During the annual ISO/IEC 42001 audit at a financial company, the auditor selected and analyzed a sample of 5 out of 25 follow-up nonconformity reports to assess whether the company adheres to its follow-up process. What type of evidence did the auditor gather?

What precautions must the certification body take when conducting short-notice audits?

According to the core element of 'Privacy and Security,' what is essential when developing AI systems?

What certification recommendation did the auditee receive?

Scenario 8: VeridicAI. based in San Francisco. USA, specializes in market research using Al technologies to analyze customer behavior. Founded in 2023, the company

employs natural language processing, machine learning, and predictive analytics to provide real time insights to a range of businesses. VeridicAI has implemented an

artificial intelligence management system AIMS based on ISO/IEC 42001 to manage its Al technologies effectively. The AIMS scope includes select departments within

the company, for which it has received a four-year certification against ISO/IEC 42001. Committed to transparency. VeridicAI publicly shares details of this certification.

As the certification nears its end, VeridicAI is preparing for an audit to renew its certification.

The audit process was led by Sharona, the audit team leader, who is a full-time employee of the certification body. Sharona and the audit team undertook all planned

audit activities. Afterward, they organized the closing meeting with VeridicAl's management. During the meeting, Sharona and the team made a recap on audit

objectives and scope, presented the audit findings and conclusions, presented identified nonconformities, and organized a session for questions and answers for the

auditee.

VeridicAI received a conditional recommendation for certification, underscoring its compliance with the industry's standards. Sharona confirmed that the company met

the essential requirements but noted some identified minor nonconformities. In response, VeridicAI compiled and submitted a comprehensive action plan that

addresses all identified nonconformities within a designated timeframe. Because of the comprehensive action plan, Sharona did not see the need for an additional on-

site visit to verify the effectiveness of the action plan.

Sharona played an integral role in the certification decision process. Her thorough understanding of VeridicAI's operations, gained from the audit, guided the

certification body towards a well-informed certification decision.

What type of audit evidence did Augustine gather when he collected management review records? Refer to scenario 3.

Scenario 3: Heala specializes in developing Al-driven solutions for the healthcare sector. With a keen focus on leveraging Al to revolutionize patient care, diagnostics,

and treatment planning, the company has implemented an artificial intelligence management system AIMS based on ISO/IEC 42001. After a year of having the AIMS in

place, the company decided to apply for a certification audit.

It contracted a local certification body, who established the audit team and assigned the audit team leader. Augustine, the designated audit team leader, has a wide

range of skills relevant to various auditing domains. His proficiency encompasses audit principles, processes, and methods, as well as standards for management

systems and additional references. Furthermore, he is knowledgeable about the Heala’s context and relevant statutory and regulatory requirements.

Augustine first gathered management review records, interested party feedback logs, and revision histories for Heala ' s AIMS. This crucial step laid the groundwork for

a deeper investigation, which included conducting comprehensive interviews with key personnel to understand how feedback from interested parties directly

influenced updates to the AIMS and its strategic direction. Augustine ' s thorough evaluation process aimed to verify Heala ' s commitment to integrating the needs and

expectations of interested parties, a critical requirement of ISO/IEC 42001.

Augustine also integrated a sophisticated Al tool to analyze large datasets for patterns and anomalies, and thus have a more informed and data driven audit process.

This Al solution, known for its ability to sift through vast amounts of data with unparalleled speed and accuracy, enabled Augustine to identify irregularities and trends

that would have been nearly impossible to detect through manual methods. The tool was also helpful in preparing hypotheses based on data.

During the audit. Augustine failed to fully consider Heala’s critical processes, expectations, the complexity of audit tasks, and necessary resources beforehand. This

oversight compromised the audit integrity and reliability, reflecting a significant deviation from the diligence and informed judgment expected of auditors.

Scenario 7:

Scenario 7: ICure, headquartered in Bratislava, is a medical institution known for its use of the latest technologies in medical practices. It has introduced groundbreaking Al-driven diagnostics and treatment planning tools that have fundamentally transformed patient care.

ICure has integrated a robust artificial intelligence management system AIMS to manage its Al systems effectively. This holistic management framework ensures that ICure ' s Al applications are not only developed but also deployed and maintained to adhere to the

highest industry standards, thereby enhancing efficiency and reliability.

ICure has initiated a comprehensive auditing process to validate its AIMS ' s effectiveness in alignment with ISO/IEC 42001. The stage 1 audit involved an on-site evaluation by the audit team. The team evaluated the site-specific conditions, interacted with ICure ' s personnel,

observed the deployed technologies, and reviewed the operations that support the AIMS. Following these observations, the findings were documented and communicated to ICure. setting the stage for subsequent actions.

Unforeseen delays and resource allocation issues introduced a significant gap between the completion of stage 1 and the onset of stage 2 audits. This interval, while unplanned, provided an opportunity for reflection and preparation for upcoming challenges.

After four months, the audit team initiated the stage 2 audit. They evaluated AIMS ' s compliance with ISO/IEC 42001 requirements, paying special attention to the complexity of processes and their documentation. It was during this phase that a critical observation was made:

ICure had not fully considered the complexity of its processes and their interactions when determining the extent of documented information. Essential processes related to Al model training, validation, and deployment were not documented accurately, hindering effective control and management of these critical activities. This issue was recorded as a minor nonconformity, signaling a need for enhanced control and management of these vital activities.

Simultaneously, the auditor evaluated the appropriateness and effectiveness of the " AIMS Insight Strategy, " a procedure developed by

ICure to determine the AIMS internal and external challenges. This examination identified specific areas for improvement, particularly in

the way stakeholder input was integrated into the system. It highlighted how this could significantly enhance the contribution of relevant

parties in strengthening the system ' s resilience and effectiveness.

The audit team determined the audit findings by taking into consideration the requirements of ICure, the previous audit records and

conclusions, the accuracy, sufficiency, and appropriateness of evidence, the extent to which planned audit activities are realized and

planned results achieved, the sample size, and the categorization of the audit findings. The audit team decided to first record all the

requirements met; then they proceeded to record the nonconformities.

Based on the scenario above, answer the following question:

Question:

Which phase of the Stage 1 audit was NOT conducted by the audit team?

Which core element of AIMS is defined as: “Organizations are responsible for the development, deployment, and use of AI systems, and their potential impacts”?