Module 20 self-check | AI GRCA Practitioner Programme

How should 'information and communication' differ for staff versus the board?

Only staff need any information at allIt shouldn't differ at allStaff typically need operational detail; the board needs a summarised risk and decision viewThe board needs more raw technical detail than staff

What best describes 'control environment' in COSO terms?

A synonym for a firewallThe physical office layoutThe server infrastructure hosting the modelThe tone, culture, accountability structures and competence that underpin all other controls

What's the relationship between control activities and risk appetite?

Control activities should be proportionate to how much risk the organisation is willing to acceptRisk appetite is only relevant to legal teamsControl activities determine risk appetite, not the other way roundNo relationship exists

Segregation of duties in AI governance most directly reduces the risk of:

Slower model trainingOne person having unchecked control over both building and approving a systemHigher cloud hosting costsLonger documentation

What is COSO, in one sentence?

A widely used internal control framework originally built for financial reporting, now applied to AI riskA synonym for ISO/IEC 42001A UK data protection regulatorAn AI-specific certification body

What does 'AI control maturity' generally describe?

The size of the AI teamHow advanced the underlying model architecture isHow consistently, reliably and verifiably an organisation's AI controls actually operate over timeThe number of AI systems deployed

A control says data will be 'reviewed periodically'. What's missing to make this a real control?

A defined frequency, named owner, and criteria for what 'reviewed' actually checksThe involvement of external auditorsA synonym for the risk statementNothing — this is sufficiently specific

What role does 'management oversight' play in an AI control environment?

Oversight only applies after a regulatory fineNone — controls run themselvesManagement is responsible for ensuring controls are resourced, monitored and acted uponOnly the board needs to be involved, never middle management

Why do control gaps need a severity rating, not just a list?

All gaps are equally urgent by definitionSeverity is only relevant for financial controlsSeverity ratings are decorativeSeverity helps prioritise limited remediation resources toward what matters most

COSO Internal Control Foundations for AI