Module 3: GRC & Assurance Basics

Welcome to Week 3

In Week 1, we explored what artificial intelligence is, how different AI systems work, who uses them and who may be affected by their decisions.

In Week 2, we explored responsible AI, trustworthy AI and harm. We learned that an AI system can perform well technically while still causing harm to individuals, organisations or society.

Now we move into the foundations of Governance, Risk, Compliance and Assurance, also known as GRCA.

This is where we stop simply identifying what could go wrong and start understanding how organisations should manage it.

Think about a bank using artificial intelligence to detect fraudulent transactions.

The system might successfully prevent thousands of fraudulent payments.

That sounds impressive.

But what happens when it incorrectly blocks a genuine customer from accessing their money?

What happens when a customer cannot pay for food, emergency travel or accommodation?

Who is responsible for that decision?

Who assesses the risk?

What controls should exist?

How does the bank prove those controls work?

And who has the authority to decide whether the system should continue operating?

These are the questions we will answer in Week 3.

Our central message

Identifying AI risk is only the beginning. A practitioner must understand how risk is assessed, controlled, owned, monitored, evidenced and governed.

We will use one fictional banking scenario throughout this lesson.

Introducing BankFraud AI

BankFraud AI is a fictional machine-learning fraud detection system used by a UK retail bank.

It analyses transaction patterns and produces a fraud-risk score to help determine whether a transaction should be approved, challenged or temporarily blocked.

Its intended benefits include reducing financial fraud, protecting customers and improving fraud detection.

However, it may also create risks such as:

• Incorrectly blocking legitimate transactions.
• Failing to detect fraudulent activity.
• Disadvantaging certain customers.
• Creating excessive reliance on automated scores.
• Delaying urgent customer payments.
• Exposing sensitive financial information.
• Producing decisions that staff cannot adequately explain.

BankFraud AI is a training simulation. It does not connect to a real bank, analyse actual customer transactions or make live financial decisions.

By the end of Week 3, learners should be able to:

1. Explain how governance, risk, compliance and assurance work together.
2. Write and assess a clear cause–event–impact AI risk statement.
3. Select proportionate controls, owners and evidence for an AI risk.
4. Evaluate control design, operating effectiveness and residual risk.
5. Make and defend an evidence-based governance decision for BankFraud AI.

Use the detailed topics in each learning unit as supporting knowledge for these five capabilities.

UNDERSTANDING GOVERNANCE, RISK, COMPLIANCE AND ASSURANCE

Definition

Governance is the system through which an organisation sets direction, assigns accountability, establishes rules, makes decisions and oversees its activities.

In plain term

Governance is about making sure the right people make the right decisions, follow the right rules and take responsibility for the outcomes.

Governance answers:

• Who is responsible?
• Who makes decisions?
• Who approves the system?
• What policies apply?
• What level of risk is acceptable?
• What happens when something goes wrong?
• Who can challenge a decision?
• Who can stop or restrict the system?

Everyday example: running a school

A school has teachers, a headteacher and governors.

Teachers deliver lessons.

The headteacher manages the school.

The governing body provides oversight, examines performance, challenges decisions and ensures accountability.

A school can have excellent teachers but still suffer from poor governance.

The same applies to AI.

A technology team might build a sophisticated AI system, but that does not automatically mean the organisation has governed it properly.

BankFraud AI example

A bank introduces BankFraud AI to reduce fraud losses.

The technology team says:

The model detects suspicious transactions accurately and runs without technical errors.

But the governance team asks:

• Who approved the use of AI for blocking payments?
• Has the impact on customers been assessed?
• Who owns the risk of incorrectly blocked transactions?
• Are customers able to challenge decisions?
• What happens if someone needs emergency access to money?
• Are there defined limits for acceptable false positives?
• Who reviews system performance?
• Who can suspend automated blocking?

These questions go beyond technical performance.

They concern accountability and organisational decision-making.

Important teaching point

An AI system can be technically successful but poorly governed.

Good governance does not mean preventing innovation. It means helping an organisation introduce technology responsibly, with appropriate controls and accountability.

Governance and management are closely connected, but they are not interchangeable.

