Question # 1

[Managing an ISO/IEC 42001 Audit Program]A certification body is conducting surveillance audits for a company managing multiple sites,including a temporary construction site with a limited duration.The audit team is considering whether the presence of this temporary site should influence thefrequency of surveillance audits.Can this factor necessitate an adjustment in the audit schedule? 

A. Yes, because it represents a management system certification of limited duration  
B. No, temporary construction sites do not influence audit frequency  
C. Yes, but only if the construction site operates under different seasonal conditions  

Show Answer

Question # 2

[Managing an ISO/IEC 42001 Audit Program]Who is responsible for reviewing the corrections, identified causes, and corrective actions of theauditee?

A. The certification body  
B. The audit team  
C. The internal auditor  

Show Answer

Question # 3

[Managing an ISO/IEC 42001 Audit Program]Scenario 9:Scenario 9: Securisai, located in Tallinn.Estonia, specializes in the development of automatedcybersecurity solutions that utilize AIsystems. The company recently implemented an artificialintelligence management system AIMS in accordance with ISO/IEC 42001. Indoing so, the companyaimed to manage its Al-driven systems capabilities to detect and mitigate cyber threats moreefficiently andethically. As part of its commitment to upholding the highest standards of Al use andmanagement, Securisai underwent a certificationaudit to demonstrate compliance with ISO/IEC42001.The audit process comprised two main stages: the initial or stage 1 audit focused on reviewingSecurisai's documentation, policies, andprocedures related to its AIMS. This review laid thegroundwork for the stage 2 audit, which involved a comprehensive, on-site evaluationof the actual implementation and effectiveness of the AIMS within Securisai's operations. The goalwas to observe the AIMS in operation,ensuring that it not only existed on paper but was effectivelyintegrated into the company's daily activities and cybersecurity strategies.After the audit, Roger, Securisai's internal auditor, addressed the action plans devised to rectifynonconformities identified during thecertification audit. He developed a long term strategy,highlighting key AIMS processes for triennial audits. Roger's internal audits play akey role in advancing Securisai's goals by employing a systematic and disciplined method to assessand boost the efficiency of riskmanagement, governance processes, and strategic decision-making. Roger reported his findingsdirectly to Securisai's top management.Following the successful rectification of nonconformities, Securisai was officially certified againstISO/IEC 42001.Recently, the company decided to transfer its ISO/IEC 42001 certification registration from onecertification body to another despitebeing initially bound by a long-term agreement with the currentcertification body. This decision was motivated by the desire to partnerwith a certification body thatoffers deeper insights and expertise in the rapidly evolving field of artificial intelligence incybersecurity.To ensure a smooth transition and uphold its certification status, Securisai is diligently compiling therequired documentation forsubmission to the new certification body. This includes a formal request,the most recent audit report underscoring its adherence toISO/IEC 42001, the latest corrective actionplan that highlights its continuous efforts toward improvement, and a copy of its currentvalidcertification registration.A year following Securisai's initial certification audit, a subsequent audit was carried out by thecertification body on its AIMS. Thepurpose of this audit was to assess compliance with ISO/IEC 42001 and verify the ongoingimprovement of the AIMS. The audit teamconcluded that Securisai's AIMS consistently meets the requirements set by ISO/IEC 42001.During an AIMS audit at a cybersecurity company, the team found a major nonconformity ”ineffective access controls for sensitive data.Given this situation, what is the appropriate next step? 

A. Conduct another full audit of the auditees entire AIMS  
B. Promptly revoke the auditees certification without further examination  
C. Conduct an audit follow-up before the company is recommended for certification  

Show Answer

Question # 4

[Managing an ISO/IEC 42001 Audit Program]Which of the following does NOT represent the purpose of managing and maintaining auditprogramrecords? 

A. To address information security and confidentiality needs for audit records  
B. To demonstrate the implementation of the audit program  
C. To focus on the competence and performance evaluation of the audit team members 

