tied to model refresh cycles or to expanding scope.

Question 29Fundamental principles and concepts of an AI management system

An engineering team argues that ISO/IEC 42001 obliges it to adopt named model-testing techniques such as adversarial robustness testing. How should a lead auditor characterize the standard's expectations?

  1. It requires the organization to apply the specific model-testing techniques listed in Annex A of the standard
  2. It requires the organization to determine its own risk treatment rather than prescribing technical methods Correct answer.
  3. It excludes technical testing from the AIMS and leaves that responsibility to external regulators only
  4. It mandates adversarial robustness testing for every AI system that the organization places on the market

Explanation

ISO/IEC 42001 is a management system standard: it specifies processes for risk assessment, risk treatment, impact assessment and life cycle control, and leaves the choice of specific technical methods to the organization based on its own risk assessment. Annex A provides control objectives and controls, not a catalogue of mandated test techniques.

Question 30AI management system requirements

When establishing the context of the organization for its AI management system, what must the organization determine?

  1. The names of all suppliers that provide cloud computing services
  2. The value of each AI system in the asset register
  3. The complete inventory of algorithms embedded in each AI product
  4. Internal and external issues relevant to its purpose and strategic direction Correct answer.

Explanation

Clause 4.1 requires the organization to determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcomes of the AIMS. The other items may be useful operational data, but none of them is the required context determination.

Question 31AI management system requirements

Under the AI management system, which body is responsible for establishing the AI policy?

  1. The information security manager
  2. Top management Correct answer.
  3. The AI development team leads
  4. The internal audit function

Explanation

Clause 5.2 places the responsibility for establishing, implementing and maintaining the AI policy on top management. The policy must be appropriate to the organization's purpose and provide a framework for setting AI objectives.

Question 32AI management system requirements

What must an organization determine about interested parties for its AI management system?

  1. The revenue that each interested party generates annually
  2. Which interested parties are relevant and which of their requirements are relevant Correct answer.
  3. The number of employees each party employs
  4. The contractual penalties each party has agreed to accept

Explanation

Clause 4.2 requires the organization to determine the interested parties that are relevant to the AIMS and the relevant requirements of those interested parties. Determining this is the foundation for defining scope and for identifying compliance obligations.

Question 33AI management system requirements

How must the scope of the AI management system be made available?

  1. Orally during the opening meeting of each audit
  2. As documented information that is maintained and available to interested parties Correct answer.
  3. Through the organization's public website and marketing material
  4. Only to external auditors upon written request

Explanation

Clause 4.3 requires the scope of the AIMS to be available as documented information. The scope must state the boundaries and applicability of the management system and justify any exclusions.

Question 34AI management system requirements

Which action best demonstrates top management commitment to the AI management system?

  1. Allowing teams to choose whether to follow AI procedures
  2. Integrating AIMS requirements into the organization's business processes Correct answer.
  3. Approving the audit schedule once every three years
  4. Delegating all AI decisions to an external consultancy

Explanation

Clause 5.1 expects top management to demonstrate leadership by ensuring AIMS requirements are integrated into the organization's business processes. Commitment is shown through integration and active direction, not through periodic approval alone.

Question 35AI management system requirements

What must top management do with respect to roles in the AIMS?

  1. Assign responsibility and authority for relevant roles and communicate them Correct answer.
  2. Restrict AI responsibilities to the legal department only
  3. Personally perform every AI risk assessment
  4. Document roles only for staff based at the head office

Explanation

Clause 5.3 requires top management to ensure that responsibilities and authorities for relevant roles are assigned and communicated within the organization. This includes responsibility for the conformity and performance of the AIMS and for reporting on it.

Question 36AI management system requirements

Which of the following must persons doing work under the organization's control be aware of under the AIMS?

  1. The personal contact details of the certification body
  2. The implications of not conforming with AIMS requirements Correct answer.
  3. The market share of the organization's competitors
  4. The salaries of the AI development team

Explanation

Clause 7.3 requires awareness of the AI policy, of relevant AI objectives, of one's contribution to the effectiveness of the AIMS, and of the implications of not conforming with AIMS requirements. The latter is what makes nonconformity consequences visible to staff.

Question 37AI management system requirements

Which requirement addresses improvement of the AI management system?

  1. Publishing an annual sustainability report
  2. Retaining financial records for seven years
  3. Benchmarking against competitor AI products
  4. Continually improving the suitability, adequacy and effectiveness of the AIMS Correct answer.

Explanation

Clause 10.2 requires the organization to continually improve the suitability, adequacy and effectiveness of the AI management system. Improvement is a standing requirement, not a one-off project.

Question 38AI management system requirements

How does an AI system impact assessment differ from an AI risk assessment?

  1. It focuses on consequences for individuals, groups and society rather than on organizational objectives alone Correct answer.
  2. It is performed only after an AI system has been decommissioned
  3. It replaces the need for any risk assessment and risk treatment within the AIMS
  4. It is optional for organizations that develop AI systems internally

Explanation

The impact assessment examines the potential consequences of an AI system for individuals, groups of individuals and wider society, whereas the risk assessment addresses risks in relation to the organization's AI objectives and risk criteria. The two processes are complementary and both form part of the AIMS.

Question 39AI management system requirements

When should an AI system impact assessment be carried out?

  1. Only once, at the moment the AI system is first conceived
  2. Only after a regulator has issued a formal complaint
  3. Before deploying the AI system and again when significant changes occur Correct answer.
  4. Exclusively during the annual management review meeting

Explanation

The impact assessment process must be applied before an AI system is deployed and must be repeated when significant changes to the system, its use or its context occur. Impact can change as data, purpose or user population changes.

