ISO/IEC 42001 Lead Implementer

Ten sample exam questions

One per competency domain, exactly as they appear in the simulator.

1. D6 Continual improvement and preparation for certification

   Meridale Foods, a Belgian food manufacturer, completed the implementation of its AIMS for a demand-forecasting system in January: its documented information, including the Statement of Applicability and the approved risk treatment plan, is in place and its controls have been operating since then. The certification body has offered a stage 1 date in three weeks. The first full internal audit is scheduled in two months, with the management review to follow. The project director wants to accept the date to save time. What should the AIMS manager advise?

   1. Accept the date, as stage 1 reviews the design, and hold the audit and review before stage 2
   2. Accept the date and send the approved documentation to the auditor in advance
   3. Postpone stage 1 until the risk treatment plan is approved and its residual risks accepted
   4. Move stage 1 back until the internal audit and the management review have been held

2. D5 Monitoring and measurement of an AIMS

   Rostra Insurance publishes drift metrics for its motor pricing model to a dashboard every night. Its monitoring procedure defines the metrics, the methods for measuring and analysing drift and the nightly frequency, but names no point at which results are reviewed, and nobody has looked at the dashboard for three months. The data lead proposes switching to hourly measurement so that drift is caught sooner. Which determination required by clause 9.1 is missing?

   1. What needs to be monitored and measured
   2. The methods for monitoring, measurement, analysis and evaluation
   3. When the monitoring and measuring shall be performed
   4. When the results shall be analysed and evaluated

3. D1 Fundamental principles and concepts of an AIMS

   An engineering team at Varkas Components is designing a neural network to sort greyscale photographs of machined parts, each 32 by 32 pixels, into three defect types. The photographs will be fed to the network as raw pixel values. An intern proposes an input layer of three neurons, one per defect type, so that the network starts from what it must recognize. How many neurons should the input layer have?

   1. Three, one for each defect type the network has to recognize
   2. 32, one for each row of pixels in the photographs
   3. 64, that is, one for each row and one for each column of the photographs
   4. 1,024, one for each pixel value in the photographs

4. D3 Planning of an AIMS implementation

   Lumeo Analytics records applicability in its Statement of Applicability separately for each of its two AI systems: a document summarizer built on a model licensed from a third party, and a fraud-detection model developed and hosted in-house. Its risk assessment concluded that the supplier control A.10.3 of ISO/IEC 42001 is needed for the summarizer alone. The AIMS manager wants to mark A.10.3 as applicable to both systems, arguing that controls should be applied uniformly across the AIMS. How should A.10.3 be recorded?

   1. Applicable to the summarizer, with its exclusion for the fraud model justified
   2. Applicable to both, with the inclusion justified by the summarizer's supplier risk
   3. For the summarizer now, and for the fraud model from its next major release onwards
   4. Excluded for both, with the summarizer's supplier risk handled through procurement

5. D4 Implementation of an AIMS

   At Fenwick Telecom, concerns about AI systems are reported through a form that is promoted in the quarterly staff newsletter and handled by a trained ethics officer with powers to investigate and to escalate to the board. The form requires a login with the employee number and copies each report to the reporter's line manager. In six months it has received a single report. The compliance officer wants identification to stay mandatory so that investigators can ask follow-up questions. What does the mechanism still need?

   1. Options for confidential or anonymous reports, with protection from reprisals
   2. Qualified staff with clear powers to investigate and resolve reports
   3. Assurance that line managers will treat each report in confidence and without reprisals
   4. A written policy giving the ethics officer power to escalate reports to the board

6. D2 Artificial intelligence management system

   The board of Bramley Construction, which already runs an AIMS, wants a certificate issued by an accredited certification body for its anti-bribery management. The risk manager proposes building the anti-bribery system on ISO 31000, since the company already uses that standard for enterprise risk management. Which standard should the anti-bribery system be built on?

   1. ISO 31000
   2. ISO 26000
   3. ISO 19011
   4. ISO 37001

7. D6 Continual improvement and preparation for certification

   Case study 1 - Talvora Recruit (5 questions) Talvora Recruit, a Toronto software company with 180 staff, sells CV screening and candidate ranking to EU employers and is preparing for ISO/IEC 42001 certification. In March, an internal audit raised two nonconformities: bias tests required before each model release had been skipped for the last two releases, and human-review records were missing for 9% of rejected candidates. The AI quality lead, Priya Natesan, re-ran the bias tests on the live model that week, recorded a pass and closed the first nonconformity. For the second, a workshop chaired by the CTO, Marc Delorme, listed eleven possible causes and voted reviewer workload as the root cause; the draft action plan is built on that vote. In April, the association representing most clients issued contract clauses, applying from July renewals, requiring suppliers to log every manual override of a ranking; the head of sales, Kofi Mensah, suggests adding this to the November management review. Talvora targets stage 1 in May and stage 2 in June. The compliance manager, Hugo Brandt, wants stage 1 to confirm that the bias controls operate effectively so that stage 2 can be shorter. Three accredited bodies have bid: the CEO, Amelie Roy, prefers the cheapest, which has no clients in HR technology, while another already certifies two recruitment platforms subject to the EU high-risk rules. Question 1 of 5: Besides re-running the tests, Priya Natesan had the candidates ranked by the two untested releases screened again. She considers the first nonconformity dealt with. What should happen to it?

   1. Leave it closed, as the effect has been corrected and its consequences dealt with
   2. Reopen it to establish why the tests were skipped and whether other models are affected
   3. Reopen the case to review the candidates ranked by the two releases that skipped the tests
   4. Reopen it, log the re-run as a correction and verify at the next two releases that tests run

8. D5 Monitoring and measurement of an AIMS

   Brightwell Software, a 120-person firm, has an annual management review of its AIMS planned and documented in the AIMS calendar, and the last review covered every required input. A newly hired consultant insists that the review must move to a quarterly cycle because clause 9.3 of ISO/IEC 42001 requires it. How should the consultant's claim be assessed?

   1. Move to quarterly reviews, the cycle most certification auditors expect to see
   2. The annual review conforms, provided the certification body accepts the interval
   3. A quarterly cycle is needed so that the intervals match the internal audit programme
   4. The annual review conforms, as the standard leaves the interval to the organization

9. D1 Fundamental principles and concepts of an AIMS

   A research consortium describes the goal of its proposal as a system that would handle logistics planning, legal drafting and medical diagnosis with a satisfactory level of performance, and learn new domains without anyone retraining it. The proposal says nothing about the system having a sense of itself or internal states. A reviewer labels it self-aware AI because it would act without human intervention. Which type of AI does the proposal describe?

   1. Narrow AI
   2. Limited memory AI
   3. Self-aware AI
   4. General AI

10. D3 Planning of an AIMS implementation

    Two months ago the board of Calloway Retail approved a matrix assigning AIMS responsibilities and authorities, including who reports on AIMS performance to top management. The matrix appears only in the board minutes, and the department heads named in it have not seen it. The compliance officer proposes first expanding it into a detailed RACI chart for every control so that an incomplete version is not circulated. What should be done next?

    1. Expand the matrix into a RACI chart per Annex A control before it is circulated
    2. Communicate the approved matrix to the department heads and the others it assigns roles to
    3. Brief the department heads on the matrix once it has been placed under document control
    4. Add to the matrix who reports on AIMS performance to top management, then circulate it

Answer these same ten questions in the simulator and see the explanation of every option, including the wrong ones. It opens with no sign-up →

About the official exam: its format, duration and number of questions are set by the certification body and may change, so confirm them in its documentation before you sit it. This material trains the standard, not one body's exam, so it is just as useful if you certify elsewhere.