GAICC ISO/IEC 42001 Foundation ISO-IEC-42001-Foundation Exam Questions

Page: 1 / 14
Total 40 questions

Want more questions? Get Premium Access.
()

Question 1

During a Foundation classroom exercise, learners are asked to sort four short documents into the categories defined by ISO/IEC 42001. One document is a one-page statement signed by the chief executive that sets direction for responsible AI use, commits to applicable requirements, and commits to continual improvement of the AIMS. Three other documents describe controls, model training procedures, and an incident log. Which categorisation of the signed one-page statement is BEST aligned with Clause 5.2?

AIt is an Annex A control implementation record, since it describes how the organisation intends to apply selected controls drawn from the Annex A reference set during the operational phase of the management system.

BIt is an AI system impact assessment summary, because it sets out the organisation's intended position on responsible AI use at a level that informs the impact-assessment scoring rubric for individual systems.

CIt is the AI policy required by Clause 5.2, because top management has documented direction for AI, set a framework for objectives, and committed to satisfying applicable requirements and to continual improvement.

DIt is a management-review output captured under Clause 9.3, since the chief executive has signed it and the document expresses commitments at a strategic level appropriate to a periodic review of the management system.

Answer : C

The signed executive document fulfills all core statutory requirements specified in ISO/IEC 42001 Clause 5.2 (AI Policy). Under Clause 5.2, top management must establish an AI policy that is appropriate to the purpose of the organization, provides a framework for setting AI objectives, includes a commitment to satisfy applicable requirements, and includes a commitment to continual improvement of the AIMS. A formal policy is an overarching governance instrument demonstrating leadership intent, unlike operational procedures (which govern algorithmic training, testing, or incident response), impact assessments (which analyze discrete systems), or control implementation records (which document technical mitigations). Furthermore, while management review minutes (Clause 9.3) contain strategic decisions and resource actions, the baseline governance commitments defined here represent the foundational policy instrument itself.

===============

Question 2

A compliance manager is preparing a slide for the leadership team to explain the difference between accreditation and certification in the ISO/IEC 42001 ecosystem. She wants a one-sentence working definition of an accreditation body that aligns with GAICC Foundation Module 2. Which option is the BEST fit?

AAn accreditation body is an authoritative third party that assesses and formally recognises the competence of certification bodies to audit against standards such as ISO/IEC 42001.

BAn accreditation body is the consulting firm engaged by an organisation to help draft its AI policy, conduct gap analyses, and prepare evidence packs for a Stage 1 audit.

CAn accreditation body is the internal audit function within an organisation that reviews the AIMS against ISO/IEC 42001 before any external certification audit is conducted.

DAn accreditation body is the publisher of an ISO standard, responsible for drafting the requirements text, maintaining revisions, and updating the harmonised structure terms.

Answer : A

In the global conformity assessment hierarchy governed by the International Accreditation Forum (IAF) and ISO/IEC 17011, there is a distinct structural separation between certification and accreditation. Organizations seeking to validate their AIMS undergo a certification audit performed by a Certification Body (Conformity Assessment Body). In turn, the competence, impartiality, and procedural integrity of the Certification Body are evaluated, formally approved, and surveilled by an authoritative Accreditation Body (such as UKAS in the UK, ANAB in the United States, or DAkkS in Germany). Accreditation acts as the authoritative mechanism that validates certification bodies, ensuring mutual recognition of ISO/IEC 42001 certificates across global jurisdictions. Accreditation bodies do not provide consulting services, conduct internal enterprise audits, or author the underlying international standards (which is the purview of ISO/IEC JTC 1/SC 42).

===============

Question 3

+-----------------------------------------------------------------------------------------------+

| Choosduct manager responsible for the deployed AI system, since they direct day-to- |

| day operations and have the most direct view of AI model behaviour and incidents. |

+-----------------------------------------------------------------------------------------------+

A compliance team is mapping ISO/IEC 42001 Clause 3 terms to everyday business language for an internal onboarding wiki. They are debating who counts as 'top management' under the standard, because the term governs which roles inherit Clause 5.1 leadership duties. According to GAICC Foundation Module 3, which option BEST reflects the Clause 3 definition of top management?

