CGRC GRC Program — 10 Questions

Question 1

The organization has adopted a 'Defense-in-Depth' strategy. You are tasked with mapping controls to the NIST CSF framework within the GRC tool. What is the most effective way to manage the relationship between framework sub-categories and existing internal controls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use 'Control Mapping' functionality to link internal controls to NIST sub-categories.. Control mapping functionality in a GRC tool allows you to link existing internal controls to multiple framework sub-categories without duplicating or renaming them. This preserves the organization's control taxonomy while demonstrating coverage against NIST CSF sub-categories, and it supports reuse across frameworks (e.g., mapping the same control to NIST CSF, ISO 27001, and SOC 2). It is the standard, scalable way to manage framework-to-control relationships.

Answer

Rename all internal controls to match the NIST sub-category names.

Answer

Create separate GRC instances for every framework adopted.

Answer

Hard-code the NIST framework into the GRC platform source code.

Question 2

A GRC manager is establishing a risk treatment plan for identified risks. The organization's risk appetite is low for regulatory compliance risks. Which two of the following actions are appropriate risk treatment options for a risk that exceeds the risk appetite? (Choose two.)

Accepted Answer

Implement additional controls to reduce the likelihood or impact of the risk.. The correct answers are implementing additional controls (mitigation) and transferring the risk (e.g., insurance or outsourcing). These are proactive treatment options that address risks exceeding appetite. Mitigation reduces the risk, while transfer shifts financial impact. Both are appropriate for regulatory compliance risks when the organization has a low risk appetite and needs to act.

Answer

Avoid the risk by discontinuing the business activity that creates the risk.

Answer

Monitor the risk and reassess it quarterly without taking immediate action.

Answer

Accept the risk without further action because it is within the organization's risk tolerance.

Question 3

When aligning GRC objectives with business goals, which metric best demonstrates the value of an integrated GRC program to a Board of Directors?

Accepted Answer

The percentage reduction in repeat audit findings.. A Board of Directors cares about outcomes that reduce organizational risk and cost while improving compliance posture. A reduction in repeat audit findings demonstrates that the GRC program is not just identifying issues but driving durable remediation — the same problems are not recurring. This metric ties GRC activity directly to improved control effectiveness and lower regulatory exposure, which is the language of the boardroom.

Answer

The number of tickets opened in the GRC helpdesk.

Answer

The total storage space consumed by evidence files.

Answer

The number of users logged into the GRC platform daily.

Question 4

Your GRC program requires that assessment evidence be stored in an immutable state for three years. In the GRC platform, which feature ensures this integrity?

Accepted Answer

Applying an 'Evidence Lock' or 'Retention Policy' to the record.. An 'Evidence Lock' or 'Retention Policy' is the correct feature because it enforces immutability at the record level, preventing modification or deletion for the defined retention period (three years). This satisfies evidentiary integrity requirements by ensuring the evidence cannot be altered after collection. It also produces an auditable control that maps directly to retention and chain-of-custody obligations.

Answer

Disabling the record deletion permission for all users.

Answer

Setting the record visibility to 'Public'.

Answer

Setting the 'Draft' workflow state to permanent.

Question 5

You are configuring a GRC workflow to address 'High' severity findings. The requirement is that any finding classified as 'High' must be approved by the CISO before moving to the 'Remediated' state. Which mechanism should you configure?

Accepted Answer

Set up a Workflow Transition Condition triggered by the 'Severity' field.. To enforce that any finding classified as 'High' severity must be approved by the CISO before transitioning to 'Remediated,' you need a workflow transition condition that evaluates the Severity field and requires CISO approval. This is a conditional workflow rule that gates the state transition based on the finding's severity value, ensuring the approval requirement is applied only to High-severity findings.

Answer

Configure a global Business Rule to auto-close all findings.

Answer

Change the default notification email template for findings.

Answer

Modify the User Permission set for the CISO account.

Question 6

An organization is transitioning from a siloed risk management approach to an integrated GRC program. During the initial implementation, data inconsistency between the Risk Register and the Compliance Control library is observed. Which action best facilitates 'Common Control Framework' (CCF) mapping?

Accepted Answer

Implement a 'Many-to-Many' relationship mapping between Controls and Regulatory Requirements.. A Common Control Framework (CCF) mapping requires establishing relationships between controls and the regulatory requirements they satisfy, so that one control can be reused across multiple requirements and frameworks. A 'Many-to-Many' relationship mapping is the correct mechanism because a single control can satisfy multiple regulatory requirements, and a single requirement can be met by multiple controls. This relationship structure is what enables control reuse, deduplication, and consistent evidence collection across the integrated GRC program.

Answer

Create manual spreadsheets to reconcile the data outside the GRC platform.

Answer

Force all business units to use identical risk taxonomy naming conventions.

Answer

Disable the Regulatory Requirement module to focus only on Risks.

Question 7

A multinational company needs to ensure that GRC data access complies with regional data residency laws. Which configuration feature should be utilized?

Accepted Answer

Implementing 'Data Partitioning' or 'Regional Access Scoping'.. Data residency laws (e.g., GDPR, PIPEDA, Russia's Federal Law No. 242-FZ) require that certain data remain within specific geographic boundaries. Implementing data partitioning or regional access scoping in a GRC platform ensures that data is stored and processed only in approved regions and that access is restricted based on the user's region. This directly addresses the compliance requirement by enforcing logical or physical separation of data.

Answer

Setting all user passwords to match the local language.

Answer

Encrypting the entire GRC database with one key.

Answer

Conducting a system-wide vulnerability scan.

Question 8

The GRC team has determined that 'Residual Risk' is being calculated incorrectly because the 'Control Effectiveness' score is not reflecting the latest audit results. Which architectural fix is required?

Accepted Answer

Configure a 'Dynamic Link' between Audit Testing Results and Risk Rating calculations.. The problem is that Control Effectiveness scores are static and not linked to the latest audit results, causing residual risk to be miscalculated. The architectural fix is to configure a dynamic link (automated data relationship) between Audit Testing Results and Risk Rating calculations so that when audit results change, the control effectiveness score—and therefore residual risk—updates automatically. This ensures the risk calculation reflects current control performance.

Answer

Update the manual risk assessment survey annually.

Answer

Increase the frequency of full organizational risk assessments.

Answer

Require the CISO to manually approve all risk score changes.

Question 9

An organization is integrating its GRC platform with an existing Active Directory infrastructure. To enforce the Principle of Least Privilege for internal auditors, which configuration step should be prioritized?

Accepted Answer

Map Active Directory groups to granular GRC Security Profiles.. Mapping Active Directory groups to granular GRC Security Profiles enforces least privilege by ensuring auditors receive only the permissions their role requires, based on their AD group membership. This leverages existing identity infrastructure (AD) as the source of truth while applying role-based access control within the GRC platform. It is the only option that aligns with least privilege principles.

Answer

Assign Global Administrator rights to the lead auditor.

Answer

Enable Single Sign-On (SSO) for all users globally.

Answer

Configure a shared service account for all audit activities.

Question 10

Which GRC platform component is most critical for ensuring that executive leadership receives accurate, real-time risk posture data?

Accepted Answer

The Executive Dashboard and Reporting module.. The Executive Dashboard and Reporting module is correct because it aggregates risk data from across the GRC platform and presents it in real-time, role-appropriate views for leadership. It provides the visualization, drill-down, and trend analysis executives need to make informed risk decisions. Other components support the data but do not deliver the executive-facing risk posture.

Answer

The system audit log.

Answer

The User Provisioning interface.

Answer

The API integration module.