CA ANZ Core 2: Risk, Technology and AI

Expect a mix of multiple-choice questions testing discrete concepts and longer case-based constructed-response tasks where you apply risk, control and technology reasoning to a realistic scenario. Delivery is online, either in a test centre or by remote invigilation. CA ANZ publishes the authoritative current format, structure and weightings on its program site.

Most candidates find the concepts accessible but the application demanding. Nothing requires deep mathematics, yet the constructed-response tasks penalise vague answers. The difficulty comes from judgement: choosing the most material risk, distinguishing a detective control from a preventive one, and justifying a conclusion from the facts given in the case.

No. You need working literacy in IT general controls, access management, change control, cybersecurity and data quality, plus a clear view of how automated controls fail. Candidates from audit or finance roles usually acquire this within a few weeks of structured study; genuine programmers are not advantaged, because the exam tests governance and assurance judgement rather than coding.

Plan for several weeks of consistent work rather than a last-minute sprint, and protect time for practising written answers, not only reading. Because the official module duration and recommended study hours are set by CA ANZ, check the current published guidance for the expected workload and align your schedule to the assessment window you have booked.

Start with risk concepts and frameworks, because the vocabulary of likelihood, consequence, appetite and tolerance underpins everything later. Move to governance and ethics, then IT general controls and cybersecurity, then data analytics and AI, and finish with internal control and assurance responses. That order lets each later topic reuse reasoning you have already rehearsed.

Three recurring causes: answering the question they wished had been asked rather than the one on the page; listing controls without linking each to a specific risk and case fact; and running out of structure, so strong points appear as unstructured prose. Practising under timed conditions and using a risk-to-control-to-evidence template fixes most of this.

Typically through governance and assurance lenses rather than model mechanics: data quality and bias, model risk and validation, explainability, privacy, accountability for automated decisions, and the auditability of AI-assisted outputs. You should be able to argue both the opportunity and the control gap in a given scenario, and recommend proportionate oversight.

Retake, deferral and supplementary assessment provisions change periodically, and each has eligibility conditions and cut-off dates attached. Rather than rely on second-hand accounts, confirm the current rules, any associated charges and the implications for your enrolment timeline directly with CA ANZ before making decisions about your study plan.

Treat them as diagnostics, not revision. Attempt a set closed-book, then mark your reasoning against the intended approach and note whether the error was knowledge, misread requirements or weak structure. Weight your remaining study toward the second and third categories, since those are the errors that most reliably cost marks on the day.