Module 14 self-check | AI GRCA Practitioner Programme

Why is 'documenting scope' considered a defensibility issue, not just an administrative one?

A documented, reasoned scope can be explained and justified to auditors, regulators or affected people; an undocumented one cannotDocumentation is purely for internal filing purposes with no external relevanceScope documentation is optional under Clause 4Defensibility has nothing to do with documentation

What is the purpose of 'AIMS processes' as referenced in Clause 4, beyond simply listing issues and parties?

They are the repeatable processes the organisation puts in place to actually manage AI within the scoped boundary, building on the context establishedAIMS processes only apply after certificationProcesses are optional once context is documentedThey have no defined purpose

Why are affected people treated as interested parties rather than just 'users'?

They aren't relevant to AIMS scopeThey experience consequences from the AI system even if they never interact with it directlyOnly paying customers count as interested partiesAffected people are the same as suppliers

How should 'business context' under Clause 4 reflect a new strategic AI initiative the organisation is about to launch?

It should be ignored until after launchContext documentation should be updated to reflect new AI-related strategic initiatives as they emerge, keeping scope currentBusiness context is fixed once and never updatedStrategic initiatives are outside Clause 4's remit entirely

How should 'procured' versus 'internally built' AI systems be treated differently, if at all, in Clause 4 scoping?

Procurement status is irrelevant to any governance questionProcured systems should always be excluded from AIMS scope entirelyBoth should generally be considered in scope where the organisation deploys or uses them, since accountability for use doesn't depend on who built the systemOnly internally built systems need governance

Clause 4 requires understanding which two categories of issues?

Financial and marketing issuesInternal and external issues affecting the AIMSOnly external issuesOnly issues raised by regulators

Which best describes 'needs and expectations' of interested parties in Clause 4 terms?

A fixed, universal list identical for every organisationA synonym for financial targetsWhat each interested party requires or expects from how the organisation governs AI, which the AIMS should account forOnly the needs of the AI development team

Which is the best way to describe the relationship between Clause 4 scoping work and later Clause 8 operational controls?

They are entirely disconnected activitiesClause 4 scope defines what Clause 8 operational controls actually need to cover — controls should map back to the defined scopeClause 8 controls should be defined before Clause 4 scopeScope has no bearing on which systems need operational controls

ISO/IEC 42001 Clause 4: Context of the Organisation