CGRC A GRC practitioner is auditing access Practice Question
A GRC practitioner is auditing access. Which report provides the best overview of who has 'Write' access to sensitive compliance evidence?
⚠ Common exam trap
CGRC often tests the confusion between reports that describe system health or risk posture and reports that describe authorization, causing candidates to pick a report that sounds governance-related but contains no permission data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'User Permission' or 'Access Control' report.
A 'User Permission' or 'Access Control' report enumerates which users and groups hold which permissions (read, write, delete) on specific objects or modules, including sensitive compliance evidence. This directly answers the question of who has Write access. It is the only report type designed to surface authorization assignments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The System Performance Report.
Why it's wrong here
The System Performance Report covers availability, throughput and resource metrics, not entitlement data, so it cannot identify who holds Write access. It is tempting because it is a standard operational report, and it would be the correct choice when investigating slow response times or capacity problems in the evidence platform.
- ✗
The Risk Trend Analysis Report.
Why it's wrong here
The Risk Trend Analysis Report charts risk scores over time, containing no per-user permission data, so it cannot enumerate Write access holders. It is tempting because it is a governance report, and it would be the correct choice when demonstrating how the organisation's risk posture has shifted across reporting periods.
- ✗
The Audit Finding Closure Report.
Why it's wrong here
The Audit Finding Closure Report tracks remediation status of findings, not permission assignments, so it cannot show who holds Write access. It is tempting because it is an audit-oriented report, and it would be the correct choice when verifying that previously raised findings have been remediated and closed.
- ✓
The 'User Permission' or 'Access Control' report.
Why this is correct
A user permission or access control report aggregates each principal's assigned rights across compliance evidence, showing precisely who holds Write access. This satisfies the audit requirement for an overview by permission level rather than activity or change history.
About these practice questions
Courseiva writes every CGRC question from scratch — 341 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- A GRC team is defining the scope of its governance program. The organization wants to ensure that all relevant stakehold…
- What is the primary benefit of mapping regulatory requirements to internal controls in a GRC platform?
- When structuring a GRC program, which THREE components are critical for compliance management?
- A GRC analyst is designing a process to continuously identify changes in the external regulatory environment that could…
- To ensure that GRC controls remain effective, the organization requires a 'Control Self-Assessment' (CSA) workflow that…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.