Scenario 3 (continued):
ArBank is a financial institution located in Brussels, Belgium, which offers a diverse range of banking and investment services to its clients. To ensure the continual improvement of its operations, ArBank has implemented a quality management system QMS based
on ISO 9001 and an artificial intelligence management system AIMS based on the requirements of ISO/IEC 42001.
Audrey, an experienced auditor, led an internal audit focused on the AIMS within ArBank. She assessed the chatbots integrated into the bank's website and mobile app, analyzing communications using big data technology to identify potential noncompliance, fraud, or unethical conduct. Instead of relying solely on the information provided by the chatbots, Audrey sought out evidence that would either confirm or challenge the validity of the data, ensuring her conclusions were based on reliable and accurate information. Her review of selected chatbot interactions confirmed they met their intended purpose.
For the specific context of ArBank's operations, Audrey utilized an Al system to assess the efficiency of the bank's digital infrastructure, focusing on tasks critical to the Finance Department. This Al system was able to analyze the functionality of chatbots integrated into ArBank's website and mobile app to determine if it adheres to ISO/IEC 42001 requirements and internal policies governing customer service in the banking sector.
In addition, Audrey conducted a deeper assessment of the bank’s AIMS. Her evaluation included observing different stages of the AIMS life cycle, from development to deployment, to ensure that roles and responsibilities were clearly defined and aligned with ArBank’s operational goals. She also evaluated the tools used to monitor and measure the performance of the AIMS.
Audrey continued the audit process by auditing ArBank's outsourced operations. Upon checking the contractual agreements between the two parties, Audrey decided that there was no need to gather audit evidence regarding the contractual agreement. She reviewed the company's processes for monitoring the quality of outsourced operations, determined whether appropriate governance processes are in place with regard to the engagement of outsourced persons or organizations, and reviewed and evaluated the company's plans in case of expected or unexpected termination of the outsourcing agreement.
Based on the scenario above, answer the following question:
Question:
Based on Scenario 3, did Audrey perform a technical assessment during the audit?
Scenario: NeuraGen, founded by a team of AI experts and data scientists, has gained attention for its advanced use of artificial intelligence. It specializes in developing personalized learning platforms powered by AI algorithms. MindMeld, its innovative product, is an educational platform that uses machine learning and stands out by learning from both labeled and unlabeled data during its training process. This approach allows MindMeld to use a wide range of educational content and personalize learning experiences with exceptional accuracy. Furthermore, MindMeld employs an advanced AI system capable of handling a wide variety of tasks, consistently delivering a satisfactory level of performance. This approach improves the effectiveness of educational materials and adapts to different learners' needs.
NeuraGen skillfully handles data management and AI system development, particularly for MindMeld. Initially, NeuraGen sources data from a diverse array of origins, examining patterns, relationships, trends, and anomalies. This data is then refined and formatted for compatibility with MindMeld, ensuring that any irrelevant or extraneous information is systematically eliminated. Following this, values are adjusted to a unified scale to facilitate mathematical comparability. A crucial step in this process is the rigorous removal of all personally identifiable information (PII) to protect individual privacy. Finally, the data is subjected to quality checks to assess its completeness, identify any potential bias, and evaluate other factors that could impact the platform's efficacy and reliability.
NeuraGen has implemented an advanced artificial intelligence management system (AIMS) based on ISO/IEC 42001 to support its efforts in AI-driven education. This system provides a framework for managing the life cycle of AI projects, ensuring that development and deployment are guided by ethical standards and best practices.
NeuraGen's top management is key to running the AIMS effectively. Applying an international standard that specifically provides guidance for the highest level of company leadership on governing the effective use of AI, they embed ethical principles such as fairness, transparency, and accountability directly into their strategic operations and decision-making processes.
While the company excels in ensuring fairness, transparency, reliability, safety, and privacy in its AI applications, actively preventing bias, fostering a clear understanding of AI decisions, guaranteeing system dependability, and protecting user data, it struggles to clearly define who is responsible for the development, deployment, and outcomes of its AI systems. Consequently, it becomes difficult to determine responsibility when issues arise, which undermines trust and accountability, both critical for the integrity and success of AI initiatives.
What type of machine learning does MindMeld utilize?
Which of the following pieces of evidence collected during the certification audit can be considered the most reliable? Refer to Scenario 4.
