Module 12 self-check | AI GRCA Practitioner Programme

Which of these questions is best answered using ISO/IEC 42005 rather than 42001?

'What does our internal audit programme look like?''How do we handle nonconformities under Clause 10?''Who has authority to approve our AI policy?''What adverse effects could this system have on tenants with limited English proficiency?'

How does ISO/IEC 42005 relate to NIST AI RMF's MAP function?

42005 replaces MAP entirelyMAP is a certifiable standard like 42005They are unrelatedBoth involve understanding context and impacts on affected people, though structured differently

What does 'AI actor' terminology, as covered under 22989-style vocabulary, help clarify?

Only who owns the intellectual propertyOnly the identity of the end customerNothing useful for governanceWho is responsible at each stage — developer, provider, deployer, user, affected person — reducing accountability confusion

What is a 'management system' in the ISO sense, as distinct from a single policy document?

A one-time audit checklistA synonym for a policyA structured, repeatable set of interrelated processes an organisation uses to achieve objectives and manage risk, including planning, operation, evaluation and improvementOnly the software used to track compliance

Why do ISO AI standards matter to a practitioner, beyond academic interest?

They have no practical useThey give a shared vocabulary, a governance-system structure and an impact-assessment method that make AI governance consistent and auditableThey are only relevant to software engineersThey replace the need for any legal analysis

Why does 'how ISO 42001 supports governance system design' matter for a multi-site organisation?

It provides a common structure so different sites or business units can be governed consistently rather than ad hocIt only applies to single-site organisationsIt replaces the need for site-level ownershipIt doesn't — every site should govern independently with no shared structure

A company documents its AIMS scope, policy and objectives but has never run an impact assessment on any deployed system. Which standard's practice is missing?

None — impact assessment isn't part of any of these standardsISO/IEC 22989ISO/IEC 42001ISO/IEC 42005

How do the three standards relate to each other?

42005 replaces the other two42001 is only a glossaryThey are unrelated22989 gives shared terminology, 42001 is the management-system structure, 42005 gives impact-assessment guidance within it

ISO AI Standards: ISO/IEC 22989, ISO/IEC 42001 and ISO/IEC 42005