CA ANZ Core 2: Risk, Technology and AI cheat sheet

Risk is the effect of uncertainty on objectives; it can create downside exposure or upside opportunity.

The risk assessment process identifies, analyses, and evaluates risk, then selects treatment: avoid, reduce, transfer, or accept.

Inherent risk is assessed before controls; residual risk is assessed after controls and compared with risk appetite.

A common qualitative risk score is likelihood multiplied by consequence; scores support prioritisation, not precise measurement.

Risk appetite is the amount and type of risk an organisation is willing to pursue or retain; risk tolerance is acceptable variation around that appetite.

ISO 31000 emphasises a principles-based framework and a process integrated into governance, strategy, planning, and continual improvement.

COSO ERM has five components: governance and culture, strategy and objective-setting, performance, review and revision, and information, communication, and reporting.

The three lines model separates management ownership of risk, risk and compliance oversight, and independent internal audit assurance.

A risk register records risk descriptions, causes, consequences, owners, ratings, controls, treatments, and review dates; key risk indicators use thresholds to signal rising exposure.

Governance sets direction through board oversight, delegated authority, policies, accountability, and performance monitoring.

Core ethical obligations include integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour.

Technology governance assigns accountability for IT strategy, cyber risk, data, AI, outsourcing, and regulatory compliance across board and management roles.

Segregation of duties separates incompatible functions such as authorising, recording, and custody; compensating controls are used where separation is impractical.

Common privacy principles include collection limitation, purpose specification, use limitation, security safeguards, access and correction rights, and accountability.

Speak-up channels, conflict-of-interest declarations, code-of-conduct training, and disciplinary processes support ethical culture and early risk detection.

Outsourcing and cloud arrangements do not transfer accountability; due diligence, contract terms, monitoring, audit rights, and exit plans remain necessary.

Professional scepticism requires questioning evidence, considering bias and error, and not accepting reports, models, or management explanations without validation.

Compliance obligations commonly include privacy, records retention, confidentiality, consumer protection, and sector-specific rules; these should be mapped to controls and monitoring.

An information system comprises people, processes, data, software, hardware, and networks working together to support business objectives.

IT general controls support reliable application controls and include access management, change management, IT operations, backup and recovery, and program development.

Application controls cover input, processing, and output, addressing completeness, accuracy, validity, authorisation, and error handling.

The CIA triad classifies security objectives as confidentiality, integrity, and availability.

Authentication verifies identity, authorisation grants permissions, and accounting or audit logging records activity for accountability.

Defence in depth layers preventive, detective, and corrective controls across people, processes, and technology so one failure does not cause a breach.

Least privilege grants only the access needed for a role; periodic access reviews, timely revocation, and privileged-access monitoring reduce misuse.

The 3-2-1 backup rule keeps three copies on two media types, with one copy offsite or offline; restores should be tested.

Incident response typically covers preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned; the NIST Cybersecurity Framework core functions are identify, protect, detect, respond, and recover.

Data quality dimensions include accuracy, completeness, consistency, timeliness, validity, and uniqueness; fitness for purpose depends on the decision use.

The data lifecycle covers acquisition, validation, storage, use, sharing, archiving, and disposal, with controls at each stage.

Analytics types are descriptive for what happened, diagnostic for why it happened, predictive for what may happen, and prescriptive for what action is indicated.

ETL means extract, transform, and load; data lineage documents origin and transformation to support auditability and impact analysis.

Sampling risk is the risk that sample conclusions differ from population conclusions; non-sampling risk arises from human error, poor design, or misinterpretation.

Key performance indicators measure progress toward objectives; key risk indicators signal changes in risk exposure and often use thresholds or exception reporting.

Data governance assigns ownership and stewardship and defines metadata, master data, quality rules, access rights, and issue escalation.

Visualisations should use appropriate scales and baselines; truncated axes, misleading groupings, or cherry-picked periods can distort interpretation.

Correlation does not establish causation; decision-makers should test alternative explanations and consider confounding variables before acting.

The AI lifecycle includes problem definition, data preparation, model development, validation, deployment, monitoring, and retirement.

Machine learning types include supervised learning from labelled data, unsupervised learning for patterns, and reinforcement learning from feedback.

Model risk arises from inaccurate outputs, overfitting, bias, drift, opacity, and inappropriate use; validation and ongoing monitoring are key controls.

Generative AI risks include hallucination, data leakage, intellectual-property exposure, prompt injection, and deepfakes.

High-impact AI decisions may require human-in-the-loop review, explainability, contestability, and audit trails to support accountability.

AI governance includes an inventory of systems, risk classification, assigned ownership, documentation, testing, monitoring, and incident response.

Training data quality, representativeness, and labelling affect fairness and accuracy; bias testing should cover relevant groups and use cases.

Model monitoring covers performance metrics, data and concept drift, exception rates, and periodic revalidation.

Emerging technologies such as robotic process automation, blockchain, Internet of Things, and cloud change the control environment and create new assurance needs.

Internal control is a process effected by people and designed to provide reasonable assurance over operations, reporting, and compliance objectives.

The COSO internal control framework has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

Control activities include authorisations, reconciliations, segregation of duties, physical safeguards, reviews, and IT controls.

Preventive controls stop errors or fraud before they occur; detective controls identify them afterwards; corrective controls restore or remediate.

Control testing considers design effectiveness and operating effectiveness, using evidence, samples, reperformance, observation, or inquiry.

Assurance mapping links objectives and risks to first-line controls, second-line risk and compliance oversight, third-line internal audit, and external audit where relevant.

Internal control has inherent limitations including human error, collusion, management override, and cost-benefit constraints; assurance is reasonable, not absolute.

Control deficiencies may be classified by severity as deficiency, significant deficiency, or material weakness, considering likelihood and potential impact.

Risk responses are avoid, reduce, transfer, or accept; remediation plans should record owners, actions, resources, deadlines, and verification of completion.