CGRC Practice Question: When establishing a GRC program structure, what is the primary purpose of defining a…
When establishing a GRC program structure, what is the primary purpose of defining a 'System of Record'?
⚠ Common exam trap
CGRC often tests the concept of 'Single Source of Truth' — candidates may confuse the SoR with a general data repository or pick cost/performance options that miss the governance intent.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To provide a 'Single Source of Truth' for audit and compliance data.
A System of Record (SoR) in a GRC program establishes a single authoritative source for compliance, audit, and risk data, eliminating conflicting versions across departments. This 'Single Source of Truth' ensures consistency, traceability, and reliable reporting for audits and decision-making. It is foundational to effective GRC because it prevents data silos and reconciliation errors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To allow every department to have its own data repository.
Why it's wrong here
A System of Record consolidates authoritative data into one governed source; permitting each department its own repository creates the conflicting, duplicated records the concept exists to eliminate. It tempts because departmental autonomy over data feels efficient, but that is the federated model a System of Record deliberately replaces.
- ✗
To minimize the cost of software licenses.
Why it's wrong here
A System of Record defines the authoritative source for data and its governance, not procurement economics; licence savings are a possible by-product of consolidation, never the primary purpose. It tempts because consolidating repositories can reduce duplicate tooling costs, but cost is not why the structure is defined.
- ✗
To make the GRC platform run faster.
Why it's wrong here
A System of Record establishes data authority, ownership and traceability; platform performance is an infrastructure concern unrelated to which repository is designated authoritative. It tempts because consolidation can reduce query sprawl, but speed is a side effect, not the defining purpose of the structure.
- ✓
To provide a 'Single Source of Truth' for audit and compliance data.
Why this is correct
A System of Record delivers the authoritative, single source of truth for audit and compliance data, eliminating conflicting evidence across spreadsheets and disconnected tools. This directly satisfies the stem's requirement for a defined GRC program structure, ensuring every control, risk and finding traces to one governed repository that auditors and Microsoft Entra ID access reviews can rely upon.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- The GRC program requires that all policies are reviewed annually. What is the most effective way to enforce this within…
- A mid-size healthcare insurer is standing up a GRC program and must decide where the authority to approve enterprise ris…
- An organization is transitioning from a siloed risk management approach to an integrated GRC program. During the initial…
- A retail company has just hired its first GRC analyst. The analyst is asked to explain why the organization needs a form…
- A healthcare payer's GRC team is building a new compliance program for a recently acquired subsidiary that processes pro…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.