A company develops an AI-based health monitoring system that provides insights and recommendations to users. However, users have reported that they do not understand how the system arrives at its recommendations. Which core element should the company enhance to improve user trust and understanding?

A few months after an audit, the auditor returns to the company to verify that corrective actions have been effectively implemented and that the issues identified have been resolved. Which step of the management system audit process does this activity correspond to?

Based on scenario 3, which of the following AI technologies did Augustine utilize to analyze large datasets? Refer to the fourth paragraph.

Scenario 3: Heala specializes in developing Al-driven solutions for the healthcare sector. With a keen focus on leveraging Al to revolutionize patient care, diagnostics,

and treatment planning, the company has implemented an artificial intelligence management system AIMS based on ISO/IEC 42001. After a year of having the AIMS in

place, the company decided to apply for a certification audit.

It contracted a local certification body, who established the audit team and assigned the audit team leader. Augustine, the designated audit team leader, has a wide

range of skills relevant to various auditing domains. His proficiency encompasses audit principles, processes, and methods, as well as standards for management

systems and additional references. Furthermore, he is knowledgeable about the Heala’s context and relevant statutory and regulatory requirements.

Augustine first gathered management review records, interested party feedback logs, and revision histories for Heala ' s AIMS. This crucial step laid the groundwork for

a deeper investigation, which included conducting comprehensive interviews with key personnel to understand how feedback from interested parties directly

influenced updates to the AIMS and its strategic direction. Augustine ' s thorough evaluation process aimed to verify Heala ' s commitment to integrating the needs and

expectations of interested parties, a critical requirement of ISO/IEC 42001.

Augustine also integrated a sophisticated Al tool to analyze large datasets for patterns and anomalies, and thus have a more informed and data driven audit process.

This Al solution, known for its ability to sift through vast amounts of data with unparalleled speed and accuracy, enabled Augustine to identify irregularities and trends

that would have been nearly impossible to detect through manual methods. The tool was also helpful in preparing hypotheses based on data.

During the audit. Augustine failed to fully consider Heala’s critical processes, expectations, the complexity of audit tasks, and necessary resources beforehand. This

oversight compromised the audit integrity and reliability, reflecting a significant deviation from the diligence and informed judgment expected of auditors.

Which of the following should be considered when determining the feasibility of the audit?

The certification body did not include all departments covered by the AIMS scope in the audit scope. Is this acceptable? Refer to Scenario 5.

Scenario 5: Alterhealth is a mid-sized technology firm based in Toronto. Canada. It develops Al systems for healthcare providers, focusing on improving patient care,

optimizing hospital workflows, and analyzing healthcare data for insights that can improve health outcomes. To ensure responsible and effective use of Al in its

operations, Alterhealth has implemented an artificial intelligence management system AIMS based on ISO/IEC 42001. After a year of having the AIMS in place, the

company decided to apply for a certification audit to obtain certification against ISO/IEC 42001.

The company contracted a certification body to conduct the audit, who assembled the audit team and appointed the audit team leader. The audit team leader had

conducted a certification audit at Alterhealth in the past. The top management of Alterhealth decided to reject the appointment of this auditor because they believed

that they would not receive added value from the audit. In response, the certification body appointed Jonathan, an independent auditor with no prior engagements with

Alterhealth, as the new audit team leader. Jonathan ' s introduction marked the beginning of a collaborative process aimed at evaluating the conformity of the AIMS to

ISO/IEC 42001 requirements.

The certification body determined the audit scope, which included only specific departments essential to the integration and application of Al, such as the Al Research,

Machine Learning Applications, and Al Ethics and Compliance Departments, and did not cover all of the departments covered by the AIMS scope. Meanwhile,

Alterhealth determined the audit time, setting the necessary time frame for planning and conducting a thorough and effective review to ensure all aspects of the AIMS

within the selected departments were meticulously reviewed.

Afterward, Jonathan received a detailed offer from the certification body, outlining his role and including information related to the audit, such as the audit ' s duration,

team members, their responsibilities, the limits to the audit engagement, and their salary compensation. With a clear mandate, Jonathan was tasked with a multitude

of responsibilities: defining the audit objectives and criteria, planning the audit process, identifying and addressing audit risks, managing communication with

Alterhealth, overseeing the audit team, and ensuring a smooth and conflict free execution.

With Jonathan ' s leadership and a well-defined audit framework in place, the certification audit proceeded with a structured and objective evaluation of Alterhealth ' s

AIMS.

Question:

Can the work assignments of audit team members be changed during the audit?

Scenario 9 (continued):

Scenario 9: Securisai, located in Tallinn. Estonia, specializes in the development of automated cybersecurity solutions that utilize AI systems. The company recently implemented an artificial intelligence management system AIMS in accordance with ISO/IEC 42001. In doing so, the company aimed to manage its Al-driven systems’ capabilities to detect and mitigate cyber threats more efficiently and ethically. As part of its commitment to upholding the highest standards of Al use and management, Securisai underwent a certification audit to demonstrate compliance with ISO/IEC 42001.

The audit process comprised two main stages: the initial or stage 1 audit focused on reviewing Securisai ' s documentation, policies, and procedures related to its AIMS. This review laid the groundwork for the stage 2 audit, which involved a comprehensive, on-site evaluation

of the actual implementation and effectiveness of the AIMS within Securisai ' s operations. The goal was to observe the AIMS in operation, ensuring that it not only existed on paper but was effectively integrated into the company ' s daily activities and cybersecurity strategies.

After the audit, Roger, Securisai ' s internal auditor, addressed the action plans devised to rectify nonconformities identified during the certification audit. He developed a long term strategy, highlighting key AIMS processes for triennial audits. Roger ' s internal audits play a

key role in advancing Securisai ' s goals by employing a systematic and disciplined method to assess and boost the efficiency of risk

management, governance processes, and strategic decision-making. Roger reported his findings directly to Securisai ' s top management.

Following the successful rectification of nonconformities, Securisai was officially certified against ISO/IEC 42001.

Recently, the company decided to transfer its ISO/IEC 42001 certification registration from one certification body to another despite being initially bound by a long-term agreement with the current certification body. This decision was motivated by the desire to partner with a certification body that offers deeper insights and expertise in the rapidly evolving field of artificial intelligence in cybersecurity.

To ensure a smooth transition and uphold its certification status, Securisai is diligently compiling the required documentation for submission to the new certification body. This includes a formal request, the most recent audit report underscoring its adherence to ISO/IEC 42001, the latest corrective action plan that highlights its continuous efforts toward improvement, and a copy of its current valid certification registration.

A year following Securisai ' s initial certification audit, a subsequent audit was carried out by the certification body on its AIMS. The

purpose of this audit was to assess compliance with ISO/IEC 42001 and verify the ongoing improvement of the AIMS. The audit team

concluded that Securisai ' s AIMS consistently meets the requirements set by ISO/IEC 42001.

Roger followed up on action plans after the external audit at Securisai, but he was directly involved in strategic decision-making processes, potentially affecting his audit objectivity.

Question:

Based on Scenario 9, which principle of internal auditing did Roger violate?