Did the audit team conduct their meetings in accordance with best practices? Refer to Scenario 7.

Scenario 7: TastyMade. headquartered in Hamburg, Germany, is an established company in the food manufacturing industry that applies Al technologies in its

operations. It has implemented an artificial intelligence management system AIMS based on ISO/IEC 42001 to further strengthen its Al management and ensure

compliance with international standards. As part of its commitment to excellence and continual improvement, TastyMade is undergoing an audit process to achieve

certification against ISO/IEC 42001.

In preparation for the audit, TastyMade collaborated closely with the audit team leader to develop a detailed audit plan. This plan encompassed objectives, criteria,

scope, and logistical arrangements for both on-site and remote audit activities. Recognizing the specialized nature of Al integration, a technical expert was brought in

to support the audit team and ensure comprehensive coverage of relevant aspects. Upon discussion with the audit team leader, it was mutually decided that not every

audit team member would need a guide throughout the audit process. At times, the TastyMade itself would assume the role of the guide, actively facilitating audit

activities.

A formal opening meeting was held with TastyMade ' s management to provide an overview of the audit process and set expectations. During this meeting, key

interested parties were briefed on the audit objectives and the methodologies that would be employed during the audit. Following the meeting, the audit team

proceeded with their work, collecting information and conducting tests to evaluate the effectiveness of TastyMade ' s AIMS.

Daily evening meetings were held to review progress, discuss encountered issues, and facilitate collaboration among audit team members. The audit team leader

adopted an open communication approach, encouraging all auditors to share their findings and challenges. The communication regarding the progress of the audit

was informal, allowing for a fluid exchange of information and updates among team members.

To verify adherence to some requirements of clause 4.1 Understanding the organization and its context, the audit team arbitrarily selected for analysis a representative

sample of Al management practices across different departments and functions within the company.

During the audit process, the technical expert uncovered certain technical and operational findings related to the integration and governance of Al systems.

Recognizing the significance of these findings, the expert promptly informed the audit team leader. Understanding the need for further clarification and direct

communication, the audit team leader authorized the technical expert to address the findings directly with the auditee. However, to ensure proper oversight, the expert

was supervised by one of the audit team members.

Throughout the audit, it became apparent that TastyMade promoted a culture of autonomy and decentralized decision-making in Al integration processes. Employees

were empowered to set goals, allocate responsibilities, and devise methodologies independently, with management providing guidance and support as needed. This

approach fostered innovation and agility within the company

What precautions must the certification body take when conducting short-notice audits?

Scenario 1:

To ensure the integrity of the AI system, Future Horizon Academy has implemented measures to ensure that training data remain isolated from data that could lead to harmful or undesirable outcomes. The institution adds significant data elements as metadata, transforms the data into a format usable by the AI system, and uses data from one or more trusted sources.

Committed to standardization and continual improvement, Future Horizon Academy decided to implement an artificial intelligence management system (AIMS) based on ISO/IEC 42001 that would help the institution increase operational efficiency, resulting in improved processes.

After having the AIMS in place for a year, the institution decided to apply for a certification audit to get certified against ISO/IEC 42001. Prior to the certification audit, the institution conducted an internal audit and management review to ensure that the AIMS aligns with the institution’s own requirements and that the system is being maintained effectively.

Question:

Which of the following AI principles has Future Horizon Academy applied?

Scenario 4 (continued):

BioNovaPharm, a German biopharmaceutical company, has implemented an artificial intelligence management system AIMS based on ISO/IEC 42001 to optimize various aspects of drug discovery, including analyzing extensive biological data, identifying potential drug candidates, and streamlining clinical trial processes. After having the AIMS in place for over a year, the company contracted a certification body and is now undergoing an AIMS audit to obtain certification against ISO/IEC 42001.

Adopting a risk-based approach, the audit team focused on risk throughout their activities. The level of detail outlined in the audit plan corresponded to the scope and complexity of the audit. The team employed a ranking system for detailed audit procedures, prioritizing those with the highest risk.

Once the stage 1 audit began, the audit team started reviewing the auditee ' s documented information. To assess whether BioNovaPharm complies with the legal and regulatory requirements related to incident communication, the audit team examined evidence provided by the company’s external legal office. The evidence confirmed that BioNovaPharm applies the requirements of the EU Al Act, which mandates that providers of high-risk Al systems report serious incidents to relevant authorities.

Following the completion of the stage 1 audit, John, an audit team member, documented the stage 1 audit outputs, including the observations of the audit team that could result in nonconformities during the on-site audit. However, the audit team leader, Emma, who was overseeing the audit activities, observed that John failed to document significant observations related to the lack of transparency in the Al decision-making processes of BioNovaPharm. Considering that Emma observed John ' s lack of competence in undertaking some

audit activities, a disciplinary note was recorded for John.

Question:

Based on Scenario 4, does the level of detail in the audit plan adequately reflect all aspects recommended for a comprehensive risk-based approach to planning?

