CGRC GRC Program Practice Test 3 — 15 Questions

Question 1

When aligning GRC with business objectives, which THREE of the following represent effective strategic alignment?

Accepted Answer

Mapping risk categories to specific business processes.. Option A is correct because mapping risk categories to specific business processes ties governance and risk work directly to the value streams and operations the business cares about, ensuring controls and treatments are relevant rather than generic. Option C is correct because measuring the impact of GRC activities on organizational KPI targets demonstrates and steers GRC toward measurable business outcomes, enabling continuous alignment and prioritization. Option D is correct because involving business owners in the risk assessment process embeds business context, ownership, and accountability into risk decisions, which is a hallmark of strategic alignment between GRC and business objectives. Option B does not belong because focusing exclusively on technical vulnerability patching is a narrow, tactical IT activity that ignores broader business risk and strategic priorities. Option E does not belong because allowing IT teams to ignore GRC policies for speed undermines governance, increases unmanaged risk, and directly conflicts with aligning GRC to business objectives.

Answer

Focusing exclusively on technical vulnerability patching.

Answer

Allowing IT teams to ignore GRC policies for speed.

Question 2

Which THREE of the following represent common challenges in maintaining an integrated GRC program?

Accepted Answer

Ensuring leadership support is sustained over time.. Option A is correct because sustained executive sponsorship is one of the most frequently cited challenges in integrated GRC programs; leadership priorities shift, budgets get reallocated, and momentum fades, so keeping continuous top-management commitment is difficult. Option D is correct because integrated GRC requires sharing risk, compliance, and control data across functions such as legal, IT, audit, and operations, and entrenched departmental silos block that information flow and create duplicated or conflicting risk views. Option E is correct because regulations, standards, and threat landscapes change continuously (for example GDPR, HIPAA, PCI DSS updates), forcing the GRC program to constantly re-map controls, reassess risks, and update reporting. Option B is not a core GRC challenge because branding and visual identity are cosmetic concerns that do not affect governance, risk, or compliance integration. Option C is not a challenge to maintaining an integrated program but rather the opposite of integration—restricting the platform to one department defeats the purpose of an enterprise-wide GRC program and is a design flaw, not a common maintenance challenge.

Answer

Ensuring the GRC platform looks visually identical to the company brand.

Answer

Limiting the GRC platform to only one department.

Question 3

When structuring a GRC program, which THREE components are critical for compliance management?

Accepted Answer

Centralized Policy Management library.. Centralized Policy Management library (A) is critical because it provides a single authoritative repository where policies are authored, versioned, approved, and distributed, ensuring consistent compliance obligations across the organization. A Comprehensive Control Library for mapping (B) is essential because it lets controls be mapped to frameworks, regulations, and risks, enabling gap analysis and evidence reuse across standards such as ISO 27001, SOC 2, and NIST. Audit and Issue tracking workflows (E) are required to log findings, assign remediation owners, track due dates, and retain evidence of corrective actions, which is the operational backbone of compliance monitoring. The remaining options do not belong: changing the system interface font (C) is a cosmetic UI preference with no bearing on governance, risk, or compliance, and a marketing tool for company social events (D) is unrelated to compliance management.

Answer

A feature to change the font of the system interface.

Answer

A marketing tool for company social events.

Question 4

A GRC analyst is designing a process to continuously identify changes in the external regulatory environment that could affect the organization's compliance posture. The organization operates in multiple jurisdictions and wants to avoid manual, ad-hoc tracking. Which approach best supports this requirement?

Accepted Answer

Subscribe to regulatory intelligence feeds and integrate them into the GRC platform to automatically flag relevant changes.. Integrating regulatory intelligence feeds into the GRC platform enables automated, continuous tracking of regulatory changes across jurisdictions. This allows the organization to quickly assess impact, map changes to controls, and take action, which is essential for maintaining compliance in a dynamic environment. Manual or periodic methods are insufficient for timely identification and response.

Answer

Assign a compliance officer to manually review government websites weekly and log changes in a spreadsheet.

Answer

Rely on external auditors to identify regulatory changes during annual audits.

Answer

Conduct an annual internal review of all regulations and update the compliance register accordingly.

Question 5

A GRC manager is establishing a process to manage exceptions to security policies. The goal is to ensure that exceptions are granted only when justified, have a defined expiration, and are reviewed regularly. Which TWO of the following are essential components of this exception management process? (Choose two.)

Accepted Answer

Automatic expiration of exceptions after a predefined period, with notification to the requester for renewal.. A risk-based approval workflow ensures that exceptions are authorized by the right stakeholders, while automatic expiration with renewal notifications enforces periodic review. Together, these components prevent exceptions from becoming permanent and ensure they are justified at the time of renewal. Other options either create bottlenecks, lack controls, or fail to enforce review.

