CGRC Practice Question: In a mature GRC program, which TWO of the following activities are typical for the 'Risk…
In a mature GRC program, which TWO of the following activities are typical for the 'Risk Management' domain?
⚠ Common exam trap
CGRC often tests the boundary between risk management activities and control implementation activities — candidates incorrectly select technical controls like password resets as 'risk management' when they are actually control execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Developing treatment plans for risks exceeding appetite.
Option D is correct because a core Risk Management activity is developing treatment plans (mitigate, transfer, avoid, or accept) for risks that exceed the organization's defined risk appetite or tolerance. Option E is correct because risk identification — determining which threats and vulnerabilities could affect business objectives — is the foundational step of the risk management process (identification, analysis, evaluation, treatment, monitoring). Options A and B are unrelated to GRC; office layout design and marketing brochure writing are operational/marketing tasks, not risk management activities. Option C, resetting all employee passwords every 30 days, is a technical access-control/identity-management control (an operational security task), not a Risk Management domain activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Designing new corporate office layouts.
Why it's wrong here
Office layout design is a facilities and physical-safety concern, not the identification, analysis or treatment of risks to information assets. It is tempting because physical environment factors can appear in risk registers, but layout planning itself is not a GRC risk management activity.
- ✗
Writing marketing brochures for the company.
Why it's wrong here
Marketing brochures are a communications and branding deliverable, unrelated to identifying, assessing, treating or monitoring risk. It is tempting because marketing content can carry compliance claims, yet producing it is not a Risk Management domain activity within a GRC programme.
- ✗
Resetting all employee passwords every 30 days.
Why it's wrong here
This is an IT operational task, not a risk management task.
- ✓
Developing treatment plans for risks exceeding appetite.
Why this is correct
Once assessed risks exceed the organisation's defined risk appetite or tolerance, treatment plans specify the response — mitigate, transfer, avoid or accept — plus owners, controls and target dates. This closes the Risk Management loop by converting unacceptable exposure into tracked, accountable remediation activity.
- ✓
Identifying risks that could impact business objectives.
Why this is correct
Risk identification is the foundational Risk Management activity: systematically discovering and documenting uncertainties, threats and vulnerabilities that could prevent the organisation achieving its stated business objectives. It populates the risk register that all subsequent assessment, prioritisation and treatment activity depends upon within a mature GRC programme.
About these practice questions
This CGRC question is part of Courseiva's 341-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- A financial services firm is expanding its GRC program and needs to establish a formal governance structure. The Chief I…
- Which THREE of the following represent common challenges in maintaining an integrated GRC program?
- A GRC analyst is reviewing the organization's risk register and notices that a risk related to third-party data storage…
- A multinational corporation is implementing a GRC program to manage compliance with GDPR, CCPA, and other privacy regula…
- A GRC analyst is designing a key risk indicator (KRI) dashboard for the executive committee. The goal is to provide earl…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.