Module 9 self-check | AI GRCA Practitioner Programme

How should a confirmed incident feed back into MANAGE's broader risk treatment process?

Incidents should be resolved and then forgotten with no wider follow-upLessons from the incident should inform whether existing treatment, controls or monitoring need to be strengthenedIncidents only need to be reported to affected customers, nothing elseIncident learnings are only relevant to the specific engineer involved

What is a realistic early-warning 'risk indicator' MANAGE might monitor after release?

A rising override or exception rate that could signal declining model reliabilityOnly office attendance figuresOnly marketing engagement metricsOnly the company's stock price

'Release gates' in MANAGE function as:

A synonym for a risk register entryOptional suggestions with no real effectDefined checkpoints that must be passed before a system can be released or scaledOnly relevant to hardware releases

Which best reflects a 'reduce' treatment, as distinct from 'avoid'?

Reduce is only used for low-severity risksReduce means not building the system at allReduce means keeping the system but adding controls that lower the risk to an acceptable levelAvoid and reduce are identical strategies

A rollback plan is important because:

It's never actually neededIt lets the organisation revert to a safe prior state if a release causes harmIt replaces the need for testingIt's only relevant to database migrations

Why might 'geographic restriction' be a more proportionate response than full deactivation?

Geographic restriction is never a valid optionIt can address a region-specific legal or risk issue without disrupting service where the issue doesn't applyFull deactivation is always the only valid response to any issueGeographic restriction and deactivation are the same action

What is the primary purpose of the MANAGE function?

Defining intended usePrioritising risk and deciding treatment, release controls and monitoringWriting test scriptsBoard induction training

A 'localisation/geographic restriction policy' addresses:

Only marketing localisationOnly applies to hardwareOnly translation qualityRestricting where data or system operation occurs, often for legal or risk reasons

NIST MANAGE and Risk Treatment