Show Answer

Question # 5

[Managing an ISO/IEC 42001 Audit Program]Scenario 9 (continued):Scenario 9: Securisai, located in Tallinn.Estonia, specializes in the development of automatedcybersecurity solutions that utilize AIsystems. The company recently implemented an artificialintelligence management system AIMS in accordance with ISO/IEC 42001. Indoing so, the companyaimed to manage its Al-driven systems capabilities to detect and mitigate cyber threats moreefficiently andethically. As part of its commitment to upholding the highest standards of Al use andmanagement, Securisai underwent a certificationaudit to demonstrate compliance with ISO/IEC42001.The audit process comprised two main stages: the initial or stage 1 audit focused onreviewingSecurisai's documentation, policies, andprocedures related to its AIMS. This review laid thegroundwork for the stage 2 audit, which involved a comprehensive, on-site evaluationof the actual implementation and effectiveness of the AIMS within Securisai's operations. The goalwas to observe the AIMS in operation,ensuring that it not only existed on paper but was effectivelyintegrated into the company's daily activities and cybersecurity strategies.After the audit, Roger, Securisai's internal auditor, addressed the action plans devised to rectifynonconformities identified during thecertification audit. He developed a long term strategy,highlighting key AIMS processes for triennial audits. Roger's internal audits play akey role in advancing Securisai's goals by employing a systematic and disciplined method to assessand boost the efficiency of riskmanagement, governance processes, and strategic decision-making. Roger reported his findingsdirectly to Securisai's top management.Following the successful rectification of nonconformities, Securisai was officially certified againstISO/IEC 42001.Recently, the company decided to transfer its ISO/IEC 42001 certification registration from onecertification body to another despitebeing initially bound by a long-term agreement with the currentcertification body. This decision was motivated by the desire to partnerwith a certification body thatoffers deeper insights and expertise in the rapidly evolving field of artificial intelligence incybersecurity.To ensure a smooth transition and uphold its certification status, Securisai is diligently compiling therequired documentation forsubmission to the new certification body. This includes a formal request,the most recent audit report underscoring its adherence toISO/IEC 42001, the latest corrective actionplan that highlights its continuous efforts toward improvement, and a copy of its currentvalidcertification registration.A year following Securisai's initial certification audit, a subsequent audit was carried out by thecertification body on its AIMS. Thepurpose of this audit was to assess compliance with ISO/IEC 42001 and verify the ongoingimprovement of the AIMS. The audit teamconcluded that Securisai's AIMS consistently meets the requirements set by ISO/IEC 42001.Roger followed up on action plans after the external audit at Securisai, but he was directly involved instrategic decision-making processes, potentially affecting his audit objectivity.Based on Scenario 9, which principle of internal auditing did Roger violate? 

A. Independence  
B. Integrity  
C. Objectivity  

Show Answer

Question # 6

[Managing an ISO/IEC 42001 Audit Program]Scenario 9 (continued):Scenario 9: Securisai, located in Tallinn.Estonia, specializes in the development of automatedcybersecurity solutions that utilize AIsystems. The company recently implemented an artificialintelligence management system AIMS in accordance with ISO/IEC 42001. Indoing so, the companyaimed to manage its Al-driven systems capabilities to detect and mitigate cyber threats moreefficiently andethically. As part of its commitment to upholding the highest standards of Al use andmanagement, Securisai underwent a certificationaudit to demonstrate compliance with ISO/IEC42001.The audit process comprised two main stages: the initial or stage 1 audit focused on reviewingSecurisai's documentation, policies, andprocedures related to its AIMS. This review laid thegroundwork for the stage 2 audit, which involved a comprehensive, on-site evaluationof the actual implementation and effectiveness of the AIMS within Securisai's operations. The goalwas to observe the AIMS in operation,ensuring that it not only existed on paper but was effectivelyintegrated into the company's daily activities and cybersecurity strategies.After the audit, Roger, Securisai's internal auditor, addressed the action plans devised to rectifynonconformities identified during thecertification audit. He developed a long term strategy,highlighting key AIMS processes for triennial audits. Roger's internal audits play akey role in advancing Securisai's goals by employing a systematic and disciplined method toassessand boost the efficiency of riskmanagement, governance processes, and strategic decision-making. Roger reported his findingsdirectly to Securisai's top management.Following the successful rectification of nonconformities, Securisai was officially certified againstISO/IEC 42001.Recently, the company decided to transfer its ISO/IEC 42001 certification registration from onecertification body to another despitebeing initially bound by a long-term agreement with the currentcertification body. This decision was motivated by the desire to partnerwith a certification body thatoffers deeper insights and expertise in the rapidly evolving field of artificial intelligence incybersecurity.To ensure a smooth transition and uphold its certification status, Securisai is diligently compiling therequired documentation forsubmission to the new certification body. This includes a formal request,the most recent audit report underscoring its adherence toISO/IEC 42001, the latest corrective actionplan that highlights its continuous efforts toward improvement, and a copy of its currentvalidcertification registration.A year following Securisai's initial certification audit, a subsequent audit was carried out by thecertification body on its AIMS. Thepurpose of this audit was to assess compliance with ISO/IEC 42001 and verify the ongoingimprovement of the AIMS. The audit teamconcluded that Securisai's AIMS consistently meets the requirements set by ISO/IEC 42001.In the context of Rogers action plan at Securisai, was the plan he developed a general plan or adetailed plan?