Governance

Governance establishes direction, authority, accountability and oversight.

It asks:

• Should we use this AI system?
• What objectives should it support?
• What risks are acceptable?
• Who is accountable?
• What rules must be followed?
• What evidence is required for approval?

Management

Management is responsible for planning, implementing and operating activities.

It asks:

• How will we build or deploy the system?
• Who will perform the work?
• What resources are needed?
• How will we implement controls?
• How will we monitor day-to-day operations?

Comparison

BankFraud AI example

The technology delivery manager says:

We can deploy the fraud detection upgrade on Friday.

The governance reviewer asks:

Has the bank demonstrated that the upgrade will not create unacceptable customer harm and that appropriate monitoring, escalation and rollback controls are in place?

The delivery manager focuses on delivering the system.

The governance reviewer focuses on whether its use is properly authorised and controlled.

Discussion question

If BankFraud AI reduces fraud by 30%, does that automatically mean it should be deployed?

No.

The organisation must also examine customer impact, reliability, fairness, legal requirements, operating controls and the quality of supporting evidence.

The 30% improvement is only a hypothetical example. On its own, it does not establish whether deployment is appropriate.

Definition

Compliance means meeting applicable legal, regulatory, contractual and internal organisational requirements.

In plain term

Compliance means knowing which rules apply and making sure the organisation follows them.

Everyday example

A restaurant must meet food safety requirements.

Having good customer reviews does not remove those obligations.

Similarly, a bank cannot ignore financial regulation simply because its AI system performs well.

BankFraud AI example

A UK bank using AI in fraud detection may need to consider:

• UK GDPR and data protection requirements.
• Relevant FCA requirements and expectations.
• Fair treatment of customers, including relevant Consumer Duty considerations.
• Operational resilience and incident management.
• Information security.
• Outsourcing and third-party risk.
• Internal model governance and risk policies.
• Contractual obligations.

The exact obligations depend on the bank, the system and how it is used.

Example questions

• Is the bank processing customer data lawfully?
• Has it assessed whether a DPIA is required?
• Are customers treated fairly?
• Is there an appropriate process for resolving payment blocks?
• Are vulnerable customers considered?
• Has the AI supplier been assessed?
• Are decisions appropriately documented?
• Are required controls implemented?

Compliance versus governance

Compliance asks:

Are we meeting the applicable requirements?

Governance asks:

Who is accountable, what are we trying to achieve, what risk are we prepared to accept and who oversees the system?

Risk management asks:

What could go wrong and what are we doing about it?

Assurance asks:

• > What evidence shows that our controls work?
• Teaching point

Compliance is essential, but compliance alone does not guarantee that an AI system is safe, fair or effective.

The four elements reinforce each other.

The complete picture

A bank introduces an AI fraud detection system.

Governance establishes the objectives, ownership and approval arrangements.

Risk management identifies possible losses and customer harms.

Compliance specialists determine which requirements apply.

Operational teams implement controls.

Assurance functions assess whether those controls are suitably designed and working.

Governance then uses the resulting evidence to make decisions.

Main lesson

Governance without risk management is incomplete.

Risk management without controls is ineffective.

Controls without evidence are unverified.

Evidence without accountability does not provide a complete governance decision.

ASSESSING AND TREATING AI RISK

Risk appetite

The type and amount of risk an organisation is willing to accept while pursuing its objectives.

In plain term

How much risk are we prepared to take?

Risk tolerance

The limits of acceptable variation around an objective or risk exposure.

In plain term

At what point do we say the risk has gone too far?

Everyday example

You are planning a journey.

You are comfortable allowing 20 minutes of extra travel time for traffic.

You set a maximum acceptable delay of 45 minutes before changing your plans.

Your general willingness to accept delay reflects risk appetite.

Your defined limit provides a practical tolerance.

BankFraud AI example

The bank may accept some additional checks on genuine transactions to prevent fraud.

However, it may decide that prolonged blocking of essential payments or poor treatment of vulnerable customers is unacceptable.

Its policy could define:

• Acceptable performance ranges.
• Escalation triggers.
• Maximum review times for urgent cases.
• Conditions requiring manual review.
• Thresholds requiring senior management intervention.
• Circumstances in which automated blocking must be restricted.