Answer

Storing all exception requests in a shared spreadsheet that is accessible to the entire IT department.

Answer

Allowing exceptions to remain active indefinitely as long as the requester provides a verbal justification.

Answer

A requirement that all exception requests be approved by the Chief Information Security Officer (CISO) regardless of risk level.

Question 6

A GRC team is defining the scope of its governance program. The organization wants to ensure that all relevant stakeholders are aware of their roles and responsibilities regarding risk and compliance. Which artifact is most appropriate to document and communicate this information?

Accepted Answer

A RACI matrix that maps GRC activities to roles across the organization.. A RACI matrix is specifically designed to clarify roles and responsibilities for activities and decisions. By mapping GRC activities to roles, it ensures stakeholders know what is expected of them, reducing confusion and enhancing accountability. Other artifacts serve different purposes, such as risk documentation, scheduling, or continuity planning, and do not address role clarity.

Answer

A risk register that lists all identified risks and their owners.

Answer

A compliance calendar that schedules regulatory reporting deadlines.

Answer

A business impact analysis (BIA) that identifies critical business processes.

Question 7

A financial services firm is expanding its GRC program and needs to establish a formal governance structure. The Chief Information Security Officer (CISO) has been asked to define the roles and responsibilities for overseeing risk decisions across business units. Which of the following is the MOST appropriate first step to ensure accountability and alignment with organizational objectives?

Accepted Answer

Create a Risk Management Charter that defines the governance structure, roles, and decision-making authority.. Establishing a formal governance structure begins with a Risk Management Charter, which defines the program's authority, scope, roles, and decision-making processes. This document ensures that all subsequent activities—such as risk assessments, tool implementation, and register creation—are aligned with organizational objectives and have clear accountability. Without this foundation, GRC efforts risk being fragmented and ineffective.

Answer

Develop a risk register that captures all identified risks and assigns risk owners.

Answer

Conduct a risk assessment workshop with business unit leaders to identify top risks.

Answer

Implement a GRC tool to automate risk assessments and reporting across all business units.

Question 8

A financial services firm is implementing a GRC program to satisfy multiple regulatory frameworks (e.g., GDPR, SOX, PCI DSS). The compliance team currently maps controls separately for each regulation, resulting in duplicated effort and inconsistent evidence. The CISO wants to streamline by identifying common controls that satisfy multiple requirements. Which approach should the GRC practitioner recommend?

Accepted Answer

Implement a control mapping matrix that links each regulatory requirement to a unified set of internal controls, enabling reuse of evidence across frameworks.. The correct answer is to implement a control mapping matrix that links regulatory requirements to a unified set of internal controls. This enables the organization to collect evidence once and reuse it across multiple frameworks, reducing duplication and improving consistency. It is a foundational GRC practice for managing multiple regulations efficiently and is scalable as new requirements emerge.

Answer

Create separate GRC workspaces for each regulation to ensure regulatory-specific evidence is isolated and auditors cannot confuse requirements.

Answer

Outsource all compliance mapping to an external auditor who will provide a unified control set annually.

Answer

Adopt the strictest requirement from each regulation as the baseline control and apply it universally, ignoring overlaps.

Question 9

A healthcare organization is updating its risk management methodology. The GRC team wants to ensure that risk assessments consistently consider the potential impact on patient safety, regulatory compliance, and financial performance. The CISO requests a quantitative approach to prioritize risks for mitigation funding. Which risk analysis method BEST meets these requirements?

Accepted Answer

Quantitative risk assessment using Monte Carlo simulation and annualized loss expectancy (ALE).. Quantitative risk assessment, particularly with Monte Carlo simulation and ALE, provides the numerical rigor needed to prioritize risks based on financial impact and probability. This method translates risk into monetary terms, enabling objective comparison and cost-benefit analysis for mitigation funding. It also allows for modeling uncertainty, which is essential in healthcare where impacts on patient safety and compliance can be difficult to quantify but must be considered.

Answer

Qualitative risk assessment using a likelihood-impact matrix with predefined risk levels.

Answer

Control self-assessment (CSA) workshops to identify control gaps and prioritize remediation.

Answer

Semi-quantitative risk assessment using numerical scales for likelihood and impact.

Question 10

A healthcare organization's GRC team is defining key risk indicators (KRIs) for its patient data protection program. The CISO wants KRIs that are predictive of potential breaches, not just historical metrics. Which of the following should the GRC practitioner recommend as a leading KRI?

