ISO-IEC-42001-LEAD-AUDITOR practice question 4 of 25

[AI Management System Requirements] Scenario 2 (continued): Empsy HR Solutions is a human resources consulting company that provides innovative HR…

Full set: 120 questions
[AI Management System Requirements] Scenario 2 (continued): Empsy HR Solutions is a human resources consulting company that provides innovative HR solutions to diverse industries.Recognizing the significant impact of artificial intelligence Al in HR processes, including its ability to automate repetitive tasks, analyzevast amounts of data for insights, improve recruitment and talent management strategies, and personalize employee experiences, thecompany has initiated the implementation of an artificial intelligence management system AIMS based on ISO/IEC 42001. Initially, the top management established an Al policy that was aligned with the company's objectives. The Al policy provided a frameworkfor defining Al objectives, a commitment to meeting relevant requirements, and a dedication to continually improve the AIMS. However, it did not refer to other organizational policies, although some were relevant to the AIMS. Afterward, the top management documented thepolicy, communicated it internally, and made it accessible to interested parties. The top management designated specific individuals to ensure that the AIMS meets the standard's requirements. Additionally, theyensured that these individuals were responsible for overseeing the AIMS, reporting its performance to the top management, andfacilitating continual improvement. Moreover, in its awareness sessions, the company focused exclusively on ensuring that all personnel were informed about the Al policy, emphasizing their role in ensuring the effectiveness of the AIMS and the benefits of enhanced Alperformance. The company also planned, implemented, and monitored processes to meet AIMS requirements. Additionally, it set clear criteria andimplemented controls based on them, ensuring effective operation, alignment with organizational objectives, and continual improvement.Empsy HR Solutions decided to implement strict measures to control changes to documented information within the AIMS. To ensure theintegrity and accuracy of documentation, the company adopted version control practices. Each document update was tracked using aversioning system, with clear records of what was modified, who made the changes, and when the updates occurred. Access to makechanges was restricted to authorized personnel, and any proposed modifications required approval from the designated managementteam before being implemented. Moreover, considering past experiences where the company encountered unforeseen risks, Empsy HR Solutions established acomprehensive Al risk assessment process. This process involved identifying, analyzing, and evaluating Al risks to determine if it isnecessary to implement additional controls than those specified in Annex
Answer options
A: The company also referred to Annex B for guidance onimplementing controls and, ultimately, produced a Statement of Applicability SoA. The SoA contained the necessary controls, including allthe controls of Annex A and justifications for their inclusion or exclusion. Lastly. Empsy HR Solutions decided to establish an internal audit program to ensure the AIMS conforms to both the company'srequirements and ISO/IEC 42001. It defined the audit objectives, criteria, and scope for each audit, selected auditors, and ensuredobjectivity and impartiality during the audit process. The results of the first audit were documented and reported only to the top management of the company. According to Scenario 2, were the risks addressed in accordance with the ISO/IEC 42001 requirements?
B: Yes, the risks were identified, analyzed, and evaluated
C: No, the risks should be evaluated and treated and then analyzed Correct answer
D: No, the company must also establish a risk treatment process
E: Yes, risks only need to be identified for certification
Correct Answer:
C. No, the risks should be evaluated and treated and then analyzed
Explanation

The scenario describes a thorough AI risk assessment process (identifying, analyzing, and evaluating risks), which aligns with Clause 6.1.2 of ISO/IEC 42001. However, addressing risks requires both assessment and treatment. The scenario makes no mention of the company defining or applying an AI risk treatment process, as mandated by Clause 6.1.3. This includes selecting treatment options, determining necessary controls, formulating a treatment plan, and obtaining approval. Simply performing an assessment and creating a Statement of Applicability is insufficient; a formal treatment process is also required for conformance.

Why Incorrect

A: This is incomplete. While risk assessment was performed, the mandatory subsequent step of risk treatment was not mentioned. B: This presents the risk management steps in the wrong order. The correct sequence is identify, analyze, evaluate, and then treat. D: This is incorrect. The standard requires a complete risk management process, including assessment (Clause 6.1.2) and treatment (Clause 6.1.3).

References

1. ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system, Clause 6.1.3 "AI risk treatment". This clause requires the organization to "define and apply an AI risk treatment process."

2. ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system, Clause 6.1.2 "AI risk assessment". This clause outlines the assessment process, which must be followed by the treatment process defined in 6.1.3.

Keep practicing

Take the free ISO-IEC-42001-LEAD-AUDITOR practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other ISO-IEC-42001-LEAD-AUDITOR practice questions

Scroll to Top