Module 21 self-check | AI GRCA Practitioner Programme

What does 'inspection' mean as an evidence-gathering method?

Watching someone perform a taskAsking someone a questionExamining records, documents or system configurations directlyRedoing the control yourself

What is the primary purpose of assurance planning before testing begins?

To guarantee a positive conclusion in advanceTo remove the need for independenceTo skip defining scope and jump straight to testingTo define the objective, scope, criteria and evidence strategy before any testing starts

A control's override log exists but has never been reviewed. What does this most likely indicate?

This is not a control weaknessThe override log should be deletedThe control is fully effectiveA detective control exists on paper but isn't operating as intended, since no one is acting on it

What should a management action plan for a finding always include?

Only a general statement of intentA specific action, an accountable owner, and a completion dateOnly the severity ratingThe auditor's personal opinion

What is the difference between a control test and a walkthrough?

Walkthroughs are always more rigorous than testingControl tests never involve inspecting recordsThey are identical activitiesA walkthrough traces one case to confirm the process works as described; a control test usually samples more broadly to assess consistency

What is a 'release-readiness review' meant to confirm?

That the evidence, controls and testing results support release, before launch happensThat the model has the most parameters possibleThat legal sign-off is optionalThat the marketing plan is finalised

Which best distinguishes design effectiveness from operating effectiveness?

Design effectiveness only applies to automated controlsThey are the same testDesign asks if the control could work; operating asks if it actually did work consistentlyOperating effectiveness is assessed before design

What should an 'assurance dashboard' primarily show?

The org chartMarketing metricsControl health, open findings, trend and risk indicators at a glanceOnly the AI model's technical architecture

What's a reasonable assurance conclusion when a control's operating effectiveness could not be evidenced at all?

No conclusion is required in this caseReasonable assuranceLimited or insufficient assurance, since the operating claim can't be supportedFull assurance, since the design looked fine on paper

AI Control Testing, Assurance and Audit Readiness