Accepted Answer

Percentage of critical systems with unpatched vulnerabilities older than 30 days.. The correct answer is the percentage of critical systems with unpatched vulnerabilities older than 30 days. This is a leading KRI because it measures a condition that increases the likelihood of a breach before it happens. It is actionable and predictive, enabling the organization to prioritize remediation and reduce risk proactively, which is exactly what the CISO requested.

Answer

Total number of security awareness training completions in the last quarter.

Answer

Number of past data breach incidents involving patient records.

Answer

Average time to detect a security incident after it occurs.

Question 11

A healthcare payer's GRC team is building a new compliance program for a recently acquired subsidiary that processes protected health information. Executive leadership wants assurance that the program's scope, authority, and reporting lines are formally documented and approved before any control testing begins. Which artifact should the GRC practitioner produce FIRST to satisfy this expectation?

Accepted Answer

A compliance program charter defining mandate, scope, roles, and reporting relationships. The scenario emphasizes documented scope, authority, and reporting lines approved before testing. A compliance program charter is the governance artifact that establishes mandate, scope, roles, and reporting structure, making it the necessary first step. Other listed artifacts are downstream deliverables that depend on the charter for defined boundaries, ownership, and escalation paths.

Answer

A control testing schedule covering all systems in the subsidiary

Answer

A statement of applicability mapping HIPAA requirements to implemented controls

Answer

A risk register listing the subsidiary's top information security risks

Question 12

A multinational corporation is implementing a GRC program to manage compliance with GDPR, CCPA, and other privacy regulations. The GRC manager needs to ensure that data subject access requests (DSARs) are handled within regulatory timeframes. Which of the following is the MOST effective way to integrate DSAR processing into the GRC program?

Accepted Answer

Configure the GRC platform to automate DSAR intake, track deadlines, and route requests to responsible teams with escalation alerts.. Integrating DSAR processing into the GRC platform automates intake, tracking, and escalation, ensuring regulatory deadlines are met consistently across jurisdictions. This centralized approach provides audit trails, enables oversight, and aligns privacy compliance with broader GRC objectives. It reduces manual errors and allows the privacy office to manage requests efficiently while demonstrating compliance to regulators.

Answer

Delegate DSAR handling entirely to the legal department and exclude it from the GRC program.

Answer

Implement a standalone privacy tool that is not integrated with the GRC platform.

Answer

Create a manual process where each business unit logs DSARs in a shared spreadsheet and emails the privacy office.

Question 13

A GRC analyst is reviewing the organization's risk register and notices that a risk related to third-party data storage has a high inherent risk score but a low residual risk score. The analyst needs to explain to management why the residual risk is low. Which factor should the analyst cite as the primary reason?

Accepted Answer

Effective controls have been implemented to mitigate the risk.. The correct answer is that effective controls have been implemented. Residual risk is calculated by assessing the risk after considering the mitigating effects of controls. If controls are effective, they reduce the likelihood or impact, resulting in a lower residual risk score. This is a core concept in risk management and explains the difference between inherent and residual risk.

Answer

The risk has been transferred to a cyber insurance policy.

Answer

The risk appetite for third-party data storage is very high.

Answer

The risk has been avoided by discontinuing the third-party relationship.

Question 14

A financial services firm's GRC team is defining measurable objectives for its governance program. The chief risk officer wants to demonstrate that the program is not only operating but also improving over time. Which set of performance indicators BEST supports this goal?

Accepted Answer

Percentage of high risks with approved treatment plans and trend in overdue remediation items. Demonstrating improvement requires outcome-oriented indicators, not activity or volume counts. Tracking the share of high risks with approved treatment plans shows governance rigor, while the trend in overdue remediation items reveals whether execution is getting better or worse. Together they provide a directional view of program effectiveness that activity metrics cannot deliver.

Answer

Average time to close audit findings and number of audit findings per year

Answer

Total number of controls documented and total number of risk assessments completed

Answer

Number of policies published and number of committee meetings held per quarter

Question 15

A GRC analyst is designing a key risk indicator (KRI) dashboard for the executive committee. The goal is to provide early warning signals for risks that could impact strategic objectives. Which TWO of the following characteristics are MOST important for effective KRIs? (Choose two.)

Accepted Answer

KRIs should be predictive and provide leading indicators of risk exposure.. Effective KRIs must be predictive, providing early warning through leading indicators, and quantifiable for consistent measurement and trend analysis. These characteristics enable the executive committee to anticipate risks and take proactive action. Historical data and infrequent updates are lagging and reactive, while uncoordinated KRIs undermine enterprise-wide risk visibility.

Answer

KRIs should be tailored to individual business units without central oversight.

Answer

KRIs should be updated annually to align with strategic planning cycles.

Answer

KRIs should be based on historical loss data to ensure accuracy.