CGIC common mistakes
CGIC · Understand the traps and how to avoid them.
Choosing the answer that describes the technically strongest control rather than the one matching the governance body's actual mandate and authority described in the scenario.
Candidates default to 'best practice' instincts from operational or IT audit backgrounds and skip the step of identifying who has the authority to act in the stem.
What to do instead
Before evaluating options, write down the actor (board, committee, CISO, external auditor) and their mandate; eliminate any option that exceeds or misstates that actor's authority even if it is a stronger control.
Treating governance, risk, and compliance as interchangeable and picking an answer that solves the problem in the wrong discipline (e.g., a control fix when the question asks about oversight accountability).
The domains overlap heavily in vocabulary, and stems often describe a symptom that could be addressed at several layers.
What to do instead
Classify the question by the verb in the call: 'who is accountable' = governance, 'what should be done about the exposure' = risk, 'does this meet the requirement' = compliance. Answer only within that layer.
Selecting a risk response (avoid, mitigate, transfer, accept) without first confirming the residual risk against the stated tolerance or appetite.
Candidates jump to the most familiar control activity and never check whether the remaining exposure is within the limit the scenario gives.
What to do instead
Compute or estimate residual exposure first, compare to the stated tolerance, and only then choose the response; if residual exceeds tolerance, acceptance is wrong regardless of how attractive the option sounds.
Confusing inherent risk with residual risk when the stem mentions existing controls, and scoring the exposure as if no controls existed.
The words 'currently', 'in place', and 'designed' are easy to skim past, and inherent risk is the more intuitive number to reason from.
What to do instead
Highlight every control mentioned in the stem and subtract its effect before rating risk; if the stem says a control exists but is not operating, treat that as a control failure, not as absence of control.
Answering compliance questions with the spirit of the regulation rather than its literal requirement, or vice versa, without noting which the question asks for.
Candidates rely on general impressions of frameworks (GDPR, SOX, ISO) instead of the specific obligation being tested.
What to do instead
For each option, state the precise requirement it invokes; discard options that are defensible in principle but not actually mandated, and flag any option that adds obligations the standard does not impose.
Assuming a certification, policy document, or prior audit report constitutes evidence of compliance rather than evidence of intent.
Documents are tangible and feel like proof, so candidates accept them as assurance without asking whether the control operated.
What to do instead
Ask 'does this show the control was designed, or that it operated?' Design evidence (policies, certificates) answers design questions only; operation questions require logs, samples, or test results.
Designing an audit procedure that tests the wrong assertion, e.g., testing existence when the risk is valuation or completeness.
Candidates anchor on the account or process named in the stem rather than the specific misstatement risk described.
What to do instead
Write the risk as a sentence ('records may exist that should not' = occurrence; 'records may be missing' = completeness) before selecting a procedure, and match the procedure to that sentence.
Treating a finding as closed because management responded with a remediation plan, without evidence that the action was implemented and effective.
A written management response feels like resolution and closes the loop psychologically.
What to do instead
Distinguish response, implementation, and validation as three separate stages; only validated retesting closes a finding, and an accepted-risk decision must be documented by someone with authority to accept it.
Weighing a self-interest or familiarity threat as acceptable because the work was performed competently, rather than evaluating whether the threat was identified, disclosed, and safeguarded.
Candidates evaluate the quality of the output instead of the independence of the process that produced it.
What to do instead
Run the threat-safeguard test explicitly: name the threat, name the safeguard, and confirm disclosure to the appropriate party; competence never cures an unmanaged independence threat.
Choosing the option that protects the employer's or client's interests when the scenario describes a legal or ethical violation that requires escalation outside the normal chain.
Loyalty and confidentiality instincts are strong, and candidates fear overreacting or breaching confidence.
What to do instead
Apply the priority order: legal/regulatory obligation, then public interest, then professional standards, then employer. If the normal chain is implicated, escalate to the governing body or regulator and document the decision.