AI GRCAPractice Lab
Step 1 of 5Brief
01 · Guided scenario · Recruitment and HR

Read the scenario brief

Demo mode — sign in to save your work

Treat the assignment as a worker or candidate decision-support review where equality, transparency and meaningful human involvement are central.

PRACTICE MODELoading

Restoring your saved mode and lab work…

RECRUITMENT AND HR WORKING CONTEXT

Recruitment and HR operating brief

The system supports decisions about workers or candidates. Equality, job relevance, transparency and genuinely meaningful human involvement are central.

Evidence bar
  • Selection-rate analysis
  • Job-relevance validation
  • Reviewer training and override sampling
WEEKS 3–4

GRC and wider legal landscape

Create the governance baseline and a cross-functional legal-risk assessment before contract signature.

Practical output
AI System Inventory Entry · Basic AI Risk Register · AI Control and Evidence Matrix · AI Legal Risk Checklist · Three Lines RACI · Board Report Template
FICTIONAL OPERATING ENTITY
RECRUITMENT AND HR ENTITYNorthstar People OperationsBase training lab: MarketSquare Digital
“Create the governance baseline and a cross-functional legal-risk assessment before contract signature.”

Northstar People Operations plans an AI assistant that summarises applications and recommends candidates for interview. It combines a hosted language model with a ranking model; trained recruiters remain responsible for every shortlist decision.

IN SIMPLE TERMS

The organisation wants AI to read job applications, summarise experience and suggest who should be interviewed. Recruiters decide, but the ranking may still disadvantage suitable candidates.

KNOWN FACTS
  • The assistant processes CVs and application responses
  • A hosted language model creates candidate summaries
  • A ranking model scores candidates against job criteria
  • Recruiters can change the recommendation and must record adverse decisions
  • Job-relevance and selection-rate testing by relevant group are incomplete
COMMERCIAL SIMULATION FILE

Inspect the evidence before you advise

The documents contain incomplete, conflicting and potentially unreliable evidence. Treat each claim according to its source.

OPERATING CONTEXT

The system supports decisions about workers or candidates. Equality, job relevance, transparency and genuinely meaningful human involvement are central.

COMMERCIAL PRESSURE

HR must reduce time-to-hire by 30% while the legal team has asked for a documented equality review before rollout.

EXPECTED EVIDENCE
  • Selection-rate and error analysis
  • Job-relevance validation
  • Reviewer training, override sampling and candidate redress
STEERING MEETING BRIEF

Conflicting demands, limited time, unclear ownership

Decision deadline
The steering committee meets in 10 working days. The launch slot will be lost if the decision is deferred beyond this meeting.
Budget constraint
Only GBP 28,000 remains in the assurance budget. Full independent testing was quoted at GBP 46,000, so the team must prioritise risk-based work.
Ownership gap
Product, Risk and Operations each believe another function owns final residual-risk acceptance. The governance charter is silent.
Executive sponsor

“Approve now with post-launch monitoring; delay threatens the business case.”

Risk partner

“Do not approve until critical evidence gaps and the unnamed risk owner are resolved.”

Operations lead

“The existing manual process is already failing service targets and creates its own harm.”

Supplier account director

“The product is proven in comparable organisations, but bespoke evidence requires a paid assurance package.”

OwnerPeople Operations DirectorClassificationInternal

Shows the reporting lines and decision rights relevant to the proposed AI use.

Executive sponsor
People Operations Director owns the business outcome and has requested the team to create the governance baseline and a cross-functional legal-risk assessment before contract signature. The decision must be judged against selection-rate and error analysis.
Delivery chain
People Operations Director -> Product Director -> AI Product Owner -> Data Science Lead -> Operations Manager. Procurement manages the supplier; Information Security and Data Protection are consulted.
Approval ambiguity
The Product Director believes Risk accepts residual risk. Risk states that the accountable business executive must accept it. No committee terms of reference name the final approver.
Three lines
First line operates the system; second line sets policy and challenges risk; Internal Audit has not included the system in its current plan.
YOUR REVIEWER

Cross-functional legal and risk panel

Does the analysis cover the full legal landscape without presenting uncertain conclusions as legal advice?

Start with evidence, not assumptions.

Record unknowns explicitly. Do not convert a supplier claim into a fact merely because it appears in the business case.

Lab overviewSave & continue