AI GRCA Practice Lab

Which is the strongest example of a COSO-style control activity for an AI copilot used by customer service staff?

A trained reviewer samples 20 AI-drafted responses per month against defined quality and compliance criteria, and escalates exceptions to a named ownerA policy document exists somewhere on the intranetThe supplier states the model is safe in its marketing material'We value responsible AI'

In the COSO components, where does 'segregation of duties' most directly apply to AI governance?

It has no relevance to AI systemsEnsuring the person who builds or approves a model is not the same person who independently tests and signs off its releaseIt only applies to financial transactionsIt means only one person should ever be involved in AI governance

Why is 'inquiry alone' considered weak audit evidence of operating effectiveness?

Because only automated controls can ever be testedBecause people are always dishonestBecause someone describing a control does not confirm it actually operated consistently — inspection, observation or reperformance corroborate itBecause inquiry is prohibited by all audit standards

A control is found to be well-designed on paper but, when tested against a sample of actual cases, was not consistently performed. What is the correct conclusion?

Design and operating effectiveness are the same thingNo further action is needed since the design passedThe control is fully effective because the design is soundThe control has a design that may be adequate, but operating effectiveness is deficient and needs remediation

Which contract term most directly supports governance over a supplier's AI model changes?

A clause requiring advance notification, evidence and a route to revalidate or reject material model changesUnlimited user seats at no extra costA clause limiting the supplier's uptime commitmentMarketing and co-branding rights

What is the primary difference between second-line and third-line assurance in the three-lines model, as applied to AI governance?

There is no difference; both terms mean the same thingThe second line (e.g. risk, compliance) provides oversight and challenge to the first line; the third line (internal audit) provides independent assurance over the whole system, including the second lineThe third line owns and operates the AI system directlyThe second line reports only to external regulators

An assurance review finds that a model card is six months out of date and a recent model update was accepted without regression testing evidence. What is the most defensible assurance conclusion?

Full assurance, because the original model card existed at some pointReasonable assurance that the system is fully compliantLimited or insufficient assurance, given material gaps in current evidence supporting the system's performance and safetyNo conclusion is needed if the system has not yet caused an incident

A findings register describes a control gap. Which structure best separates fact from judgement, per good audit-writing practice?

Just a severity rating with no explanationAn opinion about whether the team is competentA single sentence blaming a named individualCriteria (what should happen), condition (what actually happens), cause, consequence and supporting evidence

A financial services firm uses an AI credit-scoring tool. Which combination of concerns is most relevant to this sector, per the course's sector case coverage?

Fair lending, model risk management and consumer protectionOnly marketing effectivenessOnly server uptimeOnly software licensing cost

A hospital pilots an AI tool that supports (but does not replace) a clinician's triage decision. Which additional practitioner judgement is most relevant, per this course?

Only whether the interface is visually appealingPatient safety, the handling of patient data, product liability exposure and the boundary with medical-device regulationOnly whether the tool is cheaper than clinicians' timeNone — healthcare AI is governed identically to any other sector

A public sector body procures an AI tool to triage citizen service requests. Which additional concern is distinctly relevant to public sector AI governance, per this course?

Faster time-to-market above all other considerationsShareholder dividend policyEquality impact, public procurement duties and heightened accountability to citizensBrand sponsorship opportunities

An insurer uses AI to triage claims and score fraud risk. Which group requires specific additional attention in this sector, per the course?

Only the underwriting teamOnly competitors' customersShareholders exclusivelyVulnerable customers who may be disproportionately affected by automated claims or fraud decisions

An internal enterprise copilot retrieves company documents to answer staff questions. Which risk combination is most distinctly relevant to this internal use case, per the course?

Data leakage, access control failures, staff misuse and IP/privacy/confidentiality exposureOnly hardware procurement costOnly whether staff enjoy using the toolOnly external marketing risk

What belongs at the end of an integrated AI governance lifecycle, alongside retirement?

Nothing further is needed once a system is deactivatedEvidence retention, supplier exit management and communication to affected peopleDeleting all records immediately to save storageTransferring accountability to the AI system itself

A buy-vs-build comparison for a new AI capability should weigh which factors, per this course's guidance?

Only whether the tool is generative AI or classic AIOnly the sticker price of the vendor's contractControl, expertise required, speed, cost, data exposure, IP, transparency, assurance ability, change management and exit optionsOnly how well-known the vendor's brand is

Checkpoint 5