PECB ISO-IEC-42001-Lead-Auditor - ISO/IEC 42001:2023 Artificial Intelligence Management System Lead Auditor Exam

Scenario 1 (continued):

To ensure the integrity of the AI system, Future Horizon Academy has implemented measures to ensure that training data remain isolated from data that could lead to harmful or undesirable outcomes. The institution adds significant data elements as metadata, transforms the data into a format usable by the AI system, and uses data from one or more trusted sources.

Committed to standardization and continual improvement, Future Horizon Academy decided to implement an artificial intelligence management system (AIMS) based on ISO/IEC 42001 that would help the institution increase operational efficiency, resulting in improved processes.

After having the AIMS in place for a year, the institution decided to apply for a certification audit to get certified against ISO/IEC 42001. Prior to the certification audit, the institution conducted an internal audit and management review to ensure that the AIMS aligns with the institution’s own requirements and that the system is being maintained effectively.

Question:

Based on functionality, what type of AI system did Future Horizon Academy establish?

The process to assess the potential consequences for individuals or groups of individuals, or both, and societies that can result from the AI system throughout its life cycle is known as:

Were VeridicAI’s action plans drafted appropriately? Refer to Scenario 8.

Scenario 8: VeridicAI. based in San Francisco. USA, specializes in market research using Al technologies to analyze customer behavior. Founded in 2023, the company

employs natural language processing, machine learning, and predictive analytics to provide real time insights to a range of businesses. VeridicAI has implemented an

artificial intelligence management system AIMS based on ISO/IEC 42001 to manage its Al technologies effectively. The AIMS scope includes select departments within

the company, for which it has received a four-year certification against ISO/IEC 42001. Committed to transparency. VeridicAI publicly shares details of this certification.

As the certification nears its end, VeridicAI is preparing for an audit to renew its certification.

The audit process was led by Sharona, the audit team leader, who is a full-time employee of the certification body. Sharona and the audit team undertook all planned

audit activities. Afterward, they organized the closing meeting with VeridicAl’s management. During the meeting, Sharona and the team made a recap on audit

objectives and scope, presented the audit findings and conclusions, presented identified nonconformities, and organized a session for questions and answers for the

auditee.

VeridicAI received a conditional recommendation for certification, underscoring its compliance with the industry's standards. Sharona confirmed that the company met

the essential requirements but noted some identified minor nonconformities. In response, VeridicAI compiled and submitted a comprehensive action plan that

addresses all identified nonconformities within a designated timeframe. Because of the comprehensive action plan, Sharona did not see the need for an additional on-

site visit to verify the effectiveness of the action plan.

Sharona played an integral role in the certification decision process. Her thorough understanding of VeridicAI's operations, gained from the audit, guided the

certification body towards a well-informed certification decision.

What is the difference between reactive machines and limited-memory AI?

A healthcare provider wants to develop a system that can analyze medical images, such as X-rays and MRIs, to assist doctors in diagnosing diseases. Which AI concept is most relevant for this application?

Which core element emphasizes that AI systems should be designed to avoid bias and ensure fair treatment for all individuals?

Scenario 8 (continued):

Scenario 8:

Scenario 8: InnovateSoft, headquartered in Berlin, Germany, is a software development company known for its innovative solutions and commitment to excellence. It specializes in custom software solutions, development, design, testing, maintenance, and consulting, covering both mobile apps and web development. Recently, the company underwent an audit to evaluate the effectiveness and

compliance of its artificial intelligence management system AIMS against ISO/IEC 42001.

The audit team engaged with the auditee to discuss their findings and observations during the audit's final phases. After evaluating the evidence, the audit team presented their audit findings to InnovateSoft, highlighting the identified nonconformities.

Upon receiving the audit findings, InnovateSoft accepted the conclusions but expressed concerns about some findings inaccurately reflecting the efficiency of their software development processes. In response, the company provided new evidence and additional information to alter the audit conclusions for a couple of minor nonconformities identified. After thorough consideration, the audit team leader clarified that the new evidence did not significantly alter the core conclusions drawn for the nonconformities. Therefore, the certification body issued a certification recommendation conditional upon the filing of corrective action plans without a prior visit.

InnovateSoft accepted the decision of the certification body. The top management of the company also sought suggestions from the audit team on resolving the identified nonconformities. The audit team leader offered solutions to address the issues, fostering a collaborative effort between the auditors and InnovateSoft. During the closing meeting, the audit team covered key topics to enhance transparency. They clarified to InnovateSoft that the audit evidence was based on a sample, acknowledging the inherent uncertainty. The method and time frame of reporting and grading findings were discussed to provide a structured overview of nonconformities. The certification body's process for handling nonconformities, including potential consequences, guided InnovateSoft on corrective actions. The time frame for presenting a plan for correction was

communicated, emphasizing urgency. Insights into the certification body’s post-audit activities were provided, ensuring ongoing support.

Lastly, the audit team briefed InnovateSoft on complaint and appeal handling.

InnovateSoft submitted the action plans for each nonconformity separately, describing only the detected issues and the corrective actions planned to address the detected nonconformities. However, the submission slightly exceeded the specified period of 45 days set by the certification body, arriving three days later. InnovateSoft explained this by attributing the delay to unexpected challenges encountered during the compilation of the action plans.

After being recommended for certification (pending submission of corrective actions), InnovateSoft did not notify the auditor about completion of corrections and corrective actions.

Question:

Is this acceptable?

