Module 16 self-check | AI GRCA Practitioner Programme

Why is 'evidence preservation' relevant to both Clause 9 (evaluation) and later external scrutiny (e.g. audit or regulatory review)?

Well-preserved monitoring, audit and review evidence is what allows both internal evaluation and external scrutiny to actually verify AIMS performanceExternal reviewers never look at internally preserved evidenceEvidence preservation is not part of Clause 9's scopeEvidence preservation is only relevant internally, never externally

Why would 'supplier controls' appear within Clause 8 operation rather than only in Annex A's third-party theme?

Because managing suppliers is an ongoing operational activity (not just a one-time control selection), it belongs in Clause 8's operational scope tooClause 8 and Annex A never overlap in subject matterSupplier controls are exclusively a Clause 5 leadership matterSupplier controls have no place in Clause 8 at all

Why is 'competence' under Clause 7 relevant specifically to people operating AI systems, not just general staff training?

Competence under Clause 7 only concerns senior leadershipAI-specific competence has no bearing on control effectivenessCompetence requirements are identical regardless of rolePeople need AI-specific understanding (e.g. of limitations, bias, oversight practices) to operate systems and controls effectively

Clause 7 (Support) primarily covers:

Resources, competence, awareness, communication and documented informationOnly IT infrastructureExternal auditsFinancial reporting

Which best reflects how 'control maturity' typically progresses across stages such as initial, developing, defined, managed and optimising?

Maturity stages only apply to financial controls, not AI controlsMaturity has no defined stages and is purely subjectiveIt generally progresses from ad hoc, undocumented practice toward consistent, evidenced, continuously improved operationMaturity always starts at 'optimising' and decreases over time

Which is a practical example of 'documented information' required under Clause 7 for an operating AI system?

Documented information is not actually required under Clause 7A verbal agreement with no written recordA recorded risk assessment, control evidence log, or training record that can be inspected laterOnly the original sales brochure from the AI vendor

What is the purpose of 'monitoring' under Clause 9, distinct from a one-off pre-launch test?

Monitoring replaces the need for internal audit entirelyThere is no distinct purpose — one test is sufficient foreverMonitoring tracks ongoing performance and risk indicators after launch, catching issues that only emerge over time (like drift)Monitoring only applies before a system goes live

Relying entirely on a supplier's unverified claim of 'no bias' is a gap in which Annex A theme?

Customer relationshipsThird-party relationshipsResources for AI systemsAI policies

ISO/IEC 42001 Clauses 7–10 and Annex A Controls