Scenario 4: Finalogic leads the application of artificial intelligence in the financial services sector, which is used to improve risk assessment, fraud detection, and
customer service. The company has implemented an artificial intelligence management system AIMS based on ISO/IEC 42001 to ensure operational quality, ethical Al
use, regulatory compliance, and transparency, allowing for consistent oversight and structured governance.
This month, Finalogic is undergoing an audit to obtain certification against ISO/IEC 42001, a critical step in demonstrating its commitment to responsible Al. To
evaluate Finalogic's conformity to the audit criteria, the audit team adopted a comprehensive, evidence-based approach. The gathered evidence ranged from analyses
of unquantifiable information to analyses of samples related to determining the audit criteria-including internal reports generated by Finalogic's own Al system-which
assert successful integration and compliance with the standard.
Additionally, presentations by the company’s Al team during the audit highlighted the system’s success in customer service enhancements and fraud detection,
emphasizing improved efficiency, decision making accuracy, and user trust. An evaluation report prepared by an independent third party firm specializing in Al systems
also provided an objective review of Finalogic's AIMS. It assessed the system's effectiveness, bias, and compliance through a thorough examination.
During the audit, the audit team applied the same level of effort and utilized the same techniques across all audit areas, regardless of their risk level. This strategy
ensured a consistent and thorough evaluation of the AIMS, uncovering any latent weaknesses or inefficiencies that might otherwise go unnoticed.
Despite Finalogic's advanced AIMS and adherence to ISO/IEC 42001 for ethical Al practices, there remains a risk of Al algorithms inadvertently perpetuating bias or
making inaccurate predictions due to unforeseen flaws in training data or algorithmic models. This could lead to unfair loan rejections or approvals, potentially causing
financial losses or damaging the company’s reputation for fairness and accuracy in its financial services. By acknowledging these risks. Finalogic remains committed
to refining its Al governance, implementing bias mitigation strategies, and enhancing transparency to uphold its reputation as a leader in Al driven financial services.
Based on Scenario 5, which of the following should NOT be Jonathan's responsibility?
Scenario 5: Alterhealth is a mid-sized technology firm based in Toronto. Canada. It develops Al systems for healthcare providers, focusing on improving patient care,
optimizing hospital workflows, and analyzing healthcare data for insights that can improve health outcomes. To ensure responsible and effective use of Al in its
operations, Alterhealth has implemented an artificial intelligence management system AIMS based on ISO/IEC 42001. After a year of having the AIMS in place, the
company decided to apply for a certification audit to obtain certification against ISO/IEC 42001.
The company contracted a certification body to conduct the audit, who assembled the audit team and appointed the audit team leader. The audit team leader had
conducted a certification audit at Alterhealth in the past. The top management of Alterhealth decided to reject the appointment of this auditor because they believed
that they would not receive added value from the audit. In response, the certification body appointed Jonathan, an independent auditor with no prior engagements with
Alterhealth, as the new audit team leader. Jonathan's introduction marked the beginning of a collaborative process aimed at evaluating the conformity of the AIMS to
ISO/IEC 42001 requirements.
The certification body determined the audit scope, which included only specific departments essential to the integration and application of Al, such as the Al Research,
Machine Learning Applications, and Al Ethics and Compliance Departments, and did not cover all of the departments covered by the AIMS scope. Meanwhile,
Alterhealth determined the audit time, setting the necessary time frame for planning and conducting a thorough and effective review to ensure all aspects of the AIMS
within the selected departments were meticulously reviewed.
Afterward, Jonathan received a detailed offer from the certification body, outlining his role and including information related to the audit, such as the audit's duration,
team members, their responsibilities, the limits to the audit engagement, and their salary compensation. With a clear mandate, Jonathan was tasked with a multitude
of responsibilities: defining the audit objectives and criteria, planning the audit process, identifying and addressing audit risks, managing communication with
Alterhealth, overseeing the audit team, and ensuring a smooth and conflict free execution.
With Jonathan's leadership and a well-defined audit framework in place, the certification audit proceeded with a structured and objective evaluation of Alterhealth's
AIMS.
Question:
Which of the following should be considered when determining the feasibility of the audit?
Was the audit team leader’s decision regarding the handling of the technical expert's findings acceptable? Refer to Scenario 7.