These should be defined using the bank's approved methodology and applicable obligations, not invented by the AI team.

Teaching point

Risk appetite should translate into practical limits and decisions.

If everyone claims a risk is unacceptable but nobody defines how to detect or escalate it, governance is weak.

Risk owner

The person accountable for ensuring that a risk is understood, assessed and managed.

Control owner

The person responsible for operating, maintaining or implementing a specific control.

BankFraud AI example

Risk: Genuine transactions may be incorrectly blocked.

Risk owner: Head of Fraud Operations.

Control 1: Customer verification process.

Control owner: Fraud Operations Manager.

Control 2: Model performance testing.

Control owner: AI Model Validation Lead.

Control 3: Customer complaints escalation.

Control owner: Customer Support Operations Lead.

Control 4: Access restrictions.

Control owner: Information Security Lead.

Why this matters

A single risk may require several controls managed by different teams.

The risk owner remains responsible for ensuring that the overall risk is managed.

Introducing RACI

RACI stands for:

• Responsible: Performs the work.
• Accountable: Owns the result or decision.
• Consulted: Provides specialist input.
• Informed: Receives relevant information.

Example: BankFraud AI model review

Teaching point

A vague risk owner such as "IT" or "the business" is not good enough for significant AI risks.

Accountability should be assigned to a clear role.

These are different governance documents.

Policy

A policy establishes organisational rules or commitments.

Example: All material AI systems must undergo documented risk assessment before deployment.

Standard

A standard defines minimum expectations or requirements.

Example: AI risk assessments must document affected people, risk ratings, controls, evidence and accountable owners.

Procedure

A procedure explains how an activity is performed.

Example:

1. Register the AI use case.
2. Complete the risk assessment.
3. Identify applicable controls.
4. Perform required testing.
5. Obtain appropriate review and approval.
6. Record the decision.

Guidance

Guidance provides supporting explanations and examples.

Example: A document explaining how to identify false-positive risk in AI fraud detection systems.

In plain term

Policy: What must happen?

Standard: What requirements must be met?

Procedure: How do we do it?

Guidance: How do we understand and apply it?

BankFraud AI exercise

Ask learners to create one policy, standard, procedure and guidance statement for the bank's use of AI fraud detection.

Teaching point

A governance document has value only when people understand it, follow it and review it.

The Three Lines Model helps organisations understand risk ownership, oversight and independent assurance.

First line: operational management

The teams responsible for providing products or services and managing related risks.

BankFraud AI example:

• Fraud Operations.
• Payments Operations.
• AI product and engineering teams.
• Customer Operations.

Second line: specialist oversight and challenge

Functions that provide expertise, support, monitoring and challenge.

BankFraud AI example:

• Risk Management.
• Compliance.
• Data Protection.
• Information Security.
• Model Risk Management, depending on the bank's organisational structure.

Third line: independent assurance

Internal Audit provides independent and objective assurance and advice.

BankFraud AI example:

Internal Audit examines whether AI governance requirements have been followed and whether selected controls operate effectively.

Important distinction

The second line may perform monitoring and reviews, but third-line internal audit has a different independence role.

The Three Lines Model also recognises governing body oversight of the organisation.

Teaching point

The people who build and operate AI should not automatically be the only people judging whether their own controls are effective.

PROFESSIONAL FRAMEWORKS

Definition

Risk is the effect of uncertainty on objectives.

In AI GRCA, we often focus on uncertain events that could cause harm, financial loss, operational disruption, legal exposure or damage to organisational objectives.

In plain term

Risk is what could go wrong, why it could happen and what the consequences would be.

A useful risk statement contains three elements:

• Cause → Risk event → Impact
• Risk statement formula
• Because of [cause], [event] may occur, resulting in [impact].

Everyday example

Weak risk statement:

My car might break down.

Stronger risk statement:

Because my car has not been serviced regularly, it may break down during a long journey, resulting in missed appointments and unexpected repair costs.

The second statement provides enough information to start identifying controls.

BankFraud AI example

Weak statement:

BankFraud AI may make mistakes.

