Module 15 self-check | AI GRCA Practitioner Programme

What role does the 'governance board' typically play under Clause 5, as distinct from day-to-day system owners?

The governance board should approve every individual AI outputSystem owners report to no one under Clause 5It has no distinct role from system ownersIt provides senior oversight, sets direction and approves policy, while system owners handle operational management of individual AI systems

How does Clause 5/6 planning relate to NIST's GOVERN and MAP functions?

No relationshipLeadership commitment and risk-based planning parallel NIST's GOVERN and MAP functionsNIST functions replace ISO clauses entirelyOnly MEASURE relates to Clause 6

How should planning under Clause 6 treat a newly identified AI risk discovered mid-cycle, rather than at the original planning point?

Only Clause 9 can introduce new risks into planningIt should be ignored until the next full planning cycleThe 'planning changes' element of Clause 6 allows for controlled incorporation of newly identified risks outside the original planning cycleNew risks can never be added once a planning cycle starts

How should 'objectives and measurement' under Clause 6 be reviewed after a significant AI incident?

Objectives should never be revisited after an incidentThe incident should prompt a review of whether existing objectives and measures adequately addressed the risk that materialised, adjusting them if notIncidents are irrelevant to Clause 6 objective-settingOnly Clause 10 addresses incidents, with no link back to Clause 6 objectives

Which is a leadership responsibility under Clause 5, not a purely operational task?

Writing the model's codeResponding to individual support ticketsManually reviewing every AI outputSetting AI policy and assigning roles, authorities and resources

Which best distinguishes the role of an AI governance board from an operational AI ethics working group, where both exist?

They are always the same body under a different nameThe governance board typically holds ultimate oversight and approval authority; a working group may develop recommendations and detailed guidance for the board's considerationThe working group always outranks the governance boardOnly one of the two bodies is ever needed, never both

Why does 'senior management responsibilities' under Clause 5 typically include approving risk acceptance, not just policy?

Policy approval and risk acceptance are the same single decisionSenior management has no role in risk acceptanceBecause accepting residual AI risk carries real organisational consequence, it needs authority matched to that level of decision, often senior leadershipRisk acceptance is always delegated to the most junior available staff

How does this module's syllabus explicitly frame the alignment between ISO Clause 5/6 and NIST AI RMF?

As requiring a strict legal hierarchy between the twoAs entirely separate with no acknowledged relationshipAs explicitly aligned — Clause 5/6 leadership and planning correspond conceptually to NIST's GOVERN and MAP functionsAs mutually exclusive frameworks that cannot be used together

ISO/IEC 42001 Clause 5 and Clause 6: Leadership and Planning