AI GRCAPractice Lab
Step 1 of 5Brief
01 · Guided scenario · Financial services

Read the scenario brief

Demo mode — sign in to save your work

Treat the same governance assignment as a regulated customer-outcome decision. The committee needs to know whether the system can affect access, price, treatment or complaint outcomes.

PRACTICE MODELoading

Restoring your saved mode and lab work…

FINANCIAL SERVICES WORKING CONTEXT

Financial services operating brief

A regulated firm is using AI in a process that can affect customer access, pricing or treatment. Consumer outcomes, model risk and explainability are board concerns.

Evidence bar
  • Customer-outcome testing
  • Independent validation
  • Explanation and challenge route
WEEK 21

AI assurance and audit evidence

Perform a release-readiness assurance review and report whether the evidence supports scaled deployment.

Practical output
Assurance Plan · Control Test Plan · Evidence Sample · Assurance Summary · Board Report · Final Approval Recommendation
FICTIONAL OPERATING ENTITY
FINANCIAL SERVICES ENTITYPrinciBank Retail FinanceBase training lab: Pioneer Energy
“Perform a release-readiness assurance review and report whether the evidence supports scaled deployment.”

PrinciBank Retail Finance proposes an AI affordability assistant for personal-loan applications. It analyses application details and transaction categories, then recommends approve, refer or decline; an underwriter remains responsible for the final decision.

IN SIMPLE TERMS

The bank wants AI to help assess whether someone can afford a loan. A human underwriter makes the final decision, but the recommendation may still strongly influence access to credit.

KNOWN FACTS
  • The assistant processes application and categorised transaction data
  • A hosted model identifies affordability patterns and produces reason codes
  • The system recommends approve, refer or decline
  • Underwriters can override the recommendation but must record a reason
  • Subgroup outcome testing and the retention period are not complete
COMMERCIAL SIMULATION FILE

Inspect the evidence before you advise

The documents contain incomplete, conflicting and potentially unreliable evidence. Treat each claim according to its source.

OPERATING CONTEXT

A regulated firm is using AI in a process that can affect customer access, pricing or treatment. Consumer outcomes, model risk and explainability are board concerns.

COMMERCIAL PRESSURE

The commercial sponsor wants launch before quarter-end because a competitor has released a similar service.

EXPECTED EVIDENCE
  • Segmented outcome testing
  • Independent validation report
  • Customer explanation and challenge process
STEERING MEETING BRIEF

Conflicting demands, limited time, unclear ownership

Decision deadline
The steering committee meets in 10 working days. The launch slot will be lost if the decision is deferred beyond this meeting.
Budget constraint
Only GBP 28,000 remains in the assurance budget. Full independent testing was quoted at GBP 46,000, so the team must prioritise risk-based work.
Ownership gap
Product, Risk and Operations each believe another function owns final residual-risk acceptance. The governance charter is silent.
Executive sponsor

“Approve now with post-launch monitoring; delay threatens the business case.”

Risk partner

“Do not approve until critical evidence gaps and the unnamed risk owner are resolved.”

Operations lead

“The existing manual process is already failing service targets and creates its own harm.”

Supplier account director

“The product is proven in comparable organisations, but bespoke evidence requires a paid assurance package.”

OwnerRetail Lending DirectorClassificationInternal

Shows the reporting lines and decision rights relevant to the proposed AI use.

Executive sponsor
Retail Lending Director owns the business outcome and has requested the team to perform a release-readiness assurance review and report whether the evidence supports scaled deployment. The decision must be judged against segmented outcome testing.
Delivery chain
Retail Lending Director -> Product Director -> AI Product Owner -> Data Science Lead -> Operations Manager. Procurement manages the supplier; Information Security and Data Protection are consulted.
Approval ambiguity
The Product Director believes Risk accepts residual risk. Risk states that the accountable business executive must accept it. No committee terms of reference name the final approver.
Three lines
First line operates the system; second line sets policy and challenges risk; Internal Audit has not included the system in its current plan.
YOUR REVIEWER

Head of assurance

Would an independent reviewer reach the same conclusion from the retained evidence?

Start with evidence, not assumptions.

Record unknowns explicitly. Do not convert a supplier claim into a fact merely because it appears in the business case.

Lab overviewSave & continue