CGRC Configuring a 'Risk Appetite Statement' Practice Question
You are configuring a 'Risk Appetite Statement'. The requirement is that any risk score exceeding the appetite must automatically trigger a 'Risk Treatment Plan' workflow. What needs to be configured?
⚠ Common exam trap
CGRC often tests the difference between detective controls (reports, notifications) and preventive/automated controls (workflow triggers), tempting candidates to choose reporting options that do not actually initiate treatment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An automated 'Workflow Trigger' based on a 'Risk Scoring' threshold.
An automated 'Workflow Trigger' based on a 'Risk Scoring' threshold is correct because it directly enforces the risk appetite statement by initiating a Risk Treatment Plan whenever a score exceeds the defined tolerance. This creates a deterministic, auditable linkage between risk scoring and treatment workflow. It also ensures consistency across all risk records rather than relying on individual action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A manual email notification from the risk owner to the CISO.
Why it's wrong here
A manual email relies on human action, so the treatment workflow is not triggered automatically when a score exceeds appetite. It is tempting because notifying the CISO is a genuine governance step, and it would be correct where the requirement is escalation awareness rather than automated workflow initiation.
- ✓
An automated 'Workflow Trigger' based on a 'Risk Scoring' threshold.
Why this is correct
A workflow trigger evaluates the risk score against the defined appetite threshold and automatically launches the Risk Treatment Plan when it is exceeded. This satisfies the requirement that any score above the appetite initiates treatment without manual intervention.
- ✗
A change in the risk rating calculation formula.
Why it's wrong here
Altering the scoring formula changes how risk values are calculated, not what happens once a score breaches the appetite threshold. It is tempting because appetite thresholds are often expressed in score terms, so tuning the formula feels related, and it would be correct if the requirement were to recalibrate risk ratings themselves.
- ✗
A daily report showing all risks over the appetite.
Why it's wrong here
A daily report only surfaces breaches after the fact; it initiates no treatment workflow at the moment the score exceeds appetite. It is tempting because reporting is a real risk-management control, and it would be correct where the requirement is monitoring and visibility rather than automatic workflow triggering.
About these practice questions
Courseiva writes every CGRC question from scratch — 341 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- Which role is typically responsible for defining the 'Risk Appetite' within a GRC governance framework?
- A financial services firm is embedding risk management into its GRC program. The CISO wants a technique that expresses r…
- An organization is integrating its GRC platform with an existing Active Directory infrastructure. To enforce the Princip…
- An energy utility is defining its risk appetite. The board states that it will accept moderate risk in pursuit of operat…
- A global retailer's GRC team is preparing for an external audit and must demonstrate that a specific regulatory requirem…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.