CGRC Practice Question: Which GRC component is used to document the organizational structure, such as business…
Which GRC component is used to document the organizational structure, such as business units and departments, to which risks are assigned?
⚠ Common exam trap
The trap is confusing modules that store different types of data—policies, incidents, reports—with the one that specifically models the organizational structure, which is the Entity or Organization Manager.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'Entity' or 'Organization' Manager module.
The 'Entity' or 'Organization' Manager module in a GRC platform is used to document the organizational structure, including business units, departments, and other entities to which risks are assigned. This module provides a hierarchical representation of the organization, enabling risk owners to be mapped to specific units and facilitating roll-up reporting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The 'Report' generator.
Why it's wrong here
A report generator queries and presents existing data; it does not store the organisational hierarchy of business units and departments against which risks are assigned. It is tempting because reports can display ownership data, but the underlying structure must first be documented elsewhere, such as in a risk register.
- ✗
The 'Policy' library.
Why it's wrong here
A policy library stores governance documents such as policies, standards and procedures, not the organisational structure of business units and departments to which risks are assigned. It is tempting because policies often name responsible departments, but that reference is incidental; the hierarchy itself belongs in a risk register.
- ✗
The 'Incident' tracking module.
Why it's wrong here
An incident tracking module records security events and their remediation workflow, not the business units and departments to which risks are assigned. It is tempting because incidents are often linked to organisational owners, but that linkage is not its function; a risk register or asset inventory documents structure.
- ✓
The 'Entity' or 'Organization' Manager module.
Why this is correct
The Entity or Organisation Manager module maintains the hierarchical business-unit and department structure that risk records reference, satisfying the stem's requirement to document organisational structure for risk assignment. Other GRC components handle risk registers, controls or assessments, but none model the reporting hierarchy itself, so this module is the one that assigns risks to the correct organisational node.
About these practice questions
This CGRC question is part of Courseiva's 341-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- Which GRC platform component is most critical for ensuring that executive leadership receives accurate, real-time risk p…
- To ensure the integrity of the GRC 'System of Record', which THREE controls must be enforced?
- An organization is integrating 'Third-Party Risk Management' (TPRM) into their GRC framework. They need to ensure that v…
- A company is implementing a 'Continuous Monitoring' program in their GRC tool. They need to ingest data from a Cloud Sec…
- A newly appointed GRC manager at a healthcare payer is drafting the organization's first charter for the governance func…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.