Governance, Risk and Compliance
What the exam tests
GRC items test whether you can connect three things usually managed in separate silos: the direction set at the top (governance), the uncertainty that threatens it (risk), and the external rules that constrain it (compliance). Expect scenarios where a control exists but the governance around it does not, and items that ask which risk response is appropriate rather than which control is technically strongest.
Governance structure
- The board sets risk appetite - how much risk the organization will accept in pursuit of objectives. Management sets risk tolerance - the acceptable variation around a specific objective. Appetite is a statement; tolerance is measurable.
- Three lines model (IIA): the first line owns and manages risk; the second line (risk, compliance, security) provides expertise, monitoring and challenge; the third line (internal audit) gives independent assurance to the board. Internal audit must never own the controls it later audits.
- Policy hierarchy: policy (mandatory intent) → standard (specific requirements) → procedure (step-by-step) → guideline (advice). Confusing a standard with a policy is a classic weakness finding.
Risk
Risk is the effect of uncertainty on objectives, usually scored as likelihood × impact. Inherent risk is assessed before controls; residual risk after. Treatment options: avoid, reduce, transfer (insurance, contract), accept - with acceptance recorded against a named owner who has the authority to accept it.
Compliance
Maintain an obligation register mapping each requirement (statute, regulation, contract, standard) to the control that satisfies it and the evidence it produces. This register is the first thing regulators and auditors request, and it is what turns compliance from an assertion into a traceable chain.
Worked example
A SaaS provider stores EU customer data. The register records a GDPR Art. 32 security-of-processing obligation. Inherent risk of a storage misconfiguration is rated high. Controls: infrastructure-as-code scanning (preventive), quarterly access review (detective), documented restore test (corrective). Residual risk is rated medium and formally accepted by the CISO. The chain obligation → risk → control → evidence is complete and auditable.
Traps
- Treating a compliance certificate as proof that risk is managed.
- Using appetite and tolerance interchangeably.
- Placing internal audit in the second line.
- Accepting residual risk without a named accountable owner or review date.
- Building a control catalogue with no link back to an obligation.