Week 14 self-check | AI GRCA Practice Lab

WEEK 14 · ISO AI management · ISO/IEC 42001 Clause 4: Context of the Organisation

Why is 'documenting scope' considered a defensibility issue, not just an administrative one?

Documentation is purely for internal filing purposes with no external relevanceScope documentation is optional under Clause 4Defensibility has nothing to do with documentationA documented, reasoned scope can be explained and justified to auditors, regulators or affected people; an undocumented one cannot

WEEK 14 · ISO AI management · ISO/IEC 42001 Clause 4: Context of the Organisation

What is the purpose of 'AIMS processes' as referenced in Clause 4, beyond simply listing issues and parties?

Processes are optional once context is documentedThey have no defined purposeThey are the repeatable processes the organisation puts in place to actually manage AI within the scoped boundary, building on the context establishedAIMS processes only apply after certification

WEEK 14 · ISO AI management · ISO/IEC 42001 Clause 4: Context of the Organisation

Why are affected people treated as interested parties rather than just 'users'?

They aren't relevant to AIMS scopeThey experience consequences from the AI system even if they never interact with it directlyOnly paying customers count as interested partiesAffected people are the same as suppliers

WEEK 14 · ISO AI management · ISO/IEC 42001 Clause 4: Context of the Organisation

How should 'business context' under Clause 4 reflect a new strategic AI initiative the organisation is about to launch?

Business context is fixed once and never updatedStrategic initiatives are outside Clause 4's remit entirelyIt should be ignored until after launchContext documentation should be updated to reflect new AI-related strategic initiatives as they emerge, keeping scope current

WEEK 14 · ISO AI management · ISO/IEC 42001 Clause 4: Context of the Organisation

How should 'procured' versus 'internally built' AI systems be treated differently, if at all, in Clause 4 scoping?

Both should generally be considered in scope where the organisation deploys or uses them, since accountability for use doesn't depend on who built the systemOnly internally built systems need governanceProcurement status is irrelevant to any governance questionProcured systems should always be excluded from AIMS scope entirely

WEEK 14 · ISO AI management · ISO/IEC 42001 Clause 4: Context of the Organisation

Clause 4 requires understanding which two categories of issues?

Internal and external issues affecting the AIMSOnly external issuesOnly issues raised by regulatorsFinancial and marketing issues

WEEK 14 · ISO AI management · ISO/IEC 42001 Clause 4: Context of the Organisation

Which best describes 'needs and expectations' of interested parties in Clause 4 terms?

A fixed, universal list identical for every organisationA synonym for financial targetsWhat each interested party requires or expects from how the organisation governs AI, which the AIMS should account forOnly the needs of the AI development team

WEEK 14 · ISO AI management · ISO/IEC 42001 Clause 4: Context of the Organisation

Which is the best way to describe the relationship between Clause 4 scoping work and later Clause 8 operational controls?

They are entirely disconnected activitiesClause 4 scope defines what Clause 8 operational controls actually need to cover — controls should map back to the defined scopeClause 8 controls should be defined before Clause 4 scopeScope has no bearing on which systems need operational controls