Which of the following competencies must at least one of the audit team members have?
Scenario 7 (continued):
Scenario 7: ICure, headquartered in Bratislava, is a medical institution known for its use of the latest technologies in medical practices. It has introduced groundbreaking Al-driven diagnostics and treatment planning tools that have fundamentally transformed patient care.
ICure has integrated a robust artificial intelligence management system AIMS to manage its Al systems effectively. This holistic management framework ensures that ICure's Al applications are not only developed but also deployed and maintained to adhere to the
highest industry standards, thereby enhancing efficiency and reliability.
ICure has initiated a comprehensive auditing process to validate its AIMS's effectiveness in alignment with ISO/IEC 42001. The stage 1 audit involved an on-site evaluation by the audit team. The team evaluated the site-specific conditions, interacted with ICure's personnel,
observed the deployed technologies, and reviewed the operations that support the AIMS. Following these observations, the findings were documented and communicated to ICure. setting the stage for subsequent actions.
Unforeseen delays and resource allocation issues introduced a significant gap between the completion of stage 1 and the onset of stage 2 audits. This interval, while unplanned, provided an opportunity for reflection and preparation for upcoming challenges.
After four months, the audit team initiated the stage 2 audit. They evaluated AIMS's compliance with ISO/IEC 42001 requirements, paying special attention to the complexity of processes and their documentation. It was during this phase that a critical observation was made:
ICure had not fully considered the complexity of its processes and their interactions when determining the extent of documented information. Essential processes related to Al model training, validation, and deployment were not documented accurately, hindering effective control and management of these critical activities. This issue was recorded as a minor nonconformity, signaling a need for enhanced control and management of these vital activities.
Simultaneously, the auditor evaluated the appropriateness and effectiveness of the "AIMS Insight Strategy," a procedure developed by
ICure to determine the AIMS internal and external challenges. This examination identified specific areas for improvement, particularly in
the way stakeholder input was integrated into the system. It highlighted how this could significantly enhance the contribution of relevant
parties in strengthening the system's resilience and effectiveness.
The audit team determined the audit findings by taking into consideration the requirements of ICure, the previous audit records and
conclusions, the accuracy, sufficiency, and appropriateness of evidence, the extent to which planned audit activities are realized and
planned results achieved, the sample size, and the categorization of the audit findings. The audit team decided to first record all the
requirements met; then they proceeded to record the nonconformities.
Based on the scenario above, answer the following question:
Question:
Which clause did the audit team evaluate when assessing the appropriateness of the “AIMS Insight Strategy” procedure?
Scenario 8:
Scenario 8: InnovateSoft, headquartered in Berlin, Germany, is a software development company known for its innovative solutions and commitment to excellence. It specializes in custom software solutions, development, design, testing, maintenance, and consulting, covering both mobile apps and web development. Recently, the company underwent an audit to evaluate the effectiveness and
compliance of its artificial intelligence management system AIMS against ISO/IEC 42001.
The audit team engaged with the auditee to discuss their findings and observations during the audit's final phases. After evaluating the evidence, the audit team presented their audit findings to InnovateSoft, highlighting the identified nonconformities.
Upon receiving the audit findings, InnovateSoft accepted the conclusions but expressed concerns about some findings inaccurately reflecting the efficiency of their software development processes. In response, the company provided new evidence and additional information to alter the audit conclusions for a couple of minor nonconformities identified. After thorough consideration, the audit team leader clarified that the new evidence did not significantly alter the core conclusions drawn for the nonconformities. Therefore, the certification body issued a certification recommendation conditional upon the filing of corrective action plans without a prior visit.
InnovateSoft accepted the decision of the certification body. The top management of the company also sought suggestions from the audit team on resolving the identified nonconformities. The audit team leader offered solutions to address the issues, fostering a collaborative effort between the auditors and InnovateSoft. During the closing meeting, the audit team covered key topics to enhance transparency. They clarified to InnovateSoft that the audit evidence was based on a sample, acknowledging the inherent uncertainty. The method and time frame of reporting and grading findings were discussed to provide a structured overview of nonconformities. The certification body's process for handling nonconformities, including potential consequences, guided InnovateSoft on corrective actions. The time frame for presenting a plan for correction was
communicated, emphasizing urgency. Insights into the certification body’s post-audit activities were provided, ensuring ongoing support.
Lastly, the audit team briefed InnovateSoft on complaint and appeal handling.
