Week 20 self-check | AI GRCA Practice Lab

WEEK 20 · Controls, operations & judgement · COSO Internal Control Foundations for AI

How should 'information and communication' differ for staff versus the board?

It shouldn't differ at allStaff typically need operational detail; the board needs a summarised risk and decision viewThe board needs more raw technical detail than staffOnly staff need any information at all

WEEK 20 · Controls, operations & judgement · COSO Internal Control Foundations for AI

What best describes 'control environment' in COSO terms?

The tone, culture, accountability structures and competence that underpin all other controlsA synonym for a firewallThe physical office layoutThe server infrastructure hosting the model

WEEK 20 · Controls, operations & judgement · COSO Internal Control Foundations for AI

What's the relationship between control activities and risk appetite?

Risk appetite is only relevant to legal teamsControl activities determine risk appetite, not the other way roundNo relationship existsControl activities should be proportionate to how much risk the organisation is willing to accept

WEEK 20 · Controls, operations & judgement · COSO Internal Control Foundations for AI

Segregation of duties in AI governance most directly reduces the risk of:

Slower model trainingOne person having unchecked control over both building and approving a systemHigher cloud hosting costsLonger documentation

WEEK 20 · Controls, operations & judgement · COSO Internal Control Foundations for AI

What is COSO, in one sentence?

A synonym for ISO/IEC 42001A UK data protection regulatorAn AI-specific certification bodyA widely used internal control framework originally built for financial reporting, now applied to AI risk

WEEK 20 · Controls, operations & judgement · COSO Internal Control Foundations for AI

What does 'AI control maturity' generally describe?

The number of AI systems deployedThe size of the AI teamHow advanced the underlying model architecture isHow consistently, reliably and verifiably an organisation's AI controls actually operate over time

WEEK 20 · Controls, operations & judgement · COSO Internal Control Foundations for AI

A control says data will be 'reviewed periodically'. What's missing to make this a real control?

A defined frequency, named owner, and criteria for what 'reviewed' actually checksThe involvement of external auditorsA synonym for the risk statementNothing — this is sufficiently specific

WEEK 20 · Controls, operations & judgement · COSO Internal Control Foundations for AI

What role does 'management oversight' play in an AI control environment?

Oversight only applies after a regulatory fineNone — controls run themselvesManagement is responsible for ensuring controls are resourced, monitored and acted uponOnly the board needs to be involved, never middle management

WEEK 20 · Controls, operations & judgement · COSO Internal Control Foundations for AI

Why do control gaps need a severity rating, not just a list?

Severity is only relevant for financial controlsSeverity ratings are decorativeSeverity helps prioritise limited remediation resources toward what matters mostAll gaps are equally urgent by definition