Module 3 self-check | AI GRCA Practitioner Programme

Which best distinguishes governance from risk management?

They are identical activitiesGovernance sets direction and accountability; risk management identifies and treats uncertainty within that directionRisk management is done only by the boardGovernance only applies after an incident

Risk tolerance is best described as:

A synonym for a control activityOnly relevant to cybersecurityIdentical to risk appetiteThe specific, measurable thresholds within the broader risk appetite that trigger escalation

What's the practical consequence of an organisation having no defined risk appetite for AI?

Undefined appetite automatically defaults to zero risk toleranceUndefined appetite means every risk must be escalated to the boardNothing — appetite is a purely theoretical conceptDecisions about what risk to accept get made inconsistently, without a shared reference point

What does 'evidence' mean in a GRC context?

Something inspectable that demonstrates a control operated or a risk was properly assessedOnly relevant to court proceedingsA requirement only for third-party auditsA synonym for opinion

How does a 'risk' differ from an 'incident'?

Risks only exist after an incident has happenedThey are identical termsA risk is a possible future event with uncertain outcome; an incident is something that has already occurredIncidents are always less serious than risks

What is the 'second line' in the three lines of defence model?

The team that owns and operates the AI systemRisk, compliance and similar functions providing oversight and challenge to the first lineExternal regulatorsA synonym for internal audit

Why is 'governance vs management' a common source of confusion in practice?

They are truly identical and confusion is unwarrantedBecause the same people sometimes wear both hats, but the roles — setting direction vs executing decisions — are conceptually distinctBecause governance never actually happens in practiceBecause management only exists in large organisations

What is an audit trail for, in practical terms?

To let someone reconstruct what decision was made, by whom, on what evidenceOnly required for financial systemsA synonym for a risk registerTo make reports longer

Governance, Risk, Compliance & Assurance Basics