ISO-IEC-42001-LEAD-AUDITOR practice question 9 of 25

[Conducting an ISO/IEC 42001 Audit] Scenario 3 (continued): ArBank is a financial institution located in Brussels, Belgium, which offers a diverse…

Full set: 120 questions
[Conducting an ISO/IEC 42001 Audit] Scenario 3 (continued): ArBank is a financial institution located in Brussels, Belgium, which offers a diverse range of banking and investment servicesto its clients. To ensure the continual improvement of its operations, ArBank has implemented a quality management system QMS based on ISO 9001 and an artificial intelligence management system AIMS based on the requirements of ISO/IEC 42001. Audrey, an experienced auditor, led an internal audit focused on the AIMS within ArBank. She assessed the chatbots integrated into thebank's website and mobile app, analyzing communications using big data technology to identify potential noncompliance, fraud, orunethical conduct. Instead of relying solely on the information provided by the chatbots, Audrey sought out evidence that would eitherconfirm or challenge the validity of the data, ensuring her conclusions were based on reliable and accurate information. Her review ofselected chatbot interactions confirmed they met their intended purpose. For the specific context of ArBank's operations, Audrey utilized an Al system to assess the efficiency of the bank's digital infrastructure,focusing on tasks critical to the Finance Department. This Al system was able to analyze the functionality of chatbots integrated intoArBank's website and mobile app to determine if it adheres to ISO/IEC 42001 requirements and internal policies governing customerservice in the banking sector. In addition, Audrey conducted a deeper assessment of the bank’s AIMS. Her evaluation included observing different stages of the AIMSlife cycle, from development to deployment, to ensure that roles and responsibilities were clearly defined and aligned with ArBank’soperational goals. She also evaluated the tools used to monitor and measure the performance of the AIMS. Audrey continued the audit process by auditing ArBank's outsourced operations. Upon checking the contractual agreements between thetwo parties, Audrey decided that there was no need to gather audit evidence regarding the contractual agreement. She reviewed thecompany's processes for monitoring the quality of outsourced operations, determined whether appropriate governanceprocesses are inplace with regard to the engagement of outsourced persons or organizations, and reviewed and evaluated the company's plans in case ofexpected or unexpected termination of the outsourcing agreement. Based on the scenario above, answer the following question: Did Audrey conduct the audit process for the outsourced operation correctly? Refer to Scenario 3.
Answer options
A: Yes, she reviewed the company’s processes for monitoring the quality of outsourced operations
B: No, she should have gathered audit evidence concerning the contractual agreement between the two parties Correct answer
C: No, Audrey should not have been responsible for determining whether appropriate governance processes are in place for engaging outsourced persons or organizations
D: Yes, but only if the contract terms were re-audited
Correct Answer:
B. No, she should have gathered audit evidence concerning the contractual agreement between the two parties
Explanation

The audit of outsourced operations was not conducted correctly. A fundamental principle of auditing is to gather sufficient and appropriate audit evidence. The contractual agreement is a primary piece of documented information that defines the scope, responsibilities, and controls for the outsourced process. Audrey's decision to not gather evidence regarding the agreement is a significant omission. An auditor must review such agreements to verify that the organization's requirements, including those from ISO/IEC 42001, are being met by the external provider. This review is essential for assessing the effectiveness of the organization's control over outsourced processes.

Why Incorrect

A. Reviewing monitoring processes is necessary but insufficient without first verifying the foundational contractual requirements that those processes are meant to oversee.
C. Determining the appropriateness of governance processes for outsourced operations is a key responsibility of an AIMS auditor to ensure conformity with the standard.
D. The issue is not about re-auditing but about the initial failure to audit a critical piece of evidence (the contract) during the current audit cycle.

References

1. ISO/IEC 42001:2023, Clause 8.1, "Operational planning and control". This clause requires the organization to ensure that externally provided processes, products, and services conform to requirements. The auditor must verify this, and the contract is key evidence.

2. ISO 19011:2018, "Guidelines for auditing management systems", Clause 6.4.5, "Collecting and verifying information". This section emphasizes that information collected should be verified to be sufficient and appropriate audit evidence. Ignoring a key contract fails this principle.

3. Gramling, A. A., & Schneider, A. (2018). "The role of the internal audit function in the corporate governance of a publicly traded organization". Current Issues in Auditing, 12(2), P20-P25. This paper discusses the internal audit's role in reviewing third-party relationships, where contract review is a fundamental step. https://doi.org/10.2308/ciia-52212

Keep practicing

Take the free ISO-IEC-42001-LEAD-AUDITOR practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other ISO-IEC-42001-LEAD-AUDITOR practice questions

Scroll to Top