CA ANZ Core 2: Risk, Technology and AI study plan

Distinguish risk, uncertainty and opportunity, then classify twelve sample risk events by source (strategic, operational, financial, compliance, technology) and by whether they are pure or speculative.

Compare an enterprise risk management framework, an ISO-style risk management process and a three-lines accountability model on scope, components and intended users, and state which you would apply to a mid-sized technology-dependent entity and why.

Draft a risk appetite and tolerance statement covering three risk categories, each with a quantified tolerance threshold and an escalation trigger.

Apply a 5x5 likelihood-consequence matrix to ten scenarios, calculate inherent ratings, and justify the ranking of the top three in writing.

Select and apply two risk assessment techniques (for example a bow-tie analysis and a failure modes and effects analysis) to one operational process and record the outputs in a structured worksheet.

Evaluate the five treatment options (avoid, reduce, transfer, share, accept) for the top five risks and justify the chosen treatment with reference to cost versus residual exposure.

Assign an owner, due date, treatment action and target residual rating to each of the top five risks, and define the monitoring frequency for each.

Build a first-pass inventory of fifteen technology assets and supporting processes, tagging each with a confidentiality, integrity and availability rating.

Map two core transaction cycles end to end and identify where application controls (input, processing, output) and automated matching controls sit within each.

Classify fourteen general IT controls into change management, access management, IT operations and program development, and explain what could go wrong if each failed.

Design a test of operating effectiveness for one change management control, specifying the population, sampling approach, evidence to inspect and exception criteria.

Analyse a segregation-of-duties conflict scenario in an enterprise system and propose two compensating controls with their limitations.

Explain the confidentiality, integrity and availability triad and match eight common threat types (for example phishing, ransomware, insider misuse, third-party failure) to the element they most threaten.

Sequence the phases of an incident response process and specify the evidence, communication and reporting obligations at each phase.

Assess one security incident scenario to determine whether it is a control deficiency, a significant deficiency or a material weakness, and justify the conclusion.

Interpret what an assurance provider's opinion on control effectiveness does and does not cover, and state the limits of that assurance for the governing body.

Differentiate preventive, detective and corrective controls and reclassify ten controls drawn from a revenue and a procurement process accordingly.

Distinguish control design deficiency from operating effectiveness failure, and diagnose which applies to six described situations.

Evaluate the sufficiency and appropriateness of audit evidence for three control tests, identifying where evidence is unreliable or incomplete.

Prepare a deficiency memo that rates six deficiencies by severity and specifies the compensating controls and remediation actions for each.

Describe how a governing body discharges oversight of technology and data, including the questions it should ask about risk appetite, reporting lines and escalation.

Apply the five threats to independence and objectivity (self-interest, self-review, advocacy, familiarity, intimidation) to four technology-enabled engagement scenarios and select the appropriate safeguard for each.

Evaluate a data privacy scenario against confidentiality and privacy obligations, and identify the required notifications and records.

Draft an escalation note for a whistleblowing or ethical conflict situation that states the facts, the applicable obligation and the recommended course of action.

Assess a twenty-row dataset against six data quality dimensions and classify each defect found as a validity, completeness, accuracy or consistency issue.

Select an appropriate analytical technique (trend, ratio, segmentation, correlation or full-population testing) for four decision questions and justify each choice.

Design three decision-support indicators, each with a definition, data source, calculation logic and a stated limitation.

Explain how a machine learning model is trained, validated and monitored, and identify three risks specific to using it in a financial reporting or assurance context.

Interpret governance requirements for artificial intelligence systems, covering accountability, transparency, human oversight and bias monitoring, and apply them to one automated decision-making scenario.

Synthesise domains 1 to 6 by answering 60 mixed practice questions under timed conditions and categorising every error by domain and by cause.

Re-teach your three weakest topics from memory using a one-page summary each, then verify against your study notes and correct any gaps.

Construct a personal exam-day plan covering time allocation per domain, question triage rules and a check routine for scenario-based questions.