Scenario 7: TastyMade. headquartered in Hamburg, Germany, is an established company in the food manufacturing industry that applies Al technologies in its
operations. It has implemented an artificial intelligence management system AIMS based on ISO/IEC 42001 to further strengthen its Al management and ensure
compliance with international standards. As part of its commitment to excellence and continual improvement, TastyMade is undergoing an audit process to achieve
certification against ISO/IEC 42001.
In preparation for the audit, TastyMade collaborated closely with the audit team leader to develop a detailed audit plan. This plan encompassed objectives, criteria,
scope, and logistical arrangements for both on-site and remote audit activities. Recognizing the specialized nature of Al integration, a technical expert was brought in
to support the audit team and ensure comprehensive coverage of relevant aspects. Upon discussion with the audit team leader, it was mutually decided that not every
audit team member would need a guide throughout the audit process. At times, the TastyMade itself would assume the role of the guide, actively facilitating audit
activities.
A formal opening meeting was held with TastyMade's management to provide an overview of the audit process and set expectations. During this meeting, key
interested parties were briefed on the audit objectives and the methodologies that would be employed during the audit. Following the meeting, the audit team
proceeded with their work, collecting information and conducting tests to evaluate the effectiveness of TastyMade's AIMS.
Daily evening meetings were held to review progress, discuss encountered issues, and facilitate collaboration among audit team members. The audit team leader
adopted an open communication approach, encouraging all auditors to share their findings and challenges. The communication regarding the progress of the audit
was informal, allowing for a fluid exchange of information and updates among team members.
To verify adherence to some requirements of clause 4.1 Understanding the organization and its context, the audit team arbitrarily selected for analysis a representative
sample of Al management practices across different departments and functions within the company.
During the audit process, the technical expert uncovered certain technical and operational findings related to the integration and governance of Al systems.
Recognizing the significance of these findings, the expert promptly informed the audit team leader. Understanding the need for further clarification and direct
communication, the audit team leader authorized the technical expert to address the findings directly with the auditee. However, to ensure proper oversight, the expert
was supervised by one of the audit team members.
Throughout the audit, it became apparent that TastyMade promoted a culture of autonomy and decentralized decision-making in Al integration processes. Employees
were empowered to set goals, allocate responsibilities, and devise methodologies independently, with management providing guidance and support as needed. This
approach fostered innovation and agility within the company
Scenario 3 (continued):
ArBank is a financial institution located in Brussels, Belgium, which offers a diverse range of banking and investment services to its clients. To ensure the continual improvement of its operations, ArBank has implemented a quality management system QMS based
on ISO 9001 and an artificial intelligence management system AIMS based on the requirements of ISO/IEC 42001.
Audrey, an experienced auditor, led an internal audit focused on the AIMS within ArBank. She assessed the chatbots integrated into the bank's website and mobile app, analyzing communications using big data technology to identify potential noncompliance, fraud, or unethical conduct. Instead of relying solely on the information provided by the chatbots, Audrey sought out evidence that would either confirm or challenge the validity of the data, ensuring her conclusions were based on reliable and accurate information. Her review of selected chatbot interactions confirmed they met their intended purpose.
For the specific context of ArBank's operations, Audrey utilized an Al system to assess the efficiency of the bank's digital infrastructure, focusing on tasks critical to the Finance Department. This Al system was able to analyze the functionality of chatbots integrated into ArBank's website and mobile app to determine if it adheres to ISO/IEC 42001 requirements and internal policies governing customer service in the banking sector.
In addition, Audrey conducted a deeper assessment of the bank’s AIMS. Her evaluation included observing different stages of the AIMS life cycle, from development to deployment, to ensure that roles and responsibilities were clearly defined and aligned with ArBank’s operational goals. She also evaluated the tools used to monitor and measure the performance of the AIMS.
Audrey continued the audit process by auditing ArBank's outsourced operations. Upon checking the contractual agreements between the two parties, Audrey decided that there was no need to gather audit evidence regarding the contractual agreement. She reviewed the company's processes for monitoring the quality of outsourced operations, determined whether appropriate governance processes are in place with regard to the engagement of outsourced persons or organizations, and reviewed and evaluated the company's plans in case of expected or unexpected termination of the outsourcing agreement.