InnovateSoft submitted the action plans for each nonconformity separately, describing only the detected issues and the corrective actions planned to address the detected nonconformities. However, the submission slightly exceeded the specified period of 45 days set by the certification body, arriving three days later. InnovateSoft explained this by attributing the delay to unexpected challenges encountered during the compilation of the action plans.
Question:
Was the audit team leader’s attitude appropriate regarding the new evidence provided by the company?
Jonathan received an offer from the certification body including detailed information related to the audit. What other information should have been included in the audit offer? Refer to Scenario 5.
Scenario 5: Alterhealth is a mid-sized technology firm based in Toronto. Canada. It develops Al systems for healthcare providers, focusing on improving patient care,
optimizing hospital workflows, and analyzing healthcare data for insights that can improve health outcomes. To ensure responsible and effective use of Al in its
operations, Alterhealth has implemented an artificial intelligence management system AIMS based on ISO/IEC 42001. After a year of having the AIMS in place, the
company decided to apply for a certification audit to obtain certification against ISO/IEC 42001.
The company contracted a certification body to conduct the audit, who assembled the audit team and appointed the audit team leader. The audit team leader had
conducted a certification audit at Alterhealth in the past. The top management of Alterhealth decided to reject the appointment of this auditor because they believed
that they would not receive added value from the audit. In response, the certification body appointed Jonathan, an independent auditor with no prior engagements with
Alterhealth, as the new audit team leader. Jonathan's introduction marked the beginning of a collaborative process aimed at evaluating the conformity of the AIMS to
ISO/IEC 42001 requirements.
The certification body determined the audit scope, which included only specific departments essential to the integration and application of Al, such as the Al Research,
Machine Learning Applications, and Al Ethics and Compliance Departments, and did not cover all of the departments covered by the AIMS scope. Meanwhile,
Alterhealth determined the audit time, setting the necessary time frame for planning and conducting a thorough and effective review to ensure all aspects of the AIMS
within the selected departments were meticulously reviewed.
Afterward, Jonathan received a detailed offer from the certification body, outlining his role and including information related to the audit, such as the audit's duration,
team members, their responsibilities, the limits to the audit engagement, and their salary compensation. With a clear mandate, Jonathan was tasked with a multitude
of responsibilities: defining the audit objectives and criteria, planning the audit process, identifying and addressing audit risks, managing communication with
Alterhealth, overseeing the audit team, and ensuring a smooth and conflict free execution.
With Jonathan's leadership and a well-defined audit framework in place, the certification audit proceeded with a structured and objective evaluation of Alterhealth's
AIMS.
What type of audit evidence did Augustine gather when he collected management review records? Refer to scenario 3.
Scenario 3: Heala specializes in developing Al-driven solutions for the healthcare sector. With a keen focus on leveraging Al to revolutionize patient care, diagnostics,
and treatment planning, the company has implemented an artificial intelligence management system AIMS based on ISO/IEC 42001. After a year of having the AIMS in
place, the company decided to apply for a certification audit.
It contracted a local certification body, who established the audit team and assigned the audit team leader. Augustine, the designated audit team leader, has a wide
range of skills relevant to various auditing domains. His proficiency encompasses audit principles, processes, and methods, as well as standards for management
systems and additional references. Furthermore, he is knowledgeable about the Heala’s context and relevant statutory and regulatory requirements.
Augustine first gathered management review records, interested party feedback logs, and revision histories for Heala's AIMS. This crucial step laid the groundwork for
a deeper investigation, which included conducting comprehensive interviews with key personnel to understand how feedback from interested parties directly
influenced updates to the AIMS and its strategic direction. Augustine's thorough evaluation process aimed to verify Heala's commitment to integrating the needs and
expectations of interested parties, a critical requirement of ISO/IEC 42001.
Augustine also integrated a sophisticated Al tool to analyze large datasets for patterns and anomalies, and thus have a more informed and data driven audit process.
This Al solution, known for its ability to sift through vast amounts of data with unparalleled speed and accuracy, enabled Augustine to identify irregularities and trends
that would have been nearly impossible to detect through manual methods. The tool was also helpful in preparing hypotheses based on data.
During the audit. Augustine failed to fully consider Heala’s critical processes, expectations, the complexity of audit tasks, and necessary resources beforehand. This
oversight compromised the audit integrity and reliability, reflecting a significant deviation from the diligence and informed judgment expected of auditors.
Based on scenario 3, which of the following AI technologies did Augustine utilize to analyze large datasets? Refer to the fourth paragraph.
