AI GRCA Practice Lab

A bank's contact centre uses a hosted foundation model to draft reply emails, which a general-purpose classifier then routes into one of six queues before a human sends anything. Which statement about this arrangement is most accurate?

The complete AI system includes the models, the routing rules, the interface and the human sending stepBecause a human sends the email, no part of this is an AI systemThe foundation model alone is the AI system and the classifier is ordinary softwareThe classifier is the 'AI system' and the foundation model is just infrastructure

A vendor pitches a 'small, single-purpose' fraud-scoring model against a 'large, general-purpose' foundation model for the same task. What is the most defensible governance question to ask first?

Which one has more parametersWhich one is intended for and validated against this specific use case, with what evidenceWhich one is open-sourceWhich one was released more recently

A chatbot confidently states a policy that does not exist in any source document. This is best described as:

OverfittingModel driftHallucinationData poisoning

A retrieval-augmented generation (RAG) system answers questions using a company's internal wiki. Compared to fine-tuning the model on the same wiki, what is the main governance advantage of RAG?

RAG guarantees the model will never hallucinateRAG is always cheaper regardless of query volumeRAG removes the need for any access controlsSources can be updated, cited and access-filtered without retraining the model

An AI agent is given the ability to call a CRM API and send email on a person's behalf. Compared to a simple chatbot, what new governance concern does this introduce?

The agent can take real-world actions, so permissions, approval gates and rollback become relevantAgents cannot hallucinateAgent behaviour is fully deterministic and therefore lower riskNone — agents are governed the same way as chatbots

A company buys access to a third-party foundation model via API and builds a recruitment product on top of it. In this relationship, the company is best described as:

The developer of the foundation modelA deployer/provider of its own AI system, built on a supplier's modelPurely an affected personExempt from governance because it did not train the model

Which pairing correctly orders these concepts from broadest to narrowest?

Deep learning > Artificial intelligence > Generative AI > Machine learningMachine learning > Artificial intelligence > Deep learning > Generative AIArtificial intelligence > Machine learning > Deep learning > Generative AIGenerative AI > Deep learning > Machine learning > Artificial intelligence

A model is trained on labelled examples of 'fraudulent' and 'legitimate' transactions. This is an example of:

Training-free inferenceReinforcement-only learningUnsupervised learningSupervised learning

During training, a model's weights are adjusted on historical data. During inference, the same model is used live on a new applicant's data. Which statement is correct?

Training builds the model's parameters; inference applies the frozen model to new inputInference always changes the model's weightsTraining happens after every user requestTraining and inference are the same process, just renamed

A caseworker relies on an AI recommendation without independently reviewing the underlying evidence, even when it looks unusual. This tendency is best described as:

Data minimisationAutomation biasModel robustnessPurpose limitation

A student-support tool assigns a 'risk' label to some learners. Some learners never see the label but tutors change how they treat those learners because of it. Who is an 'affected person' in this scenario?

Only the tutorsOnly people who log into the toolThe learners, even though they never interact with the interfaceOnly the vendor's engineers

A hiring tool rejects candidates from one demographic group at twice the rate of others, even though overall accuracy is 90%. What is the most accurate governance conclusion?

Since the tool is automated, differential impact is not a governance concernOnly the vendor is responsible, regardless of how the deploying company configures it90% accuracy is sufficient evidence of fairnessOverall accuracy can mask unequal error distribution across groups, which requires separate review

Which pair correctly distinguishes 'harm' from 'risk'?

Harm is an adverse effect that has occurred or could occur; risk is the combination of the likelihood and severity of that harm occurringHarm and risk are interchangeable technical synonymsHarm only applies to individuals; risk only applies to organisationsHarm is a future possibility; risk is something that already happened

A frontline decision using an AI score results in an unfair rejection for one applicant. A separate concern is that many such rejections, repeated across a sector, could erode public trust in automated lending generally. The second concern is best classified as:

Group harmSocietal harmOrganisational harmIndividual harm

A team is deciding whether a moderate-probability, high-severity harm should block a product launch. Using the risk mitigation hierarchy, which option should be considered before 'accept'?

Delete the risk from the register so it does not need a decisionImmediately accept because launch pressure is highConsider whether the risk can be avoided, reduced, or transferred/shared firstTransfer the decision to the affected person

Which best distinguishes governance from risk management, in the GRC sense?

Governance only applies to boards; risk management only applies to frontline staffThey are the same activity performed by different job titlesGovernance is a subset of complianceGovernance is about setting direction, accountability and oversight; risk management is about identifying, assessing and treating uncertainty within that direction

A control owner is different from a risk owner because:

The risk owner is accountable for the risk outcome; the control owner is accountable for operating a specific control that treats part of that riskControl owners only exist in financial auditsRisk owners are always more senior than control ownersThey are always the same person by definition

An AI product team wants to launch generated marketing copy that closely echoes a competitor's trademarked slogan, reuses licensed images without checking terms, and personalises pricing using inferred protected characteristics. Why is a privacy review alone insufficient here?

Because privacy law covers all of these issues by itselfBecause intellectual property, consumer protection, equality and contract risks can arise independently of data protection lawBecause none of these issues are legal risks, only ethical onesBecause marketing copy is never subject to law

Checkpoint 1