Free PECB Certified ISO/IEC 42001 Lead Auditor Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB Certified ISO/IEC 42001 Lead Auditor practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An organization wants independent recognition that its certification body operates according to international standards. Which body provides that recognition?

   1. A.An accreditation bodyCorrect answer: A
   2. B.The certified organization
   3. C.The certification body itself
   4. D.The standards development body

   Explanation: ISO states: "Accreditation – the formal recognition by an independent body, generally known as an accreditation body, that a certification body operates according to international standards." The recognition is provided by an accreditation body.

   Reference: ISO Certification — Certification, accreditation definition

2. 2A deployed AI system continues to learn and changes its behavior during use. What consideration does ISO/IEC 42001 highlight?

   1. A.Use the initial design assessment as the basis for all later behavior.
   2. B.Review whether changing behavior continues to support responsible use.Correct answer: B
   3. C.Treat the initial training dataset as the sole ongoing governance concern.
   4. D.Evaluate responsible use at release without revisiting subsequent changes.

   Explanation: ISO/IEC 42001 states: "AI systems that perform continuous learning change their behaviour during use. They require special consideration to ensure their responsible use continues with changing behaviour." Continual learning can alter behavior after deployment.

   Reference: ISO/IEC 42001:2023 Artificial intelligence — Management system — Introduction

3. 3An organization hires an external auditor to conduct its own internal AIMS audit on its behalf. What type of audit is this?

   1. A.Second-party audit
   2. B.First-party auditCorrect answer: B
   3. C.Third-party certification audit
   4. D.Regulatory audit

   Explanation: ISO 19011 explains: "Internal audits, sometimes called first-party audits, are conducted by, or on behalf of, the organization itself." The external individual acts on behalf of the organization for its internal audit.

   Reference: ISO 19011:2026 Guidelines for auditing management systems — Clause 3.1, note 1

4. 4An audit team lacks specialized knowledge about an AI system. How can a technical expert help the team?

   1. A.Provide specialized knowledge while directing auditors without their supervision
   2. B.Review technical matters and take responsibility for the entire audit
   3. C.Supply specialized knowledge while deciding the audit findings independently
   4. D.Supplement the team's knowledge under an auditor's supervisionCorrect answer: D

   Explanation: The guidance states: "The knowledge and skills of an audit team may need to be supplemented by that of technical experts (under the supervision of an auditor), in order to meet the audit objectives." The expert supplements the team to help meet its objectives.

   Reference: ISO 9001 Auditing Practices Group: Technical Experts — Technical Experts, introduction

5. 5During the initial stage 1 certification audit, what is a primary purpose of understanding the organization and its management system?

   1. A.Plan stage 2 and assess the organization's readinessCorrect answer: A
   2. B.Assess continuing conformity through periodic surveillance audits
   3. C.Evaluate implementation and effectiveness during the stage 2 audit
   4. D.Determine the scope and readiness of a future recertification audit

   Explanation: The guidance states: "This 1st stage is primarily for scoping and planning the subsequent part of the certification audit (Stage 2) and to allow an auditor to obtain an understanding of the organization and to evaluate if that organization is ready for certification." Stage 1 informs the scope and planning of stage 2.

   Reference: ISO 9001 Auditing Practices Group: Two stage initial certification audit — Two stage initial certification audit, introduction

6. 6An organization proposes an action plan after an audit nonconformity. What should the auditor review before accepting the response?

   1. A.Evidence of correction and cause analysis without evidence of corrective action
   2. B.Evidence of cause analysis and corrective action without evidence of correction
   3. C.Appropriate evidence of correction, cause analysis and corrective actionCorrect answer: C
   4. D.Evidence of correction and corrective action without evidence of cause analysis

   Explanation: The guidance states: "In reviewing the response of an organization to a nonconformity, the auditor should confirm that documented information and objective evidence for all three parts (correction, analysis of the cause, and corrective action) are provided by the organization, and are appropriate, before accepting the response." The response must be supported by appropriate evidence.

   Reference: ISO 9001 Auditing Practices Group: Nonconformity – review and closing — Review of actions in response to a nonconformity

7. 7When applying the Plan phase of PDCA to an audit programme, which action should the manager take?

   1. A.Measure the completed programme against its targets
   2. B.Carry out the audits defined in the programme
   3. C.Implement improvements identified after programme review
   4. D.Establish objectives and processes to deliver the programmeCorrect answer: D

   Explanation: The source states: "Establish the objectives and processes necessary to deliver results" Establishing objectives and processes belongs to planning.

   Reference: Guidance on the Concept and Use of the Process Approach for management systems — Section 5.5, PDCA: Plan

8. 8Which statement describes the intended organizational applicability of ISO/IEC 42001?

   1. A.Limited to large organizations developing or using AI products or services
   2. B.Open to organizations of any size developing, providing, or using AI productsCorrect answer: B
   3. C.Limited to public-sector organizations developing or using AI products or services
   4. D.Limited to organizations primarily developing AI products or services commercially

   Explanation: ISO explains: "Organizations of any size involved in developing, providing, or using AI-based products or services. It is applicable across all industries and relevant for public sector agencies as well as companies or non-profits." Applicability is not restricted to a particular organization size or sector.

   Reference: ISO/IEC 42001:2023 - AI management systems — FAQ, Who is ISO/IEC 42001 for?

9. 9How may an organization select controls relative to the list in Annex A of ISO/IEC 42001?

   1. A.Exclude listed controls only when the organization adds its own controls.
   2. B.Apply the entire Annex A list without adding organization-specific controls.
   3. C.Choose organization-specific controls instead of considering the Annex A list.
   4. D.Select appropriate listed controls and add organization-specific controls if needed.Correct answer: D

   Explanation: ISO/IEC 42001 states: "Organizations may not require all controls listed in Annex A or may even exceed the list in Annex A with additional controls established by the organization itself." Control selection is not restricted to a mandatory use of the complete list.

   Reference: ISO/IEC 42001:2023 Artificial intelligence — Management system — Clause 3.26, note 1

10. 10A customer alone audits its AI service provider's management system for supplier oversight. In terms of the auditor's relationship to the auditee, how is this audit classified?

    1. A.Third-party audit by an independent certification body
    2. B.First-party audit by the provider's internal audit team
    3. C.Second-party audit by an interested customerCorrect answer: C
    4. D.Third-party audit by a customer as an interested party

    Explanation: ISO 19011 explains: "Second-party audits are conducted by parties having an interest in the organization, such as customers, or by other individuals on their behalf." A customer is an interested party undertaking a second-party audit.

    Reference: ISO 19011:2026 Guidelines for auditing management systems — Clause 3.1, note 2