Scenario 5 (continued):

Scenario 5: Aizoia, located in Washington, DC, has revolutionized data analytics, software development, and consulting by using advanced Al algorithms. Central to its success is an Al platform adept at deciphering complex datasets for enhanced insights. To ensure

that its Al systems operate effectively and responsibly, Aizoia has established an artificial intelligence management system AIMS based on ISO/IEC 42001 and is now undergoing a certification audit to verify the AIMS’s effectiveness and compliance with ISO/IEC 42001.

Robert, one of the certification body's full-time employees with extensive experience in auditing, was appointed as the audit team leader despite not receiving an official offer for the role. Understanding the critical importance of assembling an audit team with diverse skills

and knowledge, the certification body selected competent individuals to form the audit team. The certification body appointed a team of seven members to conduct the audit after considering the specific conditions of the audit mission and the required competencies.

Initially, the certification body, in cooperation with Aizoia, defined the extent and boundaries of the audit, specifying the sites (whether physical or virtual), organizational units, and the activities for review. Once the scope, processes, methods, and team composition had been defined, the certification body provided the audit team leader with extensive information, including the audit objectives and documented details on the scope, processes, methods, and team compositions.

Additionally, the certification body shared contact details of the auditee, including locations, time frames, and the duration of the audit activities to be conducted. The team leader also received information needed for evaluating and addressing identified risks and opportunities for the achievement of the audit objectives.

Before starting the audit, Robert wrote an engagement letter, introducing himself to Aizoia and outlining plans for scheduling initial contact. The initial contact aimed to confirm the communication channels, establish the audit team's authority to conduct the audit, and summarize the audit's key aspects, such as objectives, scope, criteria, methods, and team composition. During this first meeting, Robert emphasized the need for access to essential information that would help to conduct the audit.

Moreover, audit logistics, such as scheduling, access, health and safety arrangements, observer attendance, and the need for guides or interpreters, were thoroughly planned. The meeting also addressed areas of interest or concern, preemptively resolving potential issues and finalizing any matters related to the audit team composition.

As the audit progressed, Robert recognized the complexity of Aizoia’s operations, leading him to conclude that a review of its Al-related data governance practices was essential for compliance with ISO/IEC 42001. He discussed this need with Aizoia's management, proposing an expanded audit scope. After careful consideration, they agreed to conduct a thorough review of the Al data governance practices, but there was no mutual decision to officially change the audit scope. Consequently. Robert decided to proceed with the audit based on the original scope, adhering to the initial audit plan, and documented the conversation and decision accordingly.

Based on the scenario above, answer the following question:

Question:

Based on Scenario 5, did the certification body provide all the necessary information to conduct the audit to the audit team leader?

Scenario 7:

Scenario 7: ICure, headquartered in Bratislava, is a medical institution known for its use of the latest technologies in medical practices. It has introduced groundbreaking Al-driven diagnostics and treatment planning tools that have fundamentally transformed patient care.

ICure has integrated a robust artificial intelligence management system AIMS to manage its Al systems effectively. This holistic management framework ensures that ICure's Al applications are not only developed but also deployed and maintained to adhere to the

highest industry standards, thereby enhancing efficiency and reliability.

ICure has initiated a comprehensive auditing process to validate its AIMS's effectiveness in alignment with ISO/IEC 42001. The stage 1 audit involved an on-site evaluation by the audit team. The team evaluated the site-specific conditions, interacted with ICure's personnel,

observed the deployed technologies, and reviewed the operations that support the AIMS. Following these observations, the findings were documented and communicated to ICure. setting the stage for subsequent actions.

Unforeseen delays and resource allocation issues introduced a significant gap between the completion of stage 1 and the onset of stage 2 audits. This interval, while unplanned, provided an opportunity for reflection and preparation for upcoming challenges.

After four months, the audit team initiated the stage 2 audit. They evaluated AIMS's compliance with ISO/IEC 42001 requirements, paying special attention to the complexity of processes and their documentation. It was during this phase that a critical observation was made:

ICure had not fully considered the complexity of its processes and their interactions when determining the extent of documented information. Essential processes related to Al model training, validation, and deployment were not documented accurately, hindering effective control and management of these critical activities. This issue was recorded as a minor nonconformity, signaling a need for enhanced control and management of these vital activities.

Simultaneously, the auditor evaluated the appropriateness and effectiveness of the "AIMS Insight Strategy," a procedure developed by

ICure to determine the AIMS internal and external challenges. This examination identified specific areas for improvement, particularly in

the way stakeholder input was integrated into the system. It highlighted how this could significantly enhance the contribution of relevant

parties in strengthening the system's resilience and effectiveness.

The audit team determined the audit findings by taking into consideration the requirements of ICure, the previous audit records and

conclusions, the accuracy, sufficiency, and appropriateness of evidence, the extent to which planned audit activities are realized and

planned results achieved, the sample size, and the categorization of the audit findings. The audit team decided to first record all the

requirements met; then they proceeded to record the nonconformities.

Based on the scenario above, answer the following question:

Question:

Which phase of the Stage 1 audit was NOT conducted by the audit team?

During a certification audit, the audit team reviewed the defined roles and responsibilities within the auditee and conducted interviews with key personnel. They also evaluated whether the roles and responsibilities were aligned with the AI policy and objectives, examined reporting mechanisms for concerns, and reviewed the reporting frequency and response time for AI-related matters. The implementation of which control of ISO/IEC 42001 is being verified in this case?