Stronger statement:

Because BankFraud AI may incorrectly classify legitimate transactions as fraudulent, genuine customer payments could be blocked, resulting in financial inconvenience, customer distress, complaints and potential regulatory concerns.

Another example:

Because BankFraud AI may not recognise new fraud patterns, fraudulent transactions may go undetected, resulting in financial losses for customers and the bank.

These are two different risks.

One concerns false positives, where genuine activity is wrongly flagged.

The other concerns false negatives, where fraudulent activity is missed.

Both matter.

Risk, issue, harm and control

Teaching point

A risk describes uncertainty.

An issue describes an actual problem.

Harm describes the negative consequence.

Controls address the risk.

Evidence helps demonstrate what has been done and whether controls work.

Definition

Risk management is the coordinated process of identifying, analysing, evaluating, treating, monitoring and communicating risks.

In plain term

Risk management means identifying what could go wrong, deciding how serious it is, taking action and checking whether the action works.

The risk management cycle

Step 1: Identify the risk

What could happen?

Step 2: Analyse the risk

Why might it happen? How likely is it? How serious could it be?

Step 3: Evaluate the risk

Is the risk acceptable under the organisation's criteria and risk appetite?

Step 4: Treat the risk

What actions or controls are necessary?

Step 5: Assign ownership

Who is accountable for the risk and who operates the controls?

Step 6: Monitor and review

Is the risk changing? Are controls still effective?

Step 7: Report and escalate

Who needs to know? Does the risk require additional approval or intervention?

These steps operate as a continuous cycle.

BankFraud AI example

Risk identified: Genuine customer payments may be blocked incorrectly.

Analysis: The impact could be serious when customers need urgent access to funds.

Evaluation: The bank decides whether the risk falls within its approved tolerance.

Treatment: Customer verification, rapid manual review, escalation for vulnerable customers and monitoring of false positives.

Ownership: Fraud Operations is accountable for managing the operational risk.

Monitoring: The bank reviews false-positive rates, customer complaints and time taken to resolve blocked transactions.

Escalation: Unacceptable outcomes are reported to authorised management, which may restrict or suspend automatic blocking.

Teaching point

A risk register is not risk management by itself.

It is a tool that supports risk management.

The real work involves ownership, action, monitoring and decisions.

Risk assessments often consider two factors.

Likelihood: How likely is the risk event to occur?

Impact: How serious would the consequences be?

In plain term

Likelihood asks:

What are the chances of this happening?

Impact asks:

• > How bad would it be if it happened?
• Simple training scale

For this classroom exercise:

Risk score = Likelihood × Impact

Example

BankFraud AI incorrectly blocks legitimate transactions.

Illustrative likelihood: Medium, 2.

Illustrative impact: High, 3.

Risk score: 2 × 3 = 6.

Using the course's example rating criteria, this is a High risk.

These are training assumptions, not actual bank performance measurements.

Important point

Risk ratings are not universal.

Different organisations use different scales, thresholds and assessment methods.

A risk score should support professional judgement, not replace it.

A rare event could still be unacceptable if the potential consequences are severe.

Inherent risk

The level of risk assessed before taking account of mitigating controls.

Residual risk

The risk remaining after controls have been implemented and considered.

In plain term

Inherent risk is the original risk.

Residual risk is what remains after effective controls are applied.

Everyday example: driving

Driving carries risks of collisions and injury.

Seatbelts, vehicle safety features, speed limits and safe driving practices help reduce these risks.

However, some risk remains.

BankFraud AI example

Risk: Genuine customer transactions may be blocked incorrectly.

Inherent likelihood: Medium.

Inherent impact: High.

Inherent rating: High.

Proposed controls:

• Improved transaction classification testing.
• Customer verification.
• Rapid manual review.
• Special escalation for urgent and vulnerable customer cases.
• False-positive monitoring.
• Incident response procedures.

If those controls are implemented and shown to work, the residual risk may be lower.

However, the practitioner should not claim the risk is reduced simply because the controls are listed.

Important distinction

A proposed control is not the same as an implemented control.

An implemented control is not necessarily an effective control.

Teaching point

Residual risk must be supported by evidence and a reasonable assessment of control effectiveness.

