CGRC Practice Question: Which THREE of the following roles are typically involved in a GRC Steering Committee?
Which THREE of the following roles are typically involved in a GRC Steering Committee?
⚠ Common exam trap
CGRC often tests whether candidates can distinguish governance-level executives from operational or unrelated roles — the trap is picking a plausible-sounding but non-governance title.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
General Counsel.
A GRC (Governance, Risk, and Compliance) Steering Committee requires senior leaders who own governance, risk, and compliance accountability across the enterprise. A, General Counsel, is correct because legal leadership interprets regulatory and contractual obligations, advises on compliance exposure, and ensures governance decisions align with statutory requirements. C, Chief Risk Officer (CRO), is correct because the CRO owns the enterprise risk management framework, aggregates risk appetite decisions, and reports risk posture to the board. D, Chief Information Security Officer (CISO), is correct because the CISO translates security and privacy compliance requirements (e.g., ISO 27001, NIST CSF, GDPR) into controls and provides the committee with cyber-risk visibility. B, the lead graphic designer, and E, the office maintenance supervisor, are not typically committee members because their roles involve creative production and facilities upkeep, respectively, and carry no enterprise governance, risk, or compliance decision-making authority.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
General Counsel.
Why this is correct
General Counsel sits on a GRC Steering Committee because legal exposure, contractual obligations and regulatory interpretation shape enterprise risk appetite. Their participation ensures governance decisions align with statutory duties, providing the legal perspective the committee needs alongside risk and security leadership.
- ✗
The lead graphic designer.
Why it's wrong here
A lead graphic designer contributes creative and brand work, holding no governance, risk, or compliance mandate. Design roles belong in marketing or product reviews; GRC steering committees require executives, risk owners, and compliance or audit leaders.
- ✓
Chief Risk Officer (CRO).
Why this is correct
The Chief Risk Officer chairs or anchors a GRC Steering Committee, owning enterprise risk appetite and aggregation across domains. Their presence ensures risk decisions are prioritised consistently, satisfying the committee's mandate to govern risk holistically rather than treating compliance and security in isolation.
- ✓
Chief Information Security Officer (CISO).
Why this is correct
The Chief Information Security Officer contributes the security risk view to a GRC Steering Committee, translating control effectiveness and threat exposure into governance decisions. Their inclusion ensures security posture is weighed alongside legal and enterprise risk when the committee sets policy and priorities.
- ✗
The office maintenance supervisor.
Why it's wrong here
An office maintenance supervisor holds no governance, risk, or compliance accountability, so cannot steer enterprise risk decisions. Such facilities roles appear in operational or safety committees; a GRC steering committee instead needs executives, risk owners, and compliance officers.
About these practice questions
Courseiva writes every CGRC question from scratch — 341 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- When documenting a GRC policy, which TWO elements should be included to ensure effective governance?
- A global retailer's GRC team is preparing for an external audit of its compliance program. The auditor requests evidence…
- You need to ensure that the 'Compliance Dashboard' is updated only when the 'Assessment Completion' status is 'Verified'…
- Your GRC platform allows for 'Risk Heat Map' visualization. An executive wants to see only risks associated with 'Cybers…
- A GRC practitioner is establishing a process for maintaining the compliance program's documented information. The goal i…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.