AI curriculum
Course outline for AI Risk, Compliance and Audit
An action log can show what happened while leaving its approval and control effectiveness unproven. Reconstruct a fictional send incident using versioned policy, input, approval, and final-state evidence. Separate an established unauthorized action from an action whose approval record is missing. Produce a control review that separates design, observed operation, missing evidence, and legal questions.
- Technology
- AI Security, Governance and Trust
- Duration
- 4 hours
- Modules
- 2 · 2 hours each
- Level
- Level 3
About AI Risk, Compliance and Audit
An action log can show what happened while leaving its approval and control effectiveness unproven. Reconstruct a fictional send incident using versioned policy, input, approval, and final-state evidence. Separate an established unauthorized action from an action whose approval record is missing. Produce a control review that separates design, observed operation, missing evidence, and legal questions.
AI Risk, Compliance and Audit Course Objectives
- Link a fictional AI risk to a control owner and testable requirement.
- Separate control design, observed operation, and unresolved effectiveness.
- Reconstruct proposed, approved, and committed actions from supplied records.
- Identify missing evidence, retention needs, and incident-time versions.
- Specify containment, corrective ownership, and a negative retest without asserting legal compliance.
Pre-requisites
- Governance, risk classification, and accountability competence equivalent to AI Governance.
- Familiarity with organizational risk or operational processes.
- Ability to compare records in a document or spreadsheet; coding is not required, and technical trace literacy is optional depth.
Before this course
Complete the required courses or bring equivalent experience. Recommended courses add useful depth; they are not enrolment gates.
Required preparation
Recommended preparation
Can connect policy, risk, accountable owners, and evidence before reviewing controls and incidents; technical traces are helpful supporting material.
Find your place in the learning mapLab Setup
- Computer with a document editor and spreadsheet.
- Use fictional incidents, synthetic audit logs, mock outbox snapshots, and guided control-review fixtures.
- No code, regulated data, production access, or legal-compliance service is required.
Detailed Course Outline
Module 1: Controls and evidence requirements
- Risk management: Link fictional risks to consequences, owners, and treatment decisions; preserve unresolved effectiveness questions rather than treating a control description as assurance.
- Control design: Specify testable requirements, permitted behavior, and failure evidence; distinguish intended protection from observed operation and verified effectiveness.
- Compliance: Separate internal policy requirements from jurisdiction-specific legal questions; identify evidence and specialist follow-up needed without certifying conformity.
- Audit trails: Inspect event completeness, object versions, policy references, and retention needs; distinguish an action record from evidence of valid approval.
Practical outcome: Produce a risk/control matrix separating internal requirements from legal questions, with evidence ownership, incident-time policy versions, and retention requirements.
Module 2: Incident reconstruction and retest
- Decision provenance: Reconstruct proposed, approved, and committed actions with incident-time inputs and policies; mark missing approval evidence without assuming approval was absent.
- Evidence collection: Index supplied records as relevant, conflicting, or missing context; preserve version references and distinguish established facts from unresolved incident claims.
- Incident management: Build an incident timeline, containment decision, and corrective ownership plan; specify a denied-send retest that preserves mock outbox state.
Practical outcome: Reconstruct a fictional send incident, identify missing approval evidence, and define containment, corrective action, and a denied-send retest; do not infer compliance or absent approval from an incomplete transcript.
Practical exercise
- Submit a control matrix, incident timeline, evidence index, and corrective-action/retest record.
- Compare a correctly approved action, an established unauthorized send, a committed action with missing approval evidence, and a log containing inconsistent object versions.
- Account for every supplied record as relevant, conflicting, or missing context; preserve incident-time policy and input references, and mark unknown approval status explicitly.
- Detect every seeded evidence gap, require the unapproved-send retest to leave mock outbox state unchanged, and separate unresolved effectiveness from jurisdiction-specific compliance questions.
What you will produce
Assemble an incident evidence packet and control retest plan without overclaiming compliance.
How the work is checked
- The packet detects missing approval evidence and inconsistent versions in all seeded cases; an absent record alone is not treated as proof of absent approval.
- The matrix separates design, operation, effectiveness gaps, and legal questions.
- The negative retest requires unchanged mock outbox state and a recorded denial.
Four-hour noncoding incident review; evidence-integrity mechanisms, control assurance, and binding compliance conclusions need specialist follow-up.
When another approach is better
- Logs alone are insufficient when completeness, integrity, or approval evidence is missing.
- This fictional review cannot certify compliance or replace jurisdiction-specific legal and audit expertise.
How we train
Contact us for full course details, including duration, delivery options and lab requirements.
Ask about exercises, instructor feedback and the prior knowledge you need. Tool-specific courses marked provisional may become modules in a broader course.
Discuss your learning goals