Organisations can respond to risks in several ways.

Avoid

Stop or do not undertake the risky activity.

BankFraud AI example: Do not allow the system to automatically block certain critical payments until safeguards are demonstrated.

Reduce or mitigate

Introduce controls that lower the likelihood or consequences.

BankFraud AI example: Human review, model testing and rapid customer verification.

Share or transfer

Allocate some risk consequences through contracts, insurance or other arrangements.

BankFraud AI example: Insurance or contractual indemnities for certain losses.

This does not automatically remove the bank's accountability or responsibility to customers.

Accept or retain

Keep an understood risk where authorised decision-makers determine that it falls within applicable requirements and approved risk limits.

BankFraud AI example: Accept a documented, monitored level of routine false positives where the bank has established that the exposure is acceptable and appropriately controlled.

Monitor and review

Monitoring is necessary regardless of treatment choice.

A risk that was acceptable yesterday may change because of new fraud patterns, model updates, customer behaviour or control failures.

Teaching point

An organisation should select risk treatment based on the nature and impact of the risk.

Buying insurance does not prevent customer harm.

OWNERSHIP, CONTROLS AND EVIDENCE

Definition

Assurance involves evaluating evidence to develop confidence that risks, controls and governance arrangements are working as intended.

In plain term

Assurance means checking whether the organisation is actually doing what it says it is doing.

Everyday example: car MOT

A driver may claim:

My car is safe because I look after it.

An MOT provides an independent inspection of specified safety and roadworthiness aspects at a point in time.

It does not guarantee the car can never fail, but it provides evidence about its condition against defined requirements.

AI assurance works in a similar way.

BankFraud AI example

The bank says:

Customers can request a manual review of blocked transactions.

An assurance reviewer asks:

• Is there a documented review process?
• Can customers access it?
• Are staff trained?
• How quickly are reviews completed?
• Are decisions recorded?
• Are urgent cases escalated?
• Do completed case records show the process working?
• What happens when the process fails?

Two important assurance concepts

Control design effectiveness

Is the control appropriately designed to address the risk?

Control operating effectiveness

Does the control actually operate as designed?

Example

Control: A customer can request urgent manual review of a blocked transaction.

Design test:

Does the procedure clearly identify who handles the request, how urgent cases are prioritised and what authority staff have?

Operating test:

Do sampled records demonstrate that actual requests were reviewed and resolved according to the procedure?

Teaching point

A policy does not prove that a control works.

A procedure does not prove it has been followed.

Assurance requires appropriate evidence.

Definition

A control is a measure that helps prevent, detect or respond to risk.

In plain term

A control is something that helps stop a problem, discover it or correct it.

Preventative controls

Preventative controls reduce the likelihood of unwanted events.

BankFraud AI examples:

• Model validation before deployment.
• Restricting automated blocking for defined transaction types.
• Access controls.
• Change approval requirements.
• Rules requiring additional customer verification.

Detective controls

Detective controls help identify problems.

BankFraud AI examples:

• Monitoring false-positive rates.
• Monitoring false-negative rates.
• Customer complaints analysis.
• Detection of unusual rejection or block patterns.
• Periodic review of model performance.

Corrective controls

Corrective controls help respond after an event.

BankFraud AI examples:

• Manual release of incorrectly blocked transactions.
• Customer remediation.
• Investigation of model failures.
• Rollback to a previously approved model.
• Corrective retraining or rule changes, subject to governance approval.

Weak versus strong controls

Weak control:

Fraud staff should check AI decisions.

Stronger control:

Fraud analysts must review transactions meeting defined escalation criteria, record the evidence considered, document their decision and escalate urgent customer-impact cases within the approved service standard.

The stronger control can be assigned, monitored and tested.

Five questions for every control

1. What risk does it address?
2. Who owns it?
3. When does it operate?
4. How does it work?
5. What evidence proves it operates?

Teaching point

A control is not a good intention.

It needs to be practical, specific and testable.

Definition

Evidence is information supporting a claim, activity, finding or decision.

In plain term

Evidence is what you provide when someone says:

Show me proof.

