CGRC Practice Question: Which THREE of the following are components that must be included when documenting a…
Which THREE of the following are components that must be included when documenting a compensating control?
⚠ Common exam trap
CGRC often tests the three required elements of a compensating control, tempting candidates to select approval identity or affected-user lists because those feel like part of formal documentation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A detailed explanation of how the compensating control mitigates the risk.
Option B is correct because documenting a compensating control must include a detailed explanation of how the control mitigates the identified risk, demonstrating that the alternative measure provides equivalent protection to the original requirement. Option C is correct because the documentation must clearly describe the risk the control is intended to mitigate, establishing the security objective the compensating control addresses. Option E is correct because the documentation must state the reason the original control could not be implemented, justifying why a compensating control is necessary in the first place. Option A is not required, since the identity of the approving person is not a mandatory element of the compensating control description itself, even though approvals are tracked elsewhere in the risk management process. Option D is not required, as listing every affected user is not a standard component; the documentation focuses on the risk, the mitigation method, and the justification for the alternative control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The identity of the person who approved the control.
Why it's wrong here
Compensating control documentation records the control description, the risk it addresses, its scope, validation method and residual risk acceptance; the approving individual's identity is not a required component. It is tempting because approval evidence supports auditability, but that belongs to the risk acceptance record.
- ✓
A detailed explanation of how the compensating control mitigates the risk.
Why this is correct
The documentation must explain how the compensating control actually reduces the identified risk, demonstrating that its mechanism provides equivalent protection to the original control. This justification is required so assessors can verify the control genuinely mitigates the risk rather than merely existing.
- ✓
A description of the risk the control is intended to mitigate.
Why this is correct
Documenting a compensating control requires stating the specific risk it addresses, so reviewers can confirm the alternative control targets the same threat as the original. Without this, the control cannot be assessed for adequacy, making the risk description an essential component of the documentation.
- ✗
A list of every user affected by the control.
Why it's wrong here
Documentation describes the compensating control's design, the requirement it replaces, its scope and how effectiveness is verified; enumerating every affected user is not required. It is tempting because scope matters, but scope is expressed as systems or processes covered, not an exhaustive user list.
- ✓
The reason why the original control could not be implemented.
Why this is correct
Recording why the original control could not be implemented establishes the justification for using a compensating control at all. This rationale is a required component, proving the alternative was necessary rather than chosen for convenience, and supporting the risk acceptance decision.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- A security analyst is selecting controls for a new information system based on NIST SP 800-53 Rev. 5. The system has bee…
- You are a security consultant helping a financial institution select controls for a new mobile banking application. The…
- Which TWO of the following statements regarding the 'Tailoring' process are accurate?
- A security team is selecting controls for a system that will use a cloud-based infrastructure. They need to determine wh…
- If a control is determined to be 'system-specific', what does that mean?
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.