Scenario 8 (continued):

Scenario 8:

Scenario 8: InnovateSoft, headquartered in Berlin, Germany, is a software development company known for its innovative solutions and commitment to excellence. It specializes in custom software solutions, development, design, testing, maintenance, and consulting, covering both mobile apps and web development. Recently, the company underwent an audit to evaluate the effectiveness and

compliance of its artificial intelligence management system AIMS against ISO/IEC 42001.

The audit team engaged with the auditee to discuss their findings and observations during the audit ' s final phases. After evaluating the evidence, the audit team presented their audit findings to InnovateSoft, highlighting the identified nonconformities.

Upon receiving the audit findings, InnovateSoft accepted the conclusions but expressed concerns about some findings inaccurately reflecting the efficiency of their software development processes. In response, the company provided new evidence and additional information to alter the audit conclusions for a couple of minor nonconformities identified. After thorough consideration, the audit team leader clarified that the new evidence did not significantly alter the core conclusions drawn for the nonconformities. Therefore, the certification body issued a certification recommendation conditional upon the filing of corrective action plans without a prior visit.

InnovateSoft accepted the decision of the certification body. The top management of the company also sought suggestions from the audit team on resolving the identified nonconformities. The audit team leader offered solutions to address the issues, fostering a collaborative effort between the auditors and InnovateSoft. During the closing meeting, the audit team covered key topics to enhance transparency. They clarified to InnovateSoft that the audit evidence was based on a sample, acknowledging the inherent uncertainty. The method and time frame of reporting and grading findings were discussed to provide a structured overview of nonconformities. The certification body ' s process for handling nonconformities, including potential consequences, guided InnovateSoft on corrective actions. The time frame for presenting a plan for correction was

communicated, emphasizing urgency. Insights into the certification body’s post-audit activities were provided, ensuring ongoing support.

Lastly, the audit team briefed InnovateSoft on complaint and appeal handling.

InnovateSoft submitted the action plans for each nonconformity separately, describing only the detected issues and the corrective actions planned to address the detected nonconformities. However, the submission slightly exceeded the specified period of 45 days set by the certification body, arriving three days later. InnovateSoft explained this by attributing the delay to unexpected challenges encountered during the compilation of the action plans.

During the closing meeting, the audit team covered key topics including sampling uncertainty, timelines for corrections, and complaint/appeals procedures.

Question:

Based on Scenario 8, was the concluding meeting comprehensive in addressing all essential components of the audit?

What does ISO 19011 provide?

Question:

What type of audit is conducted when a customer audits suppliers to make purchasing decisions?

Scenario 9:

Scenario 9: Securisai, located in Tallinn. Estonia, specializes in the development of automated cybersecurity solutions that utilize AI systems. The company recently implemented an artificial intelligence management system AIMS in accordance with ISO/IEC 42001. In doing so, the company aimed to manage its Al-driven systems’ capabilities to detect and mitigate cyber threats more efficiently and ethically. As part of its commitment to upholding the highest standards of Al use and management, Securisai underwent a certification audit to demonstrate compliance with ISO/IEC 42001.

The audit process comprised two main stages: the initial or stage 1 audit focused on reviewing Securisai ' s documentation, policies, and procedures related to its AIMS. This review laid the groundwork for the stage 2 audit, which involved a comprehensive, on-site evaluation

of the actual implementation and effectiveness of the AIMS within Securisai ' s operations. The goal was to observe the AIMS in operation, ensuring that it not only existed on paper but was effectively integrated into the company ' s daily activities and cybersecurity strategies.

After the audit, Roger, Securisai ' s internal auditor, addressed the action plans devised to rectify nonconformities identified during the certification audit. He developed a long term strategy, highlighting key AIMS processes for triennial audits. Roger ' s internal audits play a

key role in advancing Securisai ' s goals by employing a systematic and disciplined method to assess and boost the efficiency of risk

management, governance processes, and strategic decision-making. Roger reported his findings directly to Securisai ' s top management.

Following the successful rectification of nonconformities, Securisai was officially certified against ISO/IEC 42001.

Recently, the company decided to transfer its ISO/IEC 42001 certification registration from one certification body to another despite being initially bound by a long-term agreement with the current certification body. This decision was motivated by the desire to partner with a certification body that offers deeper insights and expertise in the rapidly evolving field of artificial intelligence in cybersecurity.

To ensure a smooth transition and uphold its certification status, Securisai is diligently compiling the required documentation for submission to the new certification body. This includes a formal request, the most recent audit report underscoring its adherence to ISO/IEC 42001, the latest corrective action plan that highlights its continuous efforts toward improvement, and a copy of its current valid certification registration.

A year following Securisai ' s initial certification audit, a subsequent audit was carried out by the certification body on its AIMS. The

purpose of this audit was to assess compliance with ISO/IEC 42001 and verify the ongoing improvement of the AIMS. The audit team

concluded that Securisai ' s AIMS consistently meets the requirements set by ISO/IEC 42001.

Question:

Roger followed up on action plans resulting from external audits. Is this acceptable?

Question:

Which of the following standards emphasizes the importance of conducting AI system impact assessments to evaluate the potential effects on individuals and societies affected by the AI system?

Which of the following does NOT represent the purpose of managing and maintaining audit program records?