BankFraud AI examples

Weak evidence

The project manager confirmed everything was checked.

Stronger evidence

The project produced dated testing results, documented review findings, signed approvals and operational records showing the controls were followed.

Evidence quality checklist

Good evidence should be:

• Relevant.
• Accurate.
• Complete enough for its purpose.
• Traceable to the system or activity.
• Dated.
• Reliable.
• Appropriately retained.
• Protected from unauthorised alteration.

Teaching point

Evidence is central to assurance.

But evidence must actually support the claim being made.

A control procedure proves that the procedure exists. It does not, by itself, prove that staff followed it.

These two concepts are particularly important for practitioners working in assurance, controls testing and internal audit.

Design effectiveness

Is the control properly designed to manage the identified risk?

Operating effectiveness

Is the control working in practice?

BankFraud AI example

Risk: Customers cannot resolve wrongly blocked payments quickly.

Control: The bank provides an urgent manual review process.

Design effectiveness questions:

• Is there a documented procedure?
• Are urgent cases defined?
• Are responsibilities assigned?
• Are staff authorised to release payments where appropriate?
• Are target review times established?
• Is there an escalation route?

Operating effectiveness questions:

• Are customer requests handled using the process?
• Do records show appropriate decisions?
• Are review times monitored?
• Are failures investigated?
• Are overdue cases escalated?

Teaching point

A well-designed control may fail because employees do not follow it.

A control that is performed regularly may still be badly designed.

Both dimensions matter.

The NIST AI Risk Management Framework provides a structured approach to managing AI risk.

Its four functions are:

GOVERN

Establish governance structures, accountability, policies and organisational responsibilities.

MAP

Understand the context in which the AI system operates and identify relevant impacts and risks.

MEASURE

Assess and evaluate AI risks and characteristics through appropriate methods.

MANAGE

Prioritise, respond to and monitor identified risks.

BankFraud AI example

GOVERN: Define AI risk owners and approval authority.

MAP: Identify affected banking customers and possible harms.

MEASURE: Evaluate false positives, false negatives, system reliability and relevant fairness concerns.

MANAGE: Implement controls, track findings, make risk decisions and monitor outcomes.

We will explore NIST AI RMF in detail from Week 5 onwards.

ISO/IEC 42001 specifies requirements for an Artificial Intelligence Management System, or AIMS.

It focuses on how an organisation establishes, implements, maintains and continually improves its approach to managing AI.

Week 3 introduces concepts that support this, including:

• Organisational responsibilities.
• Governance policies.
• Risk assessment and treatment.
• Documented information.
• Operational controls.
• Monitoring.
• Internal audit.
• Management review.
• Continual improvement.

BankFraud AI example

A bank may use an AIMS to establish consistent governance across fraud detection, customer service AI, credit assessment and other AI applications.

BankFraud AI would be one system governed within that wider organisational approach.

Teaching point

A risk register for one AI system is not the same thing as a complete AI Management System.

COSO's Internal Control Framework provides a structured way to understand internal control.

Its five components are:

1. Control Environment.
2. Risk Assessment.
3. Control Activities.
4. Information and Communication.
5. Monitoring Activities.

BankFraud AI example

Control Environment: Leadership defines accountability for AI fraud detection.

Risk Assessment: The bank identifies fraud, customer harm and operational risks.

Control Activities: It implements model validation, manual review and access restrictions.

Information and Communication: It establishes reporting, escalation and documented procedures.

Monitoring Activities: It reviews performance, incidents and control effectiveness.

Teaching point

COSO helps practitioners examine how controls work together within an organisation rather than viewing each control in isolation.

We will study COSO in more detail later in the programme.

The Week 3 material develops knowledge relevant to professional AI governance practice and AIGP-style preparation.

It introduces:

• Governance structures.
• Risk management.
• Accountability.
• Roles and responsibilities.
• Organisational oversight.
• Risk treatment.
• Assurance and evidence.
• AI lifecycle controls.

These concepts will continue to appear throughout the course.

The programme uses original exam-style practice questions. They are not official IAPP AIGP examination questions.

GRCA ACROSS THE AI LIFECYCLE

AI governance is not something to leave until the development team finishes coding.

