Where LLMs genuinely help in GRC, where they hallucinate, and how to keep a human in the loop.
50 min 220 XPSkills: AI, Policy
Good at language, indifferent to truth
A language model is excellent at the shape of GRC writing: first drafts, tone, summarising a 90-page standard, proposing candidate mappings between frameworks. It is not a source of authority about what any framework actually says, and it will produce a fluent, correctly formatted, entirely fictional clause reference without hesitation.
So the useful split is between acceleration and assurance. Drafting, summarising and suggesting are acceleration; deciding that a control is adequate, that a mapping is correct, or that a citation exists is assurance, and assurance stays with a named human.
The line is not what the model is good at. It is who is accountable for the output.
Grounding is the difference between a draft and a guess
Retrieval-grounded generation constrains the model to material you supplied: your policies, your control catalog, the actual framework text. Every claim in the answer traces back to a chunk you can open, and an answer with no supporting chunk should be refused rather than improvised.
The measurable win is not that hallucinations vanish: it is that they become detectable. A reviewer can check five citations in two minutes; they cannot check the model's entire training corpus.
Ungrounded output is not automatically wrong. It is unverifiable, which for compliance work is the same problem.
Same question, same model. Only one answer can be checked.
Where the gate goes
Human review has to sit before the point of consequence, not after. A model may draft a policy; a person approves it. A model may propose a control mapping; a person accepts it into the catalog. A model may summarise evidence; a person signs the assertion.
Review is only real if the reviewer has both the time and the material to disagree. A gate that presents 40 mappings with an Accept All button is a rubber stamp with a governance diagram attached.
What you put in the prompt is a disclosure
Pasting audit findings, customer data or unreleased incident detail into a third-party model is a disclosure to a processor, and it needs the same treatment as any other one: a data flow, a contract, a retention position, and a written statement about training use.
Give people a sanctioned tool and clear rules about what may go into it. A blanket ban produces the same disclosures through personal accounts, where you have no contract, no logs and no idea it happened.
Treat the assistant as a system under governance
Log the prompt, the retrieved sources, the output and the reviewer's decision. That log is what lets you answer an auditor asking how AI is used in your compliance process, and it is what lets you spot the day the model output quietly got worse after a version change.
Then measure the thing that matters: the reviewer's edit and rejection rate. If nothing ever gets rejected, either the model is remarkable or the gate is decorative.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: Clause 8.24
Scenario sim+75 XP
Name the technique that would have prevented it, then what every published claim must carry.
Incident brief
An analyst asks a model to justify a new AI oversight policy against ISO 27001, and it returns a confident paragraph citing "ISO/IEC 27001:2022 Annex A 8.24: AI System Governance".
The paragraph is well written, correctly formatted, and goes into the policy pack that ships to three enterprise customers. A customer's assessor points out that A.8.24 is about cryptography, and there is no AI governance clause in Annex A at all.
The model was never given the standard's text. It was asked from memory.
1.1Name the technique that would have prevented the fabricated clause. (one word)
1.2Name what every published claim must carry. (one word)
Task 2: Accept all
Scenario sim+75 XP
Name what the review gate has become, then the metric that would have revealed it.
Incident brief
A mapping assistant proposes crosswalks between the internal catalog and ISO 27001. The workflow diagram shows a human approval step, and the program describes itself as human-in-the-loop.
In practice the interface presents 40 proposed mappings per screen with a single Accept All control. Over four months, 1,180 mappings were accepted and 3 were edited.
An auditor samples 20 and finds 6 mapped to withdrawn or unrelated requirements.
Term bank, not all of these are right
rubber stamprejection ratehuman in the loopthroughputgroundingsampling
2.1Name what the approval step has actually become. (two words)
2.2Name the metric that would have revealed it. (two words)
Task 3: Pasted into a personal account
Scenario sim+70 XP
Name what the paste legally constituted, then the governance response that prevents it.
Incident brief
The company bans AI tools for compliance work after a nervous board discussion. No tool is provided and no rules are written beyond the ban.
Two months later a manager preparing a customer questionnaire pastes the draft SOC 2 exception list, including two unremediated findings and a customer name, into a consumer chatbot on a personal account, to "tidy the wording".
There is no contract with that provider, no retention position, no log, and the company learns about it from the manager months later.
Term bank, not all of these are right
disclosuresanctioned toolshadow aidata classificationprocessoracceptable use
3.1Name what pasting the exception list legally constituted. (one word)
3.2Name the governance response that prevents it. (two words)
Labs
80 bonus XP
Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.
A director wants the assistant to "just publish the updated policies: it cites the standard, so it must be right", and suggests pasting the HR case notes in for context.
Models produce plausible text, including plausible citations. Define the workflow: what the model is allowed to do, who signs off, what it is grounded in, how its citations are verified, and what gets recorded.
Workflow vocabulary and available sources
model_role options: draft | review | approve | publish
Grounding sources available:
standards-repo (approved, version-controlled control library)
model_knowledge (whatever the model absorbed in training)
hr-case-notes (contains employee names and grievances)
Sign-off teams: policy-office, internal-audit, control-owners
Every generated draft must be reproducible: prompt, model version,
source revision and approver are the minimum record.
A model drafted six clauses for the new access control standard in about nine seconds. The policy office wants to publish this afternoon.
Accept the clauses that are grounded and testable. Reject the ones that cite something that does not exist, assert a fact nobody can check, drift outside the standard's subject, or say nothing an auditor could test.
Verdicts are accept or reject. Every rejection needs one reason code from: hallucinated-citation | unverifiable-claim | not-testable | out-of-scope.
Model output (unedited)
M-1 "Administrative access to production requires phishing-resistant MFA."
M-2 "This standard implements ISO 27001:2022 control A.19.4 on privileged identity."
M-3 "Access is reviewed by management on a regular and appropriate basis."
M-4 "All privileged sessions are recorded and retained for 365 days."
M-5 "Our organisation has never experienced an access-related incident."
M-6 "Employees should also consider the environmental impact of their workstation usage."
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · AI & Advanced
Governing AI Systems
NIST AI RMF and EU AI Act obligations translated into controls you can actually operate.
