Week 3 self-check | AI GRCA Practice Lab

WEEK 3 · Foundations, harm & law · Governance, Risk, Compliance & Assurance Basics

Which best distinguishes governance from risk management?

Governance sets direction and accountability; risk management identifies and treats uncertainty within that directionRisk management is done only by the boardGovernance only applies after an incidentThey are identical activities

WEEK 3 · Foundations, harm & law · Governance, Risk, Compliance & Assurance Basics

Risk tolerance is best described as:

Only relevant to cybersecurityIdentical to risk appetiteThe specific, measurable thresholds within the broader risk appetite that trigger escalationA synonym for a control activity

WEEK 3 · Foundations, harm & law · Governance, Risk, Compliance & Assurance Basics

What's the practical consequence of an organisation having no defined risk appetite for AI?

Undefined appetite means every risk must be escalated to the boardNothing — appetite is a purely theoretical conceptDecisions about what risk to accept get made inconsistently, without a shared reference pointUndefined appetite automatically defaults to zero risk tolerance

WEEK 3 · Foundations, harm & law · Governance, Risk, Compliance & Assurance Basics

What does 'evidence' mean in a GRC context?

Something inspectable that demonstrates a control operated or a risk was properly assessedOnly relevant to court proceedingsA requirement only for third-party auditsA synonym for opinion

WEEK 3 · Foundations, harm & law · Governance, Risk, Compliance & Assurance Basics

How does a 'risk' differ from an 'incident'?

Incidents are always less serious than risksRisks only exist after an incident has happenedThey are identical termsA risk is a possible future event with uncertain outcome; an incident is something that has already occurred

WEEK 3 · Foundations, harm & law · Governance, Risk, Compliance & Assurance Basics

What is the 'second line' in the three lines of defence model?

External regulatorsA synonym for internal auditThe team that owns and operates the AI systemRisk, compliance and similar functions providing oversight and challenge to the first line

WEEK 3 · Foundations, harm & law · Governance, Risk, Compliance & Assurance Basics

Why is 'governance vs management' a common source of confusion in practice?

They are truly identical and confusion is unwarrantedBecause the same people sometimes wear both hats, but the roles — setting direction vs executing decisions — are conceptually distinctBecause governance never actually happens in practiceBecause management only exists in large organisations

WEEK 3 · Foundations, harm & law · Governance, Risk, Compliance & Assurance Basics

What is an audit trail for, in practical terms?

To make reports longerTo let someone reconstruct what decision was made, by whom, on what evidenceOnly required for financial systemsA synonym for a risk register