It should begin when the organisation first considers using AI.

Example governance lifecycle

BankFraud AI example

The bank wants to upgrade its fraud model.

The engineering team says the model detects more suspicious transactions than the current system.

Governance should also require evidence that the model has been evaluated for customer impact, false positives, robustness, security and operational safeguards.

After deployment, the bank should monitor performance.

A successful model today may become less effective as fraud patterns change.

Teaching point

AI governance is continuous.

Passing a pre-release review does not guarantee future performance.

WEDNESDAY LEARNING RECAP

Imagine this situation.

BankFraud AI is operating at a fictional UK retail bank.

Management is pleased because the system appears to reduce fraud losses.

However, customer complaints are increasing.

Some customers say legitimate transactions were blocked.

A few say they could not access money when they urgently needed it.

The fraud team argues that stricter controls are necessary to prevent criminal activity.

The customer operations team argues that the system is causing unacceptable disruption.

The bank's AI Governance Committee requests a formal risk review.

What should happen next?

Governance: Establish who has authority to decide what happens to the system.

Risk: Identify both fraud prevention risk and harm caused by incorrect blocking.

Compliance: Determine applicable financial services, data protection and internal requirements.

Assurance: Obtain and review evidence showing whether the controls are effective.

The practitioner should ask

• What is the intended objective of BankFraud AI?
• What evidence supports the reported fraud reduction?
• What are the false-positive and false-negative rates?
• Which customers are affected?
• Are some groups disproportionately affected?
• What is the impact of incorrect blocking?
• What controls exist?
• Have they been tested?
• What risk remains?
• Who is responsible?
• Should automated blocking continue without changes?

Closing message for Wednesday

An AI system does not become trustworthy simply because it is technically advanced.

It becomes more governable when organisations understand the risks, define accountability, implement controls and use evidence to make decisions.

On Saturday, we will become the AI GRCA team responsible for reviewing BankFraud AI.

SATURDAY PRACTICAL WORKSHOP

This week we learned that:

• Governance determines how organisations direct and oversee AI.
• Management implements and operates activities.
• Risk management identifies and responds to uncertainty.
• Compliance checks applicable requirements.
• Assurance evaluates evidence and control effectiveness.
• Risk statements should identify causes, potential events and impacts.
• Inherent risk and residual risk are different.
• Risk appetite and risk tolerance help organisations set boundaries.
• Controls can be preventative, detective or corrective.
• Every significant risk needs appropriate ownership.
• Controls should be designed, implemented and tested.
• Policies and procedures alone do not prove controls work.
• Risk assessment is continuous throughout the AI lifecycle.
• NIST AI RMF, ISO/IEC 42001 and COSO provide important approaches for AI governance and control.
• BankFraud AI demonstrates how an AI system can deliver business benefits while also creating serious customer harm.
• A strong practitioner must assess both sides and provide an evidence-based recommendation.

AI governance is not about stopping every technology project.

It is about understanding when a system is appropriate, what could go wrong and what the organisation must do before trusting it.

In Week 1, we learned to understand AI systems.

In Week 2, we learned to recognise harm.

In Week 3, we learned how to turn concerns about harm into risks, controls, evidence and decisions.

BankFraud AI shows why that matters.

A system may prevent financial crime and still cause real harm when it incorrectly blocks a customer's money.

A responsible organisation must consider both outcomes.

And an AI GRCA practitioner must be prepared to ask:

What is the risk? Who is affected? Who owns it? What controls are in place? Have they been tested? What evidence exists? What risk remains? Who has authority to decide?

That is the difference between simply using AI and governing AI responsibly.

Next lesson

Week 4: AI and the Wider Legal Landscape

We will explore how AI governance connects to data protection, employment, equality, discrimination, intellectual property, consumer protection, contracts, liability and sector-specific obligations.

We will continue to develop the practical judgement needed to identify legal and regulatory risks before organisations introduce AI systems.

PADEMIQ · AI GRCA Practitioner Programme

AI Governance • Risk • Compliance • Assurance • Evidence

BankFraud AI and Northbridge Bank are fictional training scenarios. All operational figures and assessments are illustrative.