A. It was a detailed plan because it focused only on specific AIMS processes to be audited every year  
B. It was a general plan because it outlined overall AIMS processes to be audited every three years  
C. It was a detailed plan because it covered key AIMS processes  

Show Answer

Question # 7

[Managing an ISO/IEC 42001 Audit Program]Scenario 9 (continued):Scenario 9: Securisai, located in Tallinn.Estonia, specializes in the development of automatedcybersecurity solutions that utilize AIsystems. The company recently implemented an artificialintelligence management system AIMS in accordance with ISO/IEC 42001. Indoing so, the companyaimed to manage its Al-driven systems capabilities to detect and mitigate cyber threats moreefficiently andethically. As part of its commitment to upholding the highest standards of Al use andmanagement, Securisai underwent a certificationaudit to demonstrate compliance with ISO/IEC42001.The audit process comprised two main stages: the initial or stage 1 audit focused on reviewingSecurisai's documentation, policies, andprocedures related to its AIMS. This review laid thegroundwork for the stage 2 audit, which involved a comprehensive, on-site evaluationof the actual implementation and effectiveness of the AIMS within Securisai's operations. The goalwas to observe the AIMS in operation,ensuring that it not only existed on paper but was effectivelyintegrated into the company's daily activities and cybersecurity strategies.After the audit, Roger, Securisai's internal auditor, addressed the action plans devised to rectifynonconformities identified during thecertification audit. He developed a long term strategy,highlighting key AIMS processes for triennial audits. Roger's internal audits play akey role in advancing Securisai's goals by employing a systematic and disciplined method to assessand boost the efficiency of riskmanagement, governance processes, and strategic decision-making. Roger reported his findingsdirectly to Securisai's top management.Following the successful rectification of nonconformities, Securisai was officially certified againstISO/IEC 42001.Recently, the company decided to transfer its ISO/IEC 42001 certification registration fromonecertification body to another despitebeing initially bound by a long-term agreement with thecurrent certification body. This decision was motivated by the desire to partnerwith a certificationbody that offers deeper insights and expertise in the rapidly evolving field of artificial intelligence incybersecurity.To ensure a smooth transition and uphold its certification status, Securisai is diligently compiling therequired documentation forsubmission to the new certification body. This includes a formal request,the most recent audit report underscoring its adherence toISO/IEC 42001, the latest corrective actionplan that highlights its continuous efforts toward improvement, and a copy of its currentvalidcertification registration.A year following Securisai's initial certification audit, a subsequent audit was carried out by thecertification body on its AIMS. Thepurpose of this audit was to assess compliance with ISO/IEC 42001 and verify the ongoingimprovement of the AIMS. The audit teamconcluded that Securisai's AIMS consistently meets the requirements set by ISO/IEC 42001.What type of audit is described in the last paragraph of Scenario 9? 

A. Internal audit  
B. Recertification audit  
C. Surveillance audit  

Show Answer

Question # 8

[Managing an ISO/IEC 42001 Audit Program]Scenario 9 (continued):Scenario 9: Securisai, located in Tallinn.Estonia, specializes in the development of automatedcybersecurity solutions that utilize AIsystems. The company recently implemented an artificialintelligence management system AIMS in accordance with ISO/IEC 42001. Indoing so, the companyaimed to manage its Al-driven systems capabilities to detect and mitigate cyber threats moreefficiently andethically. As part of its commitment to upholding the highest standards of Al use andmanagement, Securisai underwent a certificationaudit to demonstrate compliance with ISO/IEC42001.The audit process comprised two main stages: the initial or stage 1 audit focused on reviewingSecurisai's documentation, policies, andprocedures related to its AIMS. This review laid thegroundwork for the stage 2 audit, which involved a comprehensive, on-site evaluationof the actual implementation and effectiveness of the AIMS within Securisai's operations. The goalwas to observe the AIMS in operation,ensuring that it not only existed on paper but was effectivelyintegrated into the company's daily activities and cybersecurity strategies.After the audit, Roger, Securisai's internal auditor, addressed the action plans devised to rectifynonconformities identified during thecertification audit. He developed a long term strategy,highlighting key AIMS processes for triennial audits. Roger's internal audits play akey role in advancing Securisai's goals by employing a systematic and disciplined method to assessand boost the efficiency of riskmanagement, governance processes, and strategic decision-making. Roger reported his findingsdirectly to Securisai's top management.Following the successful rectification of nonconformities, Securisai was officially certified againstISO/IEC 42001.Recently, the company decided to transfer its ISO/IEC 42001 certification registration from onecertification body to another despitebeing initially bound by a long-term agreement with the currentcertification body. This decision was motivated by the desire to partnerwith a certification body thatoffers deeper insights and expertise in the rapidly evolving field of artificial intelligence incybersecurity.To ensure a smooth transition and uphold its certification status, Securisai is diligently compiling therequired documentation forsubmission to the new certification body. This includes a formalrequest,the most recent audit report underscoring its adherence toISO/IEC 42001, the latest corrective actionplan that highlights its continuous efforts toward improvement, and a copy of its currentvalidcertification registration.A year following Securisai's initial certification audit, a subsequent audit was carried out by thecertification body on its AIMS. Thepurpose of this audit was to assess compliance with ISO/IEC 42001 and verify the ongoingimprovement of the AIMS. The audit teamconcluded that Securisai's AIMS consistently meets the requirements set by ISO/IEC 42001.Based on Scenario 9, what should Securisais certification be?