Question 40AI management system requirements

After completing an AI risk assessment, what does AI risk treatment require?

  1. Transferring all identified risks to the organization's insurance provider
  2. Immediate decommissioning of every AI system with an identified risk
  3. Selecting treatment options and determining residual risk against the risk criteria Correct answer.
  4. Recording risks without changing any existing controls or processes

Explanation

Risk treatment involves selecting appropriate options, planning and implementing them, and determining the residual risk in relation to the established risk criteria. The organization must also retain documented information of the treatment and its results.

Question 41AI management system requirements

When must an organization repeat its AI risk assessment?

  1. Only when a certification body requests it in writing
  2. Only at the end of the AI system's operational life
  3. At planned intervals and when significant changes are proposed or occur Correct answer.
  4. Only when a new competitor releases a similar AI product

Explanation

The AI risk assessment process must be performed at planned intervals and whenever significant changes are proposed or occur. This keeps the risk picture current as systems, data, use cases and context evolve.

Question 42AI management system requirements

Which documented information must the organization retain as evidence of its AI risk treatment process?

  1. Minutes of every informal conversation about AI risk
  2. Results of AI risk treatment and the determination of residual risk Correct answer.
  3. Copies of all marketing materials featuring AI features
  4. The personal development plans of all external contractors

Explanation

The standard requires documented information of the AI risk treatment process and its results, including the determination of residual risk against the risk criteria. This provides auditable evidence that treatment was planned and evaluated.

Question 43AI management system requirements

What must the internal audit programme of the AIMS consider?

  1. The importance of processes, changes affecting the organization and previous audit results Correct answer.
  2. The seniority of the managers whose departments will be audited
  3. Only the availability of auditors during public holidays
  4. The cost of audit tools compared with the AIMS budget

Explanation

The audit programme must be planned taking into account the importance of the processes concerned, changes affecting the organization and the results of previous audits. Auditors must also be selected so that the audit is objective and impartial.

Question 44AI management system requirements

Which item is a required input to the AIMS management review?

  1. The marketing department's quarterly sales forecast
  2. Results of AI risk assessments and AI system impact assessments Correct answer.
  3. The competitor analysis performed by the sales team
  4. The personal performance ratings of the audit team

Explanation

Management review inputs include information on the performance of the AIMS, such as results of AI risk assessments, status of risk treatment, and results of AI system impact assessments. These feed decisions on improvement, resources and changes to the AIMS.

Question 45AI management system requirements

What must AI objectives set under the AIMS be?

  1. Written only in general terms such as 'improve AI'
  2. Measurable, monitored, communicated and updated as appropriate Correct answer.
  3. Set exclusively by the internal audit function
  4. Kept confidential and undocumented to protect trade secrets

Explanation

Clause 6.2 requires AI objectives to be consistent with the AI policy, measurable where practicable, monitored, communicated and updated as appropriate, with documented information describing them. Objectives that cannot be measured cannot be evaluated.

Question 46AI management system requirements

How does the AIMS requirement for competence apply?

  1. It applies only to employees located in the same country as headquarters
  2. It applies to persons doing work under the organization's control that affects AI performance Correct answer.
  3. It applies only to staff who hold a formal AI qualification
  4. It applies only to the chief executive and the board of directors

Explanation

The competence requirement covers persons doing work under the organization's control whose work affects AI performance, including contractors and third-party personnel. The organization must determine necessary competence and ensure it is achieved.

Question 47AI management system requirements

Which control area addresses data used to develop or operate AI systems?

  1. Brand guidelines for the organization's visual identity
  2. Physical security of office furniture and fittings
  3. Vehicle fleet maintenance and driver training records
  4. Data quality, provenance and preparation for AI systems Correct answer.

Explanation

The data controls in Annex A cover the acquisition, quality, provenance and preparation of data used for AI systems. These controls recognize that poor data undermines the performance and fairness of AI systems.

Question 48AI management system requirements

Which set of stages belongs to AI system life cycle management?

  1. Recruitment, payroll and retirement
  2. Marketing, advertising and public relations
  3. Development, deployment, operation, monitoring and decommissioning Correct answer.
  4. Purchasing, invoicing and credit control

Explanation

AI system life cycle controls apply across development, verification and validation, deployment, operation and monitoring, and decommissioning. Each stage carries distinct risks that the organization must control.

Question 49AI management system requirements

An organization uses a third-party vendor to develop and operate its AI system. What does the AIMS require in this situation?

  1. That the AIMS scope excludes the AI system because a supplier operates it
  2. That responsibilities are clearly allocated and the organization remains accountable Correct answer.
  3. That the organization stops recording the AI system in its documented information
  4. That the vendor's own management system certification replaces the AIMS

Explanation

Controls for third-party relationships require clear allocation of responsibilities between the organization and the provider, together with appropriate oversight. Outsourcing activities does not outsource accountability for the AIMS.

Question 50AI management system requirements

Which consideration is most central to an AI system impact assessment?

  1. Effects on the speed of the IT service desk's ticket resolution
  2. Effects on the number of features included in the next release
  3. Effects on the organization's quarterly profitability and sales growth
  4. Effects on individuals and groups, including vulnerable groups Correct answer.

Explanation

The impact assessment examines potential consequences of the AI system for individuals, groups of individuals and society, with particular attention to those who may be disproportionately affected. Commercial and operational metrics are handled through other processes.