PECB ISO-IEC-42001-Lead-Auditor Exam With Confidence Using Practice Dumps

How frequently should surveillance audits be conducted?

Scenario 8:

Scenario 8: InnovateSoft, headquartered in Berlin, Germany, is a software development company known for its innovative solutions and commitment to excellence. It specializes in custom software solutions, development, design, testing, maintenance, and consulting, covering both mobile apps and web development. Recently, the company underwent an audit to evaluate the effectiveness and

compliance of its artificial intelligence management system AIMS against ISO/IEC 42001.

The audit team engaged with the auditee to discuss their findings and observations during the audit's final phases. After evaluating the evidence, the audit team presented their audit findings to InnovateSoft, highlighting the identified nonconformities.

Upon receiving the audit findings, InnovateSoft accepted the conclusions but expressed concerns about some findings inaccurately reflecting the efficiency of their software development processes. In response, the company provided new evidence and additional information to alter the audit conclusions for a couple of minor nonconformities identified. After thorough consideration, the audit team leader clarified that the new evidence did not significantly alter the core conclusions drawn for the nonconformities. Therefore, the certification body issued a certification recommendation conditional upon the filing of corrective action plans without a prior visit.

InnovateSoft accepted the decision of the certification body. The top management of the company also sought suggestions from the audit team on resolving the identified nonconformities. The audit team leader offered solutions to address the issues, fostering a collaborative effort between the auditors and InnovateSoft. During the closing meeting, the audit team covered key topics to enhance transparency. They clarified to InnovateSoft that the audit evidence was based on a sample, acknowledging the inherent uncertainty. The method and time frame of reporting and grading findings were discussed to provide a structured overview of nonconformities. The certification body's process for handling nonconformities, including potential consequences, guided InnovateSoft on corrective actions. The time frame for presenting a plan for correction was

communicated, emphasizing urgency. Insights into the certification body’s post-audit activities were provided, ensuring ongoing support.

Lastly, the audit team briefed InnovateSoft on complaint and appeal handling.

InnovateSoft submitted the action plans for each nonconformity separately, describing only the detected issues and the corrective actions planned to address the detected nonconformities. However, the submission slightly exceeded the specified period of 45 days set by the certification body, arriving three days later. InnovateSoft explained this by attributing the delay to unexpected challenges encountered during the compilation of the action plans.

Question:

Was the audit team leader’s attitude appropriate regarding the new evidence provided by the company?

The certification body did not include all departments covered by the AIMS scope in the audit scope. Is this acceptable? Refer to Scenario 5.

Scenario 5: Alterhealth is a mid-sized technology firm based in Toronto. Canada. It develops Al systems for healthcare providers, focusing on improving patient care,

optimizing hospital workflows, and analyzing healthcare data for insights that can improve health outcomes. To ensure responsible and effective use of Al in its

operations, Alterhealth has implemented an artificial intelligence management system AIMS based on ISO/IEC 42001. After a year of having the AIMS in place, the

company decided to apply for a certification audit to obtain certification against ISO/IEC 42001.

The company contracted a certification body to conduct the audit, who assembled the audit team and appointed the audit team leader. The audit team leader had

conducted a certification audit at Alterhealth in the past. The top management of Alterhealth decided to reject the appointment of this auditor because they believed

that they would not receive added value from the audit. In response, the certification body appointed Jonathan, an independent auditor with no prior engagements with

Alterhealth, as the new audit team leader. Jonathan's introduction marked the beginning of a collaborative process aimed at evaluating the conformity of the AIMS to

ISO/IEC 42001 requirements.

The certification body determined the audit scope, which included only specific departments essential to the integration and application of Al, such as the Al Research,

Machine Learning Applications, and Al Ethics and Compliance Departments, and did not cover all of the departments covered by the AIMS scope. Meanwhile,

Alterhealth determined the audit time, setting the necessary time frame for planning and conducting a thorough and effective review to ensure all aspects of the AIMS

within the selected departments were meticulously reviewed.

Afterward, Jonathan received a detailed offer from the certification body, outlining his role and including information related to the audit, such as the audit's duration,

team members, their responsibilities, the limits to the audit engagement, and their salary compensation. With a clear mandate, Jonathan was tasked with a multitude

of responsibilities: defining the audit objectives and criteria, planning the audit process, identifying and addressing audit risks, managing communication with

Alterhealth, overseeing the audit team, and ensuring a smooth and conflict free execution.

With Jonathan's leadership and a well-defined audit framework in place, the certification audit proceeded with a structured and objective evaluation of Alterhealth's

AIMS.