CGRC Practice Question: When aligning GRC with business objectives, which THREE of the following represent…
When aligning GRC with business objectives, which THREE of the following represent effective strategic alignment?
⚠ Common exam trap
CGRC often tests the misconception that strategic alignment means doing more technical security work, when in fact it means connecting GRC activities to business processes, KPIs, and business-owner participation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mapping risk categories to specific business processes.
Option A is correct because mapping risk categories to specific business processes ties governance and risk work directly to the value streams and operations the business cares about, ensuring controls and treatments are relevant rather than generic. Option C is correct because measuring the impact of GRC activities on organizational KPI targets demonstrates and steers GRC toward measurable business outcomes, enabling continuous alignment and prioritization. Option D is correct because involving business owners in the risk assessment process embeds business context, ownership, and accountability into risk decisions, which is a hallmark of strategic alignment between GRC and business objectives. Option B does not belong because focusing exclusively on technical vulnerability patching is a narrow, tactical IT activity that ignores broader business risk and strategic priorities. Option E does not belong because allowing IT teams to ignore GRC policies for speed undermines governance, increases unmanaged risk, and directly conflicts with aligning GRC to business objectives.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Mapping risk categories to specific business processes.
Why this is correct
Mapping risk categories to specific business processes links each risk to the value stream it threatens, so treatment priorities follow business criticality. This connects GRC decisions to operational and strategic objectives rather than abstract risk registers.
- ✗
Focusing exclusively on technical vulnerability patching.
Why it's wrong here
Patching alone addresses technical weaknesses and ignores governance, risk appetite and regulatory obligations that strategic alignment requires. It is tempting because vulnerability management is measurable and genuinely reduces exploitable exposure, so it belongs within a GRC programme — but as one operational control, not the whole alignment strategy.
- ✓
Measuring the impact of GRC activities on organizational KPI targets.
Why this is correct
Measuring GRC impact against organisational KPI targets directly satisfies the stem's strategic alignment requirement by tying governance, risk and compliance activity to business performance metrics. This quantitative linkage demonstrates that GRC effort contributes measurably to business objectives, rather than operating as a standalone compliance function disconnected from commercial outcomes.
- ✓
Involving business owners in the risk assessment process.
Why this is correct
Involving business owners in risk assessment embeds their process knowledge and priorities, so identified risks reflect actual business impact rather than a purely technical view. This directly aligns GRC outcomes with business objectives and ownership.
- ✗
Allowing IT teams to ignore GRC policies for speed.
Why it's wrong here
Deliberately bypassing GRC policies destroys the accountability and risk oversight that strategic alignment depends on. It is tempting because delivery pressure is real and rigid controls can slow releases, so teams sometimes seek exceptions — but alignment means embedding governance into delivery, not suspending it for velocity.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- In a mature GRC program, which TWO of the following activities are typical for the 'Risk Management' domain?
- A financial services firm is expanding its GRC program and needs to establish a formal governance structure. The Chief I…
- Which THREE of the following represent common challenges in maintaining an integrated GRC program?
- A GRC analyst is reviewing the organization's risk register and notices that a risk related to third-party data storage…
- A multinational corporation is implementing a GRC program to manage compliance with GDPR, CCPA, and other privacy regula…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.