Week 13 self-check | AI GRCA Practice Lab

WEEK 13 · ISO AI management · ISO/IEC 42001 Foundations

What is the risk of an organisation writing an AI policy that simply copies another company's publicly available policy verbatim?

This is explicitly recommended by the standardVerbatim copying guarantees certification successNo risk — policies are meant to be genericIt likely won't reflect the organisation's actual context, risks and AI use, undermining its usefulness and its Clause 5 intent

WEEK 13 · ISO AI management · ISO/IEC 42001 Foundations

How should an organisation treat a nonconformity discovered during a management review?

Nonconformities found internally don't need any actionIgnore it until the next external auditAddress it through correction and, where needed, root-cause corrective action, consistent with Clause 10Immediately decertify itself

WEEK 13 · ISO AI management · ISO/IEC 42001 Foundations

What does 'AIMS' stand for and mean?

AI Management System — a structured, repeatable way to govern AI responsiblyAutomated Inference Monitoring ServiceA synonym for a risk registerAI Marketing System

WEEK 13 · ISO AI management · ISO/IEC 42001 Foundations

What does 'Clause 4 to 10 overview' most usefully give a first-time reader of ISO/IEC 42001?

A mental map of how the requirements flow from context-setting through to continual improvementA list of every possible AI riskA pricing guide for certificationA legal history of the standard

WEEK 13 · ISO AI management · ISO/IEC 42001 Foundations

What is the role of internal audit within an AIMS?

It only applies once certification has been achievedTo replace management's own responsibility for AI riskTo independently check whether the AIMS is being followed and is effective, feeding into management reviewIt's optional and rarely relevant

WEEK 13 · ISO AI management · ISO/IEC 42001 Foundations

Which best reflects the relationship between leadership commitment (Clause 5) and Annex A control selection?

They are entirely unrelated activitiesLeadership commitment sets the direction and resourcing that makes meaningful Annex A control selection and operation possibleAnnex A controls are selected before any leadership involvementLeadership has no role in control selection

WEEK 13 · ISO AI management · ISO/IEC 42001 Foundations

What is the practical risk of treating 42001 implementation as a one-off project rather than an ongoing system?

One-off projects are explicitly required by Clause 10This approach is what the standard recommendsNo risk — a one-off effort is equally effectiveThe AIMS becomes outdated and disconnected from how AI is actually being used as the organisation's AI footprint grows

WEEK 13 · ISO AI management · ISO/IEC 42001 Foundations

What's the difference between certification and implementation?

They're identicalImplementation is building the AIMS practices; certification is an optional external verification against the standardCertification must happen before any implementation workCertification guarantees fair AI outcomes