Module 22 self-check | AI GRCA Practitioner Programme

What is the purpose of an 'exceptions and waivers' process?

To let anyone bypass governance permanentlyTo allow a documented, time-limited departure from standard process, with a compensating control and named approverExceptions should never be granted under any circumstanceWaivers remove the need for any future review

What is the purpose of an integrated AI governance lifecycle?

To apply only to generative AI systemsTo slow down every AI project equallyTo connect intake, risk tiering, specialist review, release, monitoring and retirement into one coherent processTo replace the need for any specialist legal or privacy review

What's a reasonable trigger for a 'security review' at intake?

Security review is only needed after a breachSecurity review only applies to open-source systemsThe system has no external connections and processes no sensitive dataThe system integrates with external tools, APIs or handles sensitive data

What's the difference between 'risk acceptance' and simply ignoring a risk?

They are the same thing in practiceRisk acceptance is a deliberate, documented decision by an authorised role; ignoring is an absence of any decisionIgnoring a risk is always the safer optionRisk acceptance means the risk no longer exists

What is an 'external communication plan' for AI incidents meant to define?

A synonym for the model cardNothing — communication should be improvisedWho is told what, when, by whom, and how uncertainty is acknowledged if a real-world impact occursOnly the internal engineering response

What's a key governance trade-off between hosted and self-hosted deployment?

Self-hosting always eliminates the need for security controlsHosted deployment is always illegal under UK GDPRNo meaningful trade-off existsHosted deployment can mean less operational burden but less control over data location; self-hosting reverses that

Which trigger would most likely require a DPIA screening at intake?

The system is only used internally by two peopleThe system has no connection to any personal dataThe system processes no personal data at allThe system profiles individuals at scale for a decision with potential significant effect

What belongs in the 'retirement' stage of the AI lifecycle?

Data handling, supplier exit, evidence retention and communication to affected people, as relevantImmediate deletion of all records with no retentionTransferring accountability to the AI system itselfNothing further once a system stops being used

Which vendor contract term most directly addresses the supplier's right to inspect or verify compliance claims?

Export restrictionsCompliance supportIndemnityAudit rights

Integrated AI Governance Operating Model