ISO-IEC-42001-LEAD-AUDITOR practice question 5 of 25

[Conducting an ISO/IEC 42001 Audit] Scenario 3: ArBank is a financial institution located in Brussels, Belgium, which offers a diverse range of…

Full set: 120 questions
[Conducting an ISO/IEC 42001 Audit] Scenario 3: ArBank is a financial institution located in Brussels, Belgium, which offers a diverse range of banking and investment servicesto its clients. To ensure the continual improvement of its operations, ArBank has implemented a quality management system QMS based on ISO 9001 and an artificial intelligence management system AIMS based on the requirements of ISO/IEC 42001. Audrey, an experienced auditor, led an internal audit focused on the AIMS within ArBank. She assessed the chatbots integrated into thebank's website and mobile app, analyzing communications using big data technology to identify potential noncompliance, fraud, orunethical conduct. Instead of relying solely on the information provided by the chatbots, Audrey sought out evidence that would eitherconfirm or challenge the validity of the data, ensuring her conclusions were based on reliable and accurate information. Her review ofselected chatbot interactions confirmed they met their intended purpose. For the specific context of ArBank's operations, Audrey utilized an Al system to assess the efficiency of the bank's digital infrastructure,focusing on tasks critical to the Finance Department. This Al system was able to analyze the functionality of chatbots integrated intoArBank's website and mobile app to determine if it adheres to ISO/IEC 42001 requirements and internal policies governing customerservice in the banking sector. In addition, Audrey conducted a deeper assessment of the bank’s AIMS. Her evaluation included observing different stages of the AIMSlife cycle, from development to deployment, to ensure that roles and responsibilities were clearly defined and aligned with ArBank’soperational goals. She also evaluated the tools used to monitor and measure the performance of the AIMS. Audrey continued the audit process by auditing ArBank's outsourced operations. Upon checking the contractual agreements between thetwo parties, Audrey decided that there was no need to gather audit evidence regarding the contractual agreement. She reviewed thecompany's processes for monitoring the quality of outsourced operations, determined whether appropriate governance processes are inplace with regard to the engagement of outsourced persons or organizations, and reviewed and evaluated the company's plans in case ofexpected or unexpected termination of the outsourcing agreement. Based on the scenario above, answer the following question: Which audit principle did Audrey demonstrate while assessing the chatbots?
Answer options
A: Risk-based approach
B: Confidentiality
C: Due professional care Correct answer
D: Impartiality
Correct Answer:
C. Due professional care
Explanation

Audrey demonstrated due professional care by not accepting the information from the chatbots at face value. The scenario states she "sought out evidence that would either confirm or challenge the validity of the data, ensuring her conclusions were based on reliable and accurate information." This diligence and application of reasoned judgment in performing her audit tasks is the definition of due professional care, a fundamental principle of auditing. Her actions ensure the audit findings are robust and credible.

Why Incorrect

A. A risk-based approach focuses audit activities on areas of highest risk. While related, her specific action of verifying data is a direct example of diligence (due professional care).
B. Confidentiality concerns the security and non-disclosure of information. The scenario does not provide any details about how Audrey handled the information she collected.
D. Impartiality refers to being objective and free from bias. While her actions support impartiality, the core principle demonstrated is the thoroughness and diligence of her work.

References

1. ISO 19011:2018, Guidelines for auditing management systems, Clause 4, "Principles of auditing". This clause defines "Due professional care" as "the application of diligence and judgement in auditing." Audrey's verification of data is a direct application of this principle.

2. The Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), Standard 1220: Due Professional Care. It states that internal auditors must apply the care and skill expected of a reasonably prudent and competent internal auditor.

Scroll to Top