CGRC Practice Question: To ensure the integrity of the GRC 'System of Record', which THREE controls must be…
To ensure the integrity of the GRC 'System of Record', which THREE controls must be enforced?
⚠ Common exam trap
CGRC often tests whether candidates recognize that integrity requires a combination of preventive (validation, access control) and detective (audit logging) controls, and that backups are an availability control, not an integrity control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automated data validation rules for input fields.
Option A is correct because automated data validation rules for input fields enforce integrity at the point of entry, rejecting malformed, out-of-range, or inconsistent values before they can corrupt the GRC system of record. Option C is correct because strict access control and user authorization policies (e.g., role-based access control with least privilege) ensure that only approved users can create or modify records, preventing unauthorized or accidental changes. Option E is correct because comprehensive audit logs of all user actions provide an immutable trail that supports accountability, traceability, and detection of tampering or unauthorized modifications. Option B is incorrect because allowing all users to edit any data at any time destroys integrity by removing authorization boundaries and enabling unauthorized changes. Option D is incorrect because disabling backups removes the ability to restore the system of record after corruption, loss, or ransomware, which is essential for maintaining integrity over time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Automated data validation rules for input fields.
Why this is correct
Automated validation rules reject malformed, out-of-range or inconsistent entries at the point of capture, preventing corrupt records from entering the GRC system of record. This enforces data accuracy and completeness, directly satisfying the integrity constraint by stopping bad data before it propagates.
- ✗
Allowing all users to edit any data at any time.
Why it's wrong here
Unrestricted editing destroys the audit trail and data integrity a System of Record depends on, since any user could silently alter or overwrite records. It is tempting because open collaboration suits shared working documents, but a System of Record requires role-based write restrictions and versioned, tamper-evident change logging instead.
- ✓
Strict access control and user authorization policies.
Why this is correct
Role-based authorisation restricts who may create, modify or approve records, ensuring only authenticated, appropriately privileged users alter the system of record. This prevents unauthorised or accidental changes, directly satisfying the integrity requirement through least-privilege enforcement and segregation of duties.
- ✗
Disabling the backup of the GRC database.
Why it's wrong here
Disabling backups removes the ability to restore the system of record after corruption, deletion or ransomware, so integrity cannot be assured. It tempts as a way to cut storage cost or speed maintenance, and would suit a disposable test instance holding no authoritative data.
- ✓
Comprehensive audit logs of all user actions.
Why this is correct
Immutable audit logs capture who changed what, when and from where, creating a tamper-evident trail across the system of record. This enables detection and reconstruction of unauthorised modifications, satisfying integrity by making every change attributable and reviewable during audits.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- An organization is integrating 'Third-Party Risk Management' (TPRM) into their GRC framework. They need to ensure that v…
- A company is implementing a 'Continuous Monitoring' program in their GRC tool. They need to ingest data from a Cloud Sec…
- A newly appointed GRC manager at a healthcare payer is drafting the organization's first charter for the governance func…
- A multinational company needs to ensure that GRC data access complies with regional data residency laws. Which configura…
- Your GRC program requires that assessment evidence be stored in an immutable state for three years. In the GRC platform,…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.