Scenario 3: Heala specializes in developing Al-driven solutions for the healthcare sector. With a keen focus on leveraging Al to revolutionize patient care, diagnostics,
and treatment planning, the company has implemented an artificial intelligence management system AIMS based on ISO/IEC 42001. After a year of having the AIMS in
place, the company decided to apply for a certification audit.
It contracted a local certification body, who established the audit team and assigned the audit team leader. Augustine, the designated audit team leader, has a wide
range of skills relevant to various auditing domains. His proficiency encompasses audit principles, processes, and methods, as well as standards for management
systems and additional references. Furthermore, he is knowledgeable about the Heala’s context and relevant statutory and regulatory requirements.
Augustine first gathered management review records, interested party feedback logs, and revision histories for Heala's AIMS. This crucial step laid the groundwork for
a deeper investigation, which included conducting comprehensive interviews with key personnel to understand how feedback from interested parties directly
influenced updates to the AIMS and its strategic direction. Augustine's thorough evaluation process aimed to verify Heala's commitment to integrating the needs and
expectations of interested parties, a critical requirement of ISO/IEC 42001.
Augustine also integrated a sophisticated Al tool to analyze large datasets for patterns and anomalies, and thus have a more informed and data driven audit process.
This Al solution, known for its ability to sift through vast amounts of data with unparalleled speed and accuracy, enabled Augustine to identify irregularities and trends
that would have been nearly impossible to detect through manual methods. The tool was also helpful in preparing hypotheses based on data.
During the audit. Augustine failed to fully consider Heala’s critical processes, expectations, the complexity of audit tasks, and necessary resources beforehand. This
oversight compromised the audit integrity and reliability, reflecting a significant deviation from the diligence and informed judgment expected of auditors.
Based on Scenario 5, Alterhealth determined the audit time. Is this acceptable?
Scenario 5: Alterhealth is a mid-sized technology firm based in Toronto. Canada. It develops Al systems for healthcare providers, focusing on improving patient care,
optimizing hospital workflows, and analyzing healthcare data for insights that can improve health outcomes. To ensure responsible and effective use of Al in its
operations, Alterhealth has implemented an artificial intelligence management system AIMS based on ISO/IEC 42001. After a year of having the AIMS in place, the
company decided to apply for a certification audit to obtain certification against ISO/IEC 42001.
The company contracted a certification body to conduct the audit, who assembled the audit team and appointed the audit team leader. The audit team leader had
conducted a certification audit at Alterhealth in the past. The top management of Alterhealth decided to reject the appointment of this auditor because they believed
that they would not receive added value from the audit. In response, the certification body appointed Jonathan, an independent auditor with no prior engagements with
Alterhealth, as the new audit team leader. Jonathan's introduction marked the beginning of a collaborative process aimed at evaluating the conformity of the AIMS to
ISO/IEC 42001 requirements.
The certification body determined the audit scope, which included only specific departments essential to the integration and application of Al, such as the Al Research,
Machine Learning Applications, and Al Ethics and Compliance Departments, and did not cover all of the departments covered by the AIMS scope. Meanwhile,
Alterhealth determined the audit time, setting the necessary time frame for planning and conducting a thorough and effective review to ensure all aspects of the AIMS
within the selected departments were meticulously reviewed.
Afterward, Jonathan received a detailed offer from the certification body, outlining his role and including information related to the audit, such as the audit's duration,
team members, their responsibilities, the limits to the audit engagement, and their salary compensation. With a clear mandate, Jonathan was tasked with a multitude
of responsibilities: defining the audit objectives and criteria, planning the audit process, identifying and addressing audit risks, managing communication with
Alterhealth, overseeing the audit team, and ensuring a smooth and conflict free execution.
With Jonathan's leadership and a well-defined audit framework in place, the certification audit proceeded with a structured and objective evaluation of Alterhealth's
AIMS.
During an audit, the auditor uncovers sensitive data regarding the AI system's algorithms and their decision-making processes. Which principle must the auditor adhere to when handling this information?
Did the audit team conduct their meetings in accordance with best practices? Refer to Scenario 7.
Scenario 7: TastyMade. headquartered in Hamburg, Germany, is an established company in the food manufacturing industry that applies Al technologies in its
operations. It has implemented an artificial intelligence management system AIMS based on ISO/IEC 42001 to further strengthen its Al management and ensure
compliance with international standards. As part of its commitment to excellence and continual improvement, TastyMade is undergoing an audit process to achieve
certification against ISO/IEC 42001.
