Module 13 self-check | AI GRCA Practitioner Programme

What is the risk of an organisation writing an AI policy that simply copies another company's publicly available policy verbatim?

It likely won't reflect the organisation's actual context, risks and AI use, undermining its usefulness and its Clause 5 intentThis is explicitly recommended by the standardVerbatim copying guarantees certification successNo risk — policies are meant to be generic

How should an organisation treat a nonconformity discovered during a management review?

Immediately decertify itselfNonconformities found internally don't need any actionIgnore it until the next external auditAddress it through correction and, where needed, root-cause corrective action, consistent with Clause 10

What does 'AIMS' stand for and mean?

AI Management System — a structured, repeatable way to govern AI responsiblyAutomated Inference Monitoring ServiceA synonym for a risk registerAI Marketing System

What does 'Clause 4 to 10 overview' most usefully give a first-time reader of ISO/IEC 42001?

A legal history of the standardA mental map of how the requirements flow from context-setting through to continual improvementA list of every possible AI riskA pricing guide for certification

What is the role of internal audit within an AIMS?

To replace management's own responsibility for AI riskTo independently check whether the AIMS is being followed and is effective, feeding into management reviewIt's optional and rarely relevantIt only applies once certification has been achieved

Which best reflects the relationship between leadership commitment (Clause 5) and Annex A control selection?

Leadership commitment sets the direction and resourcing that makes meaningful Annex A control selection and operation possibleAnnex A controls are selected before any leadership involvementLeadership has no role in control selectionThey are entirely unrelated activities

What is the practical risk of treating 42001 implementation as a one-off project rather than an ongoing system?

The AIMS becomes outdated and disconnected from how AI is actually being used as the organisation's AI footprint growsOne-off projects are explicitly required by Clause 10This approach is what the standard recommendsNo risk — a one-off effort is equally effective

What's the difference between certification and implementation?

Implementation is building the AIMS practices; certification is an optional external verification against the standardCertification must happen before any implementation workCertification guarantees fair AI outcomesThey're identical

ISO/IEC 42001 Foundations