Module 7 self-check | AI GRCA Practitioner Programme

Why does higher autonomy typically require more attention in MAP?

Greater independent action increases the consequence of an error occurring without a human catching itHigher autonomy always means lower riskAutonomy only matters for hardware robotsIt doesn't — autonomy has no bearing on risk

What does MAP's 'context' work primarily protect against?

Marketing miscommunication onlyNothing — it's a formalityBuilding controls and tests for the wrong problem because the system's real use and risk weren't properly understood firstModel training costs

Which best reflects the relationship between MAP and MEASURE?

They are unrelated and sequential-only with no feedbackMAP identifies what to test for; MEASURE then tests against that mapped context and riskMEASURE happens before MAP in every caseMAP replaces the need for MEASURE

What is the primary purpose of the MAP function?

Board reportingSetting risk appetite policyWriting release evidenceEstablishing context: intended use, affected people, misuse and risk scenarios

What's the risk of skipping 'assumptions and constraints' documentation in MAP?

No risk — assumptions rarely matterKey unverified beliefs (e.g. about data quality or supplier practices) could quietly undermine the whole risk assessmentAssumptions are always self-evidently trueThis step is purely administrative

'External dependencies' in MAP is broader than 'supplier dependencies' because it also includes:

Nothing broader — they are identicalOther environmental factors like data sources, infrastructure or partner systems the AI system relies onOnly competitor productsOnly regulatory bodies

Why should 'assumptions and constraints' be explicitly documented in MAP?

Undocumented assumptions can silently become false without anyone noticing, undermining the risk pictureAssumptions are the same as confirmed factsConstraints only matter for budget planningThey don't need documenting since they're obvious

'Deployment environment' in MAP includes:

Only the vendor's headquarters locationOnly the marketing channelOnly the programming language usedThe operational, physical and organisational setting in which the system is actually used

NIST MAP