In preparation for the audit, TastyMade collaborated closely with the audit team leader to develop a detailed audit plan. This plan encompassed objectives, criteria,
scope, and logistical arrangements for both on-site and remote audit activities. Recognizing the specialized nature of Al integration, a technical expert was brought in
to support the audit team and ensure comprehensive coverage of relevant aspects. Upon discussion with the audit team leader, it was mutually decided that not every
audit team member would need a guide throughout the audit process. At times, the TastyMade itself would assume the role of the guide, actively facilitating audit
activities.
A formal opening meeting was held with TastyMade's management to provide an overview of the audit process and set expectations. During this meeting, key
interested parties were briefed on the audit objectives and the methodologies that would be employed during the audit. Following the meeting, the audit team
proceeded with their work, collecting information and conducting tests to evaluate the effectiveness of TastyMade's AIMS.
Daily evening meetings were held to review progress, discuss encountered issues, and facilitate collaboration among audit team members. The audit team leader
adopted an open communication approach, encouraging all auditors to share their findings and challenges. The communication regarding the progress of the audit
was informal, allowing for a fluid exchange of information and updates among team members.
To verify adherence to some requirements of clause 4.1 Understanding the organization and its context, the audit team arbitrarily selected for analysis a representative
sample of Al management practices across different departments and functions within the company.
During the audit process, the technical expert uncovered certain technical and operational findings related to the integration and governance of Al systems.
Recognizing the significance of these findings, the expert promptly informed the audit team leader. Understanding the need for further clarification and direct
communication, the audit team leader authorized the technical expert to address the findings directly with the auditee. However, to ensure proper oversight, the expert
was supervised by one of the audit team members.
Throughout the audit, it became apparent that TastyMade promoted a culture of autonomy and decentralized decision-making in Al integration processes. Employees
were empowered to set goals, allocate responsibilities, and devise methodologies independently, with management providing guidance and support as needed. This
approach fostered innovation and agility within the company
Scenario 7 (continued):
Scenario 7: ICure, headquartered in Bratislava, is a medical institution known for its use of the latest technologies in medical practices. It has introduced groundbreaking Al-driven diagnostics and treatment planning tools that have fundamentally transformed patient care.
ICure has integrated a robust artificial intelligence management system AIMS to manage its Al systems effectively. This holistic management framework ensures that ICure's Al applications are not only developed but also deployed and maintained to adhere to the
highest industry standards, thereby enhancing efficiency and reliability.
ICure has initiated a comprehensive auditing process to validate its AIMS's effectiveness in alignment with ISO/IEC 42001. The stage 1 audit involved an on-site evaluation by the audit team. The team evaluated the site-specific conditions, interacted with ICure's personnel,
observed the deployed technologies, and reviewed the operations that support the AIMS. Following these observations, the findings were documented and communicated to ICure. setting the stage for subsequent actions.
Unforeseen delays and resource allocation issues introduced a significant gap between the completion of stage 1 and the onset of stage 2 audits. This interval, while unplanned, provided an opportunity for reflection and preparation for upcoming challenges.
After four months, the audit team initiated the stage 2 audit. They evaluated AIMS's compliance with ISO/IEC 42001 requirements, paying special attention to the complexity of processes and their documentation. It was during this phase that a critical observation was made:
ICure had not fully considered the complexity of its processes and their interactions when determining the extent of documented information. Essential processes related to Al model training, validation, and deployment were not documented accurately, hindering effective control and management of these critical activities. This issue was recorded as a minor nonconformity, signaling a need for enhanced control and management of these vital activities.
Simultaneously, the auditor evaluated the appropriateness and effectiveness of the "AIMS Insight Strategy," a procedure developed by
ICure to determine the AIMS internal and external challenges. This examination identified specific areas for improvement, particularly in
the way stakeholder input was integrated into the system. It highlighted how this could significantly enhance the contribution of relevant
parties in strengthening the system's resilience and effectiveness.
The audit team determined the audit findings by taking into consideration the requirements of ICure, the previous audit records and
conclusions, the accuracy, sufficiency, and appropriateness of evidence, the extent to which planned audit activities are realized and
planned results achieved, the sample size, and the categorization of the audit findings. The audit team decided to first record all the
requirements met; then they proceeded to record the nonconformities.
Based on the scenario above, answer the following question:
Question:
Based on Scenario 7, the audit team conducted a Stage 2 audit after a considerable time from Stage 1. Is this recommended?
TESTED 16 Oct 2025