Quick mixed check · Self-check | AI GRCA Practice Lab

WEEK 21 · Controls, operations & judgement · AI Control Testing, Assurance and Audit Readiness

What does 'inspection' mean as an evidence-gathering method?

Watching someone perform a taskAsking someone a questionExamining records, documents or system configurations directlyRedoing the control yourself

WEEK 17 · AI law & privacy · EU AI Act Foundations and Global AI Law Landscape

A non-EU company's AI product is never sold in the EU, but its output is used by an EU-based customer who receives services generated by it. Could EU AI Act obligations still be relevant?

This scenario is explicitly exempted by the ActNo, obligations can never extend this wayPotentially yes — market connection can arise through the use of the system's output within the EU, not only through direct sales thereOnly physical hardware sales create market connection

WEEK 14 · ISO AI management · ISO/IEC 42001 Clause 4: Context of the Organisation

Which is the best way to describe the relationship between Clause 4 scoping work and later Clause 8 operational controls?

They are entirely disconnected activitiesClause 4 scope defines what Clause 8 operational controls actually need to cover — controls should map back to the defined scopeClause 8 controls should be defined before Clause 4 scopeScope has no bearing on which systems need operational controls

WEEK 8 · NIST AI RMF · NIST MEASURE

A good acceptance criterion should be set:

After testing, once results are knownBefore testing, as a measurable threshold with a rule for unacceptable failureOnly by the AI vendorAs a vague aspiration

WEEK 18 · AI law & privacy · EU AI Act High-Risk AI, GPAI, Timeline and Compliance Evidence

What does 'data governance' cover in the EU AI Act's high-risk obligations?

Marketing approval of the dataset nameOnly applies to GPAI models, not high-risk systemsOnly where the servers are physically locatedPractices for training, validation and testing data, including relevance, representativeness and quality

WEEK 7 · NIST AI RMF · NIST MAP

What is the primary purpose of the MAP function?

Establishing context: intended use, affected people, misuse and risk scenariosBoard reportingSetting risk appetite policyWriting release evidence

WEEK 22 · Controls, operations & judgement · Integrated AI Governance Operating Model

What belongs in the 'retirement' stage of the AI lifecycle?

Nothing further once a system stops being usedData handling, supplier exit, evidence retention and communication to affected people, as relevantImmediate deletion of all records with no retentionTransferring accountability to the AI system itself

WEEK 24 · Controls, operations & judgement · Mock Exam, Capstone Evidence Pack and Final Viva

When classifying a scenario under the EU AI Act, what should a strong answer state alongside the conclusion?

Nothing — a bare classification label is sufficientThe key assumption or fact the classification depends on, and any residual uncertaintyA guarantee of complete legal certaintyOnly the technology used, not the use case

WEEK 23 · Controls, operations & judgement · Sector Case Studies and Practitioner Judgement

Which two sectors in this week's coverage most explicitly require attention to how automated decisions affect vulnerable or differently-situated groups?

Internal copilots and recruitment onlyInsurance and public sectorOnly financial servicesOnly healthcare

WEEK 22 · Controls, operations & judgement · Integrated AI Governance Operating Model

What's a reasonable trigger for a 'security review' at intake?

The system integrates with external tools, APIs or handles sensitive dataSecurity review is only needed after a breachSecurity review only applies to open-source systemsThe system has no external connections and processes no sensitive data

WEEK 1 · Foundations, harm & law · AI Foundations for Governance

Why does AI governance exist at all?

To slow down technology adoption for its own sakeTo manage the risks and responsibilities AI systems create for people and organisationsBecause all AI is illegal without itOnly to satisfy IT departments

WEEK 5 · NIST AI RMF · NIST AI RMF Overview and OECD AI Principles

Which RMF function establishes intended use, context and risk scenarios?

GovernMapMeasureManage

WEEK 20 · Controls, operations & judgement · COSO Internal Control Foundations for AI

What best describes 'control environment' in COSO terms?

The tone, culture, accountability structures and competence that underpin all other controlsA synonym for a firewallThe physical office layoutThe server infrastructure hosting the model

WEEK 6 · NIST AI RMF · NIST GOVERN

Why does 'AI ownership' need to be distinct from general IT ownership?

