ISO-IEC-42001-LEAD-AUDITOR practice question 10 of 25

[Conducting an ISO/IEC 42001 Audit] Scenario 3 (continued): ArBank is a financial institution located in Brussels, Belgium, which offers a diverse…

Full set: 120 questions
[Conducting an ISO/IEC 42001 Audit] Scenario 3 (continued): ArBank is a financial institution located in Brussels, Belgium, which offers a diverse range of banking and investment servicesto its clients. To ensure the continual improvement of its operations, ArBank has implemented a quality management system QMS based on ISO 9001 and an artificial intelligence management system AIMS based on the requirements of ISO/IEC 42001. Audrey, an experienced auditor, led an internal audit focused on the AIMS within ArBank. She assessed the chatbots integrated into thebank's website and mobile app, analyzing communications using big data technology to identify potential noncompliance, fraud, orunethical conduct. Instead of relying solely on the information provided by the chatbots, Audrey sought out evidence that would eitherconfirm or challenge the validity of the data, ensuring her conclusions were based on reliable and accurate information. Her review ofselected chatbot interactions confirmed they met their intended purpose. For the specific context of ArBank's operations, Audrey utilized an Al system to assess the efficiency of the bank's digital infrastructure,focusing on tasks critical to the Finance Department. This Al system was able to analyze the functionality of chatbots integrated intoArBank's website and mobile app to determine if it adheres to ISO/IEC 42001 requirements and internal policies governing customerservice in the banking sector. In addition, Audrey conducted a deeper assessment of the bank’s AIMS. Her evaluation included observing different stages of the AIMSlife cycle, from development to deployment, to ensure that roles and responsibilities were clearly defined and aligned with ArBank’soperational goals. She also evaluated the tools used to monitor and measure the performance of the AIMS. Audrey continued the audit process by auditing ArBank's outsourced operations. Upon checking the contractual agreements between thetwo parties, Audrey decided that there was no need to gather audit evidence regarding the contractual agreement. She reviewed thecompany's processes for monitoring the quality of outsourced operations, determined whether appropriate governance processes are inplace with regard to the engagement of outsourced persons or organizations, andreviewed and evaluated the company's plans in case ofexpected or unexpected termination of the outsourcing agreement. Based on the scenario above, answer the following question: Based on Scenario 3, did Audrey perform a technical assessment during the audit?
Answer options
A: Yes, she performed a general assessment of ArBank's customer service performance
B: No, she only reviewed contractual agreements with outsourced service providers
C: Yes, she conducted observations of the AIMS life cycle and evaluated the tools used to monitor its performance Correct answer
D: No, only the certification body should perform technical assessments
Correct Answer:
C. Yes, she conducted observations of the AIMS life cycle and evaluated the tools used to monitor its performance
Explanation

Yes, Audrey performed a technical assessment. The scenario explicitly states her evaluation included "observing different stages of the AIMS life cycle, from development to deployment" and she "evaluated the tools used to monitor and measure the performance of the AIMS." These actions go beyond reviewing documentation or conducting interviews. Observing a system's life cycle and evaluating its performance monitoring tools are hands-on, technical audit procedures designed to verify that processes and controls are implemented and operating effectively in practice.

Why Incorrect

A. This statement is too general. Her assessment was a specific, technical evaluation of the AIMS, not a general review of customer service performance.
B. This is factually incorrect. The scenario clearly describes her assessment of the AIMS life cycle and tools, in addition to her work on outsourced operations.
D. This is an incorrect assertion. Internal auditors are often required to perform technical assessments within their scope of work, provided they have the necessary competence.

References

1. ISO 19011:2018, Guidelines for auditing management systems, Clause 6.4.5, "Collecting and verifying information". This section lists "observing processes, environment, conditions, systems" as a valid method for collecting audit evidence, which is a key part of a technical assessment.

2. ISO/IEC 42001:2023, Artificial intelligence — Management system, Annex A, Control A.4.3 "AI system development process". Auditing this control effectively would necessitate technical assessment activities like observing the development life cycle, as Audrey did.

Scroll to Top