Based on the scenario above, answer the following question:
Question:
Based on Scenario 3, which of the following AI technologies did Audrey employ to assess the efficiency of the bank's digital infrastructure?
Based on Scenario 8, did Sharona and the audit team address all essential aspects during the closing meeting?
Scenario 8: VeridicAI. based in San Francisco. USA, specializes in market research using Al technologies to analyze customer behavior. Founded in 2023, the company
employs natural language processing, machine learning, and predictive analytics to provide real time insights to a range of businesses. VeridicAI has implemented an
artificial intelligence management system AIMS based on ISO/IEC 42001 to manage its Al technologies effectively. The AIMS scope includes select departments within
the company, for which it has received a four-year certification against ISO/IEC 42001. Committed to transparency. VeridicAI publicly shares details of this certification.
As the certification nears its end, VeridicAI is preparing for an audit to renew its certification.
The audit process was led by Sharona, the audit team leader, who is a full-time employee of the certification body. Sharona and the audit team undertook all planned
audit activities. Afterward, they organized the closing meeting with VeridicAl’s management. During the meeting, Sharona and the team made a recap on audit
objectives and scope, presented the audit findings and conclusions, presented identified nonconformities, and organized a session for questions and answers for the
auditee.
VeridicAI received a conditional recommendation for certification, underscoring its compliance with the industry's standards. Sharona confirmed that the company met
the essential requirements but noted some identified minor nonconformities. In response, VeridicAI compiled and submitted a comprehensive action plan that
addresses all identified nonconformities within a designated timeframe. Because of the comprehensive action plan, Sharona did not see the need for an additional on-
site visit to verify the effectiveness of the action plan.
Sharona played an integral role in the certification decision process. Her thorough understanding of VeridicAI's operations, gained from the audit, guided the
certification body towards a well-informed certification decision.
Scenario 9 (continued):
Scenario 9: Securisai, located in Tallinn. Estonia, specializes in the development of automated cybersecurity solutions that utilize AI systems. The company recently implemented an artificial intelligence management system AIMS in accordance with ISO/IEC 42001. In doing so, the company aimed to manage its Al-driven systems’ capabilities to detect and mitigate cyber threats more efficiently and ethically. As part of its commitment to upholding the highest standards of Al use and management, Securisai underwent a certification audit to demonstrate compliance with ISO/IEC 42001.
The audit process comprised two main stages: the initial or stage 1 audit focused on reviewing Securisai's documentation, policies, and procedures related to its AIMS. This review laid the groundwork for the stage 2 audit, which involved a comprehensive, on-site evaluation
of the actual implementation and effectiveness of the AIMS within Securisai's operations. The goal was to observe the AIMS in operation, ensuring that it not only existed on paper but was effectively integrated into the company's daily activities and cybersecurity strategies.
After the audit, Roger, Securisai's internal auditor, addressed the action plans devised to rectify nonconformities identified during the certification audit. He developed a long term strategy, highlighting key AIMS processes for triennial audits. Roger's internal audits play a
key role in advancing Securisai's goals by employing a systematic and disciplined method to assess and boost the efficiency of risk
management, governance processes, and strategic decision-making. Roger reported his findings directly to Securisai's top management.
Following the successful rectification of nonconformities, Securisai was officially certified against ISO/IEC 42001.
Recently, the company decided to transfer its ISO/IEC 42001 certification registration from one certification body to another despite being initially bound by a long-term agreement with the current certification body. This decision was motivated by the desire to partner with a certification body that offers deeper insights and expertise in the rapidly evolving field of artificial intelligence in cybersecurity.
To ensure a smooth transition and uphold its certification status, Securisai is diligently compiling the required documentation for submission to the new certification body. This includes a formal request, the most recent audit report underscoring its adherence to ISO/IEC 42001, the latest corrective action plan that highlights its continuous efforts toward improvement, and a copy of its current valid certification registration.
A year following Securisai's initial certification audit, a subsequent audit was carried out by the certification body on its AIMS. The
purpose of this audit was to assess compliance with ISO/IEC 42001 and verify the ongoing improvement of the AIMS. The audit team
concluded that Securisai's AIMS consistently meets the requirements set by ISO/IEC 42001.
Question:
Based on Scenario 9, what should Securisai’s certification be?
TESTED 18 Aug 2025