AAny line manager with budget authority over an AI initiative, since top management refers to the manager who funds the AI project rather than to enterprise leadership.

BThe third-party certification body's lead auditor, since the auditor exercises decisive authority over whether the AIMS satisfies ISO/IEC 42001 during a Stage 2 audit.

CThe person or group of people who directs and controls an organisation at the highest level and has the authority to delegate and provide resources within it.

DThe product manager responsible for the deployed AI system, since they direct day-to-day operations and have the most direct view of AI model behaviour and incidents.

Answer : C

In alignment with the standardized Harmonized Structure across all ISO management system frameworks, Clause 3 of ISO/IEC 42001 defines 'top management' verbatim as the 'person or group of people who directs and controls an organization at the highest level.' Top management possesses enterprise-wide executive authority to allocate corporate capital, assign operational resources, delegate organizational responsibilities, and enforce strategic accountability across all operating units. In corporate practice, this typically denotes the Board of Directors, Chief Executive Officer, C-suite executives, or the executive leadership team. While technical product managers and engineering directors oversee operational model execution, they do not direct the enterprise at the highest level. External certification auditors are independent third-party assessors who hold zero organizational governance authority. Correctly identifying top management is crucial, as this group is directly accountable for Clause 5.1 leadership obligations and Clause 9.3 management reviews.

===============

Question 4

A regional hospital network is starting its ISO/IEC 42001 journey. The chief medical officer wants the AIMS scope to cover the radiology-triage AI in current use, on the basis that no other AI is deployed yet. The chief information officer has identified two more AI tools planned for rollout in the next six months: an admissions-forecasting model and a clinical-coding assistant. How should the AIMS scope be framed at the outset, consistent with Clause 4 of ISO/IEC 42001?

ADefine the AIMS scope to reflect the organisation's planned AI footprint, including the radiology triage tool in use plus the two near-term planned tools, and document the rationale so the scope boundaries are explicit and defensible.

BRestrict the AIMS scope to the radiology triage tool in use today, on the basis that planned systems may be cancelled, and revisit the scope question after the planned tools have been live in production for an extended observation period.

CAdopt an open-ended scope statement that covers any AI the hospital may deploy at any point in the future, without listing specific systems, on the grounds that a broad scope avoids the need for frequent scope-change documentation.

DDefer the scope decision until after the two planned tools are live, and operate the AIMS informally in the interim, since a formal scope decision before deployment risks creating obligations the hospital is not yet ready to discharge under the management system.

Answer : A

Clause 4.3 (Determining the scope of the AI management system) requires an organization to establish the boundaries and applicability of the AIMS by considering the external and internal issues identified in Clause 4.1, the requirements of interested parties determined in Clause 4.2, and the full lifecycle of activities, products, and services within its purview. In an operational enterprise where near-term deployments are actively in development or scheduled for release within the business cycle, framing the scope around both active and near-term scheduled implementations ensures that risk assessments, design controls, and AI system impact assessments are applied before production deployment. A scope restricted artificially to a single active algorithm risks leaving subsequent pipeline deployments ungoverned by management system controls. Conversely, vague and open-ended scoping statements that do not delineate system boundaries or organizational interfaces fail audit scrutiny. Formally documenting the planned footprint and providing clear, defensible boundaries satisfies the expectations of Clause 4.3 and allows the organization to build proactive compliance pathways across the development lifecycle.

===============

Question 5

A mid-sized SaaS company has implemented its AIMS and now wants to obtain certification against ISO/IEC 42001. The CISO asks which standard governs the bodies that will conduct the external certification audit, so she can check the credentials of the shortlisted firms. Which standard is the right reference?

AISO/IEC 22989, which provides AI vocabulary and concepts and is the normative reference cited inside ISO/IEC 42001 for terminology used during audits.

BISO/IEC 17021-1, which sets requirements for bodies providing audit and certification of management systems and applies to ISO/IEC 42001 certification bodies.

CISO/IEC 27001, which sets requirements for information security management systems and is widely used by SaaS vendors that also pursue ISO/IEC 42001.

DISO/IEC 38507, which sets governance implications of AI use for governing bodies and supports board-level oversight in organisations adopting ISO/IEC 42001.

