Module 6 self-check | AI GRCA Practitioner Programme

What's a realistic consequence of poor supplier governance?

Supplier governance is optional for SaaS-based AI toolsNo consequence — suppliers are always trustworthyA supplier could change a model with no notice, degrading performance without the organisation knowingSupplier governance only affects cost, not risk

Which is the best example of a 'developer' role, distinct from 'provider'?

The organisation marketing the finished AI product to customersThe team or organisation that builds the underlying model or system componentsThe end customer using the toolThe regulator overseeing the sector

How should 'approval gates' differ for a low-risk internal tool versus a high-risk customer-facing system?

Gates should be proportionate — more rigorous scrutiny and higher-level sign-off for higher-risk systemsLow-risk tools should have more gates than high-risk onesApproval gates only apply to customer-facing systemsThey should be identical regardless of risk

What is the purpose of 'AI literacy and training' as a GOVERN activity?

Training replaces the need for any policyOnly developers need AI literacyIt's a nice-to-have with no real functionPolicies and controls only work if the people applying them understand the underlying AI risk

What distinguishes 'model ownership' from 'product ownership' in AI governance?

They are identical rolesModel ownership concerns the technical model itself; product ownership concerns the overall business offering built on itProduct ownership only applies to hardwareModel ownership is always more senior

Why does 'AI ownership' need to be distinct from general IT ownership?

IT ownership is always sufficientAI ownership is a redundant conceptAI systems carry no distinct risk from other softwareAI systems raise specific risks (bias, hallucination, autonomy) that general IT ownership models may not cover

In the developer/provider/deployer/user responsibility mapping, who is the 'deployer'?

Only the affected personThe software vendor's marketing teamThe person who trains the original modelThe organisation putting the AI system into use within its own operations

What is the primary purpose of the GOVERN function?

Mapping affected peopleTesting model accuracyEstablishing accountability, policy, ownership and risk culture for AIWriting release notes

NIST GOVERN