Week 21 self-check | AI GRCA Practice Lab

WEEK 21 · Controls, operations & judgement · AI Control Testing, Assurance and Audit Readiness

What does 'inspection' mean as an evidence-gathering method?

Watching someone perform a taskAsking someone a questionExamining records, documents or system configurations directlyRedoing the control yourself

WEEK 21 · Controls, operations & judgement · AI Control Testing, Assurance and Audit Readiness

What is the primary purpose of assurance planning before testing begins?

To define the objective, scope, criteria and evidence strategy before any testing startsTo guarantee a positive conclusion in advanceTo remove the need for independenceTo skip defining scope and jump straight to testing

WEEK 21 · Controls, operations & judgement · AI Control Testing, Assurance and Audit Readiness

A control's override log exists but has never been reviewed. What does this most likely indicate?

A detective control exists on paper but isn't operating as intended, since no one is acting on itThis is not a control weaknessThe override log should be deletedThe control is fully effective

WEEK 21 · Controls, operations & judgement · AI Control Testing, Assurance and Audit Readiness

What should a management action plan for a finding always include?

Only the severity ratingThe auditor's personal opinionOnly a general statement of intentA specific action, an accountable owner, and a completion date

WEEK 21 · Controls, operations & judgement · AI Control Testing, Assurance and Audit Readiness

What is the difference between a control test and a walkthrough?

Walkthroughs are always more rigorous than testingControl tests never involve inspecting recordsThey are identical activitiesA walkthrough traces one case to confirm the process works as described; a control test usually samples more broadly to assess consistency

WEEK 21 · Controls, operations & judgement · AI Control Testing, Assurance and Audit Readiness

What is a 'release-readiness review' meant to confirm?

That the marketing plan is finalisedThat the evidence, controls and testing results support release, before launch happensThat the model has the most parameters possibleThat legal sign-off is optional

WEEK 21 · Controls, operations & judgement · AI Control Testing, Assurance and Audit Readiness

Which best distinguishes design effectiveness from operating effectiveness?

They are the same testDesign asks if the control could work; operating asks if it actually did work consistentlyOperating effectiveness is assessed before designDesign effectiveness only applies to automated controls

WEEK 21 · Controls, operations & judgement · AI Control Testing, Assurance and Audit Readiness

What should an 'assurance dashboard' primarily show?

Control health, open findings, trend and risk indicators at a glanceOnly the AI model's technical architectureThe org chartMarketing metrics

WEEK 21 · Controls, operations & judgement · AI Control Testing, Assurance and Audit Readiness

What's a reasonable assurance conclusion when a control's operating effectiveness could not be evidenced at all?

No conclusion is required in this caseReasonable assuranceLimited or insufficient assurance, since the operating claim can't be supportedFull assurance, since the design looked fine on paper