CGRC Practice Question: When documenting a GRC policy, which TWO elements should be included to ensure effective…
When documenting a GRC policy, which TWO elements should be included to ensure effective governance?
⚠ Common exam trap
CGRC often tests whether candidates confuse governance documentation with operational or personal details, so distractors like home addresses or social media handles are inserted to see if you recognize that only ownership/accountability and clear objective-linked statements belong in a policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Explicit assignment of policy ownership and accountability.
Option B is correct because effective governance requires that each policy have a clearly identified owner who is accountable for its maintenance, enforcement, and review, ensuring there is no ambiguity about who is responsible. Option D is correct because a GRC policy must contain clear, unambiguous policy statements tied to organizational objectives, so that the controls and requirements directly support the business goals and can be measured and audited. Options A, C, and E are incorrect because a CISO's home address, employees' social media handles, and a website color scheme are irrelevant operational or personal details that do not contribute to policy ownership, accountability, or alignment with organizational objectives.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The home address of the CISO.
Why it's wrong here
A GRC policy states governance requirements such as scope, roles, and compliance obligations; a CISO's home address is personal data with no governance function. It tempts because identifying the accountable executive is legitimate, yet the policy names the role, never private contact details.
- ✓
Explicit assignment of policy ownership and accountability.
Why this is correct
Naming a specific owner and holding them accountable satisfies the governance constraint that every policy has enforceable responsibility. Without assigned ownership, review cycles, exceptions and updates stall, so this element ensures the policy remains maintained rather than orphaned.
- ✗
A list of all employees' social media handles.
Why it's wrong here
Governance documentation specifies control ownership and compliance requirements, not employees' personal social media accounts, which are irrelevant and a privacy risk. It tempts because identifying personnel responsible for controls is valid, but that means role titles, not personal handles.
- ✓
Clear policy statements and organizational objectives.
Why this is correct
Clear policy statements define the mandatory rules, while organisational objectives tie those rules to business intent, satisfying the governance requirement that policy direction align with strategic goals. Together they give auditors and staff an unambiguous basis for measuring whether controls actually support the stated outcomes.
- ✗
The exact color scheme of the company website.
Why it's wrong here
GRC policies define control objectives, responsibilities, and enforcement mechanisms; website colour schemes carry no governance meaning. It tempts because brand and style standards are documented artefacts, but they belong in marketing guidelines, not in a governance policy.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- A global retailer's GRC team is preparing for an external audit of its compliance program. The auditor requests evidence…
- You need to ensure that the 'Compliance Dashboard' is updated only when the 'Assessment Completion' status is 'Verified'…
- Your GRC platform allows for 'Risk Heat Map' visualization. An executive wants to see only risks associated with 'Cybers…
- A GRC practitioner is establishing a process for maintaining the compliance program's documented information. The goal i…
- A GRC practitioner is auditing access. Which report provides the best overview of who has 'Write' access to sensitive co…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.