A. Suspended  
B. Withdrawn  
C. Transferred  

Show Answer

Question # 9

[Managing an ISO/IEC 42001 Audit Program]Scenario 9:Scenario 9: Securisai, located in Tallinn.Estonia, specializes in the development of automatedcybersecurity solutions that utilize AIsystems. The company recently implemented an artificialintelligence management system AIMS in accordance with ISO/IEC 42001. Indoing so, the companyaimed to manage its Al-driven systems capabilities to detect and mitigate cyber threats moreefficiently andethically. As part of its commitment to upholding the highest standards of Al use andmanagement, Securisai underwent a certificationaudit to demonstrate compliance with ISO/IEC42001.The audit process comprised two main stages: the initial or stage 1 audit focused on reviewingSecurisai's documentation, policies, andprocedures related to its AIMS. This review laid thegroundwork for the stage 2 audit, which involved a comprehensive, on-site evaluationof the actual implementation and effectiveness of the AIMS within Securisai's operations. The goalwas to observe the AIMS in operation,ensuring that it not only existed on paper but was effectivelyintegrated into the company's daily activities and cybersecurity strategies.After the audit, Roger, Securisai's internal auditor, addressed the action plans devised to rectifynonconformities identified during thecertification audit. He developed a long term strategy,highlighting key AIMS processes for triennial audits. Roger's internal audits play akey role in advancing Securisai's goals by employing a systematic and disciplined method to assessand boost the efficiency of riskmanagement, governance processes, and strategic decision-making. Roger reported his findingsdirectly to Securisai's top management.Following the successful rectification of nonconformities, Securisai was officially certified againstISO/IEC 42001.Recently, the company decided to transfer its ISO/IEC 42001 certification registration from onecertification body to another despitebeing initially bound by a long-term agreement with the currentcertification body. This decision was motivated by the desire to partnerwith a certification body thatoffers deeper insights and expertise in the rapidly evolving field of artificial intelligence incybersecurity.To ensure a smooth transition and uphold its certification status, Securisai is diligently compiling therequired documentation forsubmission to the new certification body. This includes a formal request,the most recent audit report underscoring its adherence toISO/IEC 42001, the latest corrective actionplan that highlights its continuous efforts toward improvement, and a copy of its currentvalidcertification registration.A year following Securisai's initial certification audit, a subsequent audit was carried out by thecertification body on its AIMS. Thepurpose of this audit was to assess compliance with ISO/IEC 42001 and verify the ongoingimprovement of the AIMS. The audit teamconcluded that Securisai's AIMS consistently meets the requirements set by ISO/IEC 42001.Roger followed up on action plans resulting from external audits. Is this acceptable? 

A. No, it is the responsibility of the external auditor to follow up on action plans resulting fromexternal audits
B. Yes, the internal auditor should follow up on action plans submitted during internal and external audits 
C. No, the internal auditor should follow up on action plans submitted in response tononconformities resulting only from internal audits 

Show Answer

Question # 10

[Conducting an ISO/IEC 42001 Audit]During a combined audit, if an auditor identifies a finding linked to one criterion, should theyconsider its potential impact on corresponding or related criteria of other management systems? 

A. Yes, the auditor should consider the other criteria only if the finding is deemed significant  
B. Yes, the auditor should consider the possible impact on the corresponding or similar criteria of theother management system
C. No, in such cases the auditor should always focus on the specific criterion identified  

Show Answer