Week 16 self-check | AI GRCA Practice Lab

WEEK 16 · ISO AI management · ISO/IEC 42001 Clauses 7–10 and Annex A Controls

Why is 'evidence preservation' relevant to both Clause 9 (evaluation) and later external scrutiny (e.g. audit or regulatory review)?

Evidence preservation is only relevant internally, never externallyWell-preserved monitoring, audit and review evidence is what allows both internal evaluation and external scrutiny to actually verify AIMS performanceExternal reviewers never look at internally preserved evidenceEvidence preservation is not part of Clause 9's scope

WEEK 16 · ISO AI management · ISO/IEC 42001 Clauses 7–10 and Annex A Controls

Why would 'supplier controls' appear within Clause 8 operation rather than only in Annex A's third-party theme?

Because managing suppliers is an ongoing operational activity (not just a one-time control selection), it belongs in Clause 8's operational scope tooClause 8 and Annex A never overlap in subject matterSupplier controls are exclusively a Clause 5 leadership matterSupplier controls have no place in Clause 8 at all

WEEK 16 · ISO AI management · ISO/IEC 42001 Clauses 7–10 and Annex A Controls

Why is 'competence' under Clause 7 relevant specifically to people operating AI systems, not just general staff training?

Competence under Clause 7 only concerns senior leadershipAI-specific competence has no bearing on control effectivenessCompetence requirements are identical regardless of rolePeople need AI-specific understanding (e.g. of limitations, bias, oversight practices) to operate systems and controls effectively

WEEK 16 · ISO AI management · ISO/IEC 42001 Clauses 7–10 and Annex A Controls

Clause 7 (Support) primarily covers:

Resources, competence, awareness, communication and documented informationOnly IT infrastructureExternal auditsFinancial reporting

WEEK 16 · ISO AI management · ISO/IEC 42001 Clauses 7–10 and Annex A Controls

Which best reflects how 'control maturity' typically progresses across stages such as initial, developing, defined, managed and optimising?

Maturity always starts at 'optimising' and decreases over timeMaturity stages only apply to financial controls, not AI controlsMaturity has no defined stages and is purely subjectiveIt generally progresses from ad hoc, undocumented practice toward consistent, evidenced, continuously improved operation

WEEK 16 · ISO AI management · ISO/IEC 42001 Clauses 7–10 and Annex A Controls

Which is a practical example of 'documented information' required under Clause 7 for an operating AI system?

Documented information is not actually required under Clause 7A verbal agreement with no written recordA recorded risk assessment, control evidence log, or training record that can be inspected laterOnly the original sales brochure from the AI vendor

WEEK 16 · ISO AI management · ISO/IEC 42001 Clauses 7–10 and Annex A Controls

What is the purpose of 'monitoring' under Clause 9, distinct from a one-off pre-launch test?

Monitoring replaces the need for internal audit entirelyThere is no distinct purpose — one test is sufficient foreverMonitoring tracks ongoing performance and risk indicators after launch, catching issues that only emerge over time (like drift)Monitoring only applies before a system goes live

WEEK 16 · ISO AI management · ISO/IEC 42001 Clauses 7–10 and Annex A Controls

Relying entirely on a supplier's unverified claim of 'no bias' is a gap in which Annex A theme?

Customer relationshipsThird-party relationshipsResources for AI systemsAI policies