CGRC Practice Question: The GRC program requires that all policies are reviewed annually
The GRC program requires that all policies are reviewed annually. What is the most effective way to enforce this within the GRC platform?
⚠ Common exam trap
Many candidates confuse a human reminder (meeting invite) with a platform-enforced workflow control — CGRC expects you to choose the option that creates automated, auditable enforcement inside the GRC tool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set an 'Expiration Date' and 'Workflow Reminder' on the policy record.
Setting an Expiration Date plus a Workflow Reminder on the policy record is the native GRC mechanism that automatically notifies the policy owner before the review deadline and flags the record as overdue if not completed. This enforces the annual review cadence through the platform's workflow engine rather than relying on human memory or manual tracking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block access to the policy after 365 days.
Why it's wrong here
Blocking access after 365 days enforces a hard expiry but does not initiate review, notify the owner, or capture attestation, so policies lapse rather than being reviewed. It is tempting because it guarantees action before the deadline; it would be correct for retiring obsolete documents that must not remain accessible.
- ✓
Set an 'Expiration Date' and 'Workflow Reminder' on the policy record.
Why this is correct
An Expiration Date marks when the policy falls due for review, while the Workflow Reminder automatically notifies the responsible owner ahead of that date. Together they enforce the annual review cadence within the platform rather than relying on manual tracking, satisfying the stated yearly requirement.
- ✗
Create a recurring meeting for the policy owner.
Why it's wrong here
A recurring meeting is an external calendar reminder; it does not change policy status, trigger attestation, or produce an auditable review record inside the GRC platform. It is tempting because scheduling is cheap and familiar; it would be correct for coordinating discussion among owners where the platform lacks automated review workflows.
- ✗
Require the administrator to manually reset the policy status.
Why it's wrong here
Manual status resets depend on an administrator remembering to act each year, so the annual review is not enforced by the platform and can be missed. It is tempting because resetting status forces re-approval, which is the correct outcome; it would be right where no scheduling or workflow capability exists and reviews are genuinely ad hoc.
About these practice questions
Courseiva writes every CGRC question from scratch — 341 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- A mid-size healthcare insurer is standing up a GRC program and must decide where the authority to approve enterprise ris…
- An organization is transitioning from a siloed risk management approach to an integrated GRC program. During the initial…
- A retail company has just hired its first GRC analyst. The analyst is asked to explain why the organization needs a form…
- A healthcare payer's GRC team is building a new compliance program for a recently acquired subsidiary that processes pro…
- The GRC team has determined that 'Residual Risk' is being calculated incorrectly because the 'Control Effectiveness' sco…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.