AI systems raise specific risks (bias, hallucination, autonomy) that general IT ownership models may not coverIT ownership is always sufficientAI ownership is a redundant conceptAI systems carry no distinct risk from other software

WEEK 11 · GenAI & agent security · Agentic AI, Prompt Injection and AI Security Controls

Why does 'audit trail' design for agents typically need to capture the reasoning or plan, not just the final action taken?

Only the final output ever needs reviewCapturing reasoning is technically impossible for any agentReasoning is irrelevant to understanding what happenedUnderstanding why an agent chose a particular action helps diagnose whether it was manipulated, malfunctioning, or behaving as intended

WEEK 15 · ISO AI management · ISO/IEC 42001 Clause 5 and Clause 6: Leadership and Planning

What role does the 'governance board' typically play under Clause 5, as distinct from day-to-day system owners?

System owners report to no one under Clause 5It has no distinct role from system ownersIt provides senior oversight, sets direction and approves policy, while system owners handle operational management of individual AI systemsThe governance board should approve every individual AI output

WEEK 9 · NIST AI RMF · NIST MANAGE and Risk Treatment

A 'localisation/geographic restriction policy' addresses:

Only applies to hardwareOnly translation qualityRestricting where data or system operation occurs, often for legal or risk reasonsOnly marketing localisation

WEEK 10 · GenAI & agent security · GenAI, RAG and LLM Application Risk

A cited source doesn't actually support the claim made in the answer. This is a failure of:

Database rightsPurpose limitationData minimisationGrounding and citation traceability

WEEK 19 · AI law & privacy · UK GDPR, DUAA, DPIA and AI Privacy

Which of these is a 'special category' of data under UK GDPR?

A person's postcodeData concerning healthA person's job titleA person's employer name

WEEK 2 · Foundations, harm & law · Responsible AI, Trustworthy AI & Harm

Why might 'monitor' be an acceptable treatment for a low-probability, low-severity harm, when it wouldn't be for a high-severity one?

All harms require the same treatment regardless of severityMonitoring replaces the need to ever assess severityMonitoring is never an acceptable treatment for any harmTreatment should be proportionate to the risk level; lower risks can sometimes be managed with monitoring alone

WEEK 12 · ISO AI management · ISO AI Standards: ISO/IEC 22989, ISO/IEC 42001 and ISO/IEC 42005

Why do ISO AI standards matter to a practitioner, beyond academic interest?

They give a shared vocabulary, a governance-system structure and an impact-assessment method that make AI governance consistent and auditableThey are only relevant to software engineersThey replace the need for any legal analysisThey have no practical use

WEEK 16 · ISO AI management · ISO/IEC 42001 Clauses 7–10 and Annex A Controls

Why would 'supplier controls' appear within Clause 8 operation rather than only in Annex A's third-party theme?

Because managing suppliers is an ongoing operational activity (not just a one-time control selection), it belongs in Clause 8's operational scope tooClause 8 and Annex A never overlap in subject matterSupplier controls are exclusively a Clause 5 leadership matterSupplier controls have no place in Clause 8 at all

WEEK 3 · Foundations, harm & law · Governance, Risk, Compliance & Assurance Basics

What is the 'second line' in the three lines of defence model?

External regulatorsA synonym for internal auditThe team that owns and operates the AI systemRisk, compliance and similar functions providing oversight and challenge to the first line

WEEK 13 · ISO AI management · ISO/IEC 42001 Foundations

Which best reflects the relationship between leadership commitment (Clause 5) and Annex A control selection?

They are entirely unrelated activitiesLeadership commitment sets the direction and resourcing that makes meaningful Annex A control selection and operation possibleAnnex A controls are selected before any leadership involvementLeadership has no role in control selection

WEEK 4 · Foundations, harm & law · AI and the Wider Legal Landscape

Sector regulation for a financial services AI tool would most likely add requirements around:

Only physical workplace safetyOnly employment contractsOnly general marketing practices with no sector specificityFinancial-services-specific obligations, such as fair lending or model risk management practices