Answer : B

Conformity assessment bodies (CABs) that evaluate organizations for certification against management system standards must themselves satisfy the stringent competence and operational criteria set out in ISO/IEC 17021-1 (Conformity assessment --- Requirements for bodies providing audit and certification of management systems). ISO/IEC 17021-1 establishes the global benchmark for impartiality, audit methodology, auditor qualifications, and quality control that certification bodies must demonstrate to national accreditation bodies (such as UKAS, ANAB, or DAkkS). While ISO/IEC 22989 is the foundational terminology standard and ISO/IEC 38507 provides corporate governance guidance for boards, neither standard governs the operations of third-party certification bodies. Checking that a certification body holds accreditation under ISO/IEC 17021-1 ensures that the resulting certificate is credible, verifiable, and internationally recognized.

===============

Question 6

A start-up founder argues that ISO/IEC 42001 is irrelevant to her company because it neither develops AI models nor sells AI products---it merely uses a third-party generative AI assistant to draft customer support replies. The compliance lead disagrees and points to the standard's scope as described in the GAICC Foundation materials. Which statement BEST captures who ISO/IEC 42001 is intended for?

AOrganisations that build and train their own AI models from scratch, since the standard targets AI developers rather than downstream users of third-party vendor tools.

BAny organisation that develops, provides, or uses AI systems, irrespective of size, sector, or AI maturity, including those that consume AI through third-party tools.

CPublic-sector bodies subject to AI legislation, since voluntary management system standards are intended for regulated entities rather than commercial start-ups.

DEnterprises above a defined revenue threshold, since the cost and complexity of an AI management system is disproportionate for smaller firms or early-stage start-ups.

Answer : B

Clause 1 (Scope) of ISO/IEC 42001 specifies that the standard is universally applicable to any organization, regardless of its size, nature, sector, or operational maturity, that develops, provides, or uses products or services that utilize artificial intelligence systems. The standard explicitly rejects the premise that AI governance is exclusively relevant to foundational frontier model builders or commercial software vendors. Downstream deployers and end-users of third-party commercial tools---such as enterprises leveraging third-party large language models for customer engagement---introduce operational, legal, privacy, and reputational risks into their operational environments. Consequently, organizations acting purely as AI users must establish governance oversight over tool selection, acceptable use policies, prompt data confidentiality, operational monitoring, and vendor relationship controls governed under Annex A (specifically domain A.9). The standard's requirements are scalable and proportionate to organizational context and risk exposure rather than headcount or development footprint.

===============

Question 7

A board director asks: 'Why should we invest in ISO/IEC 42001 certification rather than simply publishing an internal AI ethics statement?' The Chief AI Officer responds by listing the drivers that motivated publication of the standard. Which option BEST summarises the main drivers behind ISO/IEC 42001 as presented in GAICC Foundation Module 1?

APressure from professional indemnity insurers, who require ISO/IEC 42001 certification as a precondition for issuing technology errors-and-omissions policies to AI software vendors worldwide.

BA directive from the International Telecommunication Union requiring each member state to publish a national AI register before the end of 2026, with a binding regional reporting cycle.

CConverging regulatory, commercial, reputational, and operational pressures around AI---including new AI laws, procurement scrutiny, public AI failures, and consequential AI decisions.

DA specific request from the World Trade Organization to harmonise tariff treatment for AI-enabled goods and services across the major trading blocs by the end of the year 2026.

Answer : C

The inception and rapid global adoption of ISO/IEC 42001 are driven by the intersection of four critical operational forces: evolving legal compliance (such as the EU AI Act and emerging national frameworks), rigorous commercial procurement diligence, acute reputational risks stemming from publicized model failures, and the expanding delegation of high-stakes, consequential decisions to autonomous systems. Informal corporate AI ethics statements lack enforceable verification, audit mechanisms, and systematic lifecycle controls, often inviting accusations of 'ethics washing.' In contrast, ISO/IEC 42001 addresses these mounting industry pressures by codifying an internationally auditable standard. Organizations implement the standard to prove governance rigor to enterprise buyers, withstand regulatory audits, prevent systemic operational harms, and safeguard enterprise reputation through documented, verifiable conformity.

===============