I85PREP
⌘ K
GRCP study materials
GRCP study resources

GRCP practice questions

One question at a time. Build your GRCP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1GRC Key Concepts

In a GRC framework, which term best describes the acceptable amount of risk an organization is willing to retain after controls are applied?

  1. Residual risk Correct answer.
  2. Risk capacity
  3. Inherent risk
  4. Risk appetite

Explanation

Residual risk is the risk that remains after existing controls have been applied and is the figure management actually monitors against tolerance. Inherent risk is measured before controls, and risk appetite describes willingness to take risk rather than the leftover amount.

Question 2GRC Key Concepts

A control that reduces the likelihood of an event before it occurs is best classified as which type?

  1. Compensating
  2. Preventive Correct answer.
  3. Detective
  4. Corrective

Explanation

Preventive controls act before an event to stop it or lower its likelihood, such as access restrictions or segregation of duties. Detective controls find events after they happen, and corrective controls restore conditions afterward.

Question 3GRC Key Concepts

Which statement best captures the relationship between governance and management in a GRC operating model?

  1. Governance and management are synonyms used interchangeably in GRC frameworks
  2. Management sets risk appetite while governance implements the controls
  3. Governance is limited to internal audit and management owns all risk decisions
  4. Governance sets direction and oversight while management executes day-to-day activities Correct answer.

Explanation

Governance establishes direction, authority, and oversight through the board and executive leadership, while management runs the operational activities that deliver objectives. Separating the two preserves accountability and independent challenge.

Question 4GRC Key Concepts

What is the primary purpose of a compliance obligation register in a GRC program?

  1. To record employee training completions
  2. To track financial journal entries
  3. To document software licenses purchased
  4. To inventory applicable laws, regulations, and contractual duties with ownership Correct answer.

Explanation

An obligation register catalogs the external and internal requirements that apply to the organization, assigns owners, and links each obligation to the controls that satisfy it. This creates traceability between legal duties and operational compliance activity.

Question 5GRC Key Concepts

In risk assessment terminology, what does likelihood represent?

  1. The time required to remediate a finding
  2. The probability that a given threat event will occur Correct answer.
  3. The number of controls mapped to a risk
  4. The financial impact if an event occurs

Explanation

Likelihood expresses the probability or frequency that a threat event will materialize against an asset or process. It is combined with impact to derive an overall risk rating.

Question 6GRC Key Concepts

Which element distinguishes a policy from a standard in a typical GRC document hierarchy?

  1. A policy is reviewed annually, while a standard is never reviewed
  2. A policy is optional guidance, while a standard is legally binding
  3. A policy applies only to executives, while a standard applies to all staff
  4. A policy states mandatory high-level direction, while a standard specifies mandatory detailed requirements Correct answer.

Explanation

Policies articulate management's intent and mandatory principles, while standards translate that intent into specific, measurable requirements such as password length or encryption algorithms. Both are mandatory, but they differ in level of detail.

Question 7GRC Key Concepts

A three-lines model in GRC typically places independent assurance over risk management in which line?

  1. Governing body
  2. Second line
  3. Third line Correct answer.
  4. First line

Explanation

The third line, usually internal audit, provides independent assurance to the governing body on the effectiveness of governance, risk, and control. The first line owns and manages risk, and the second line provides oversight and challenge.

Question 8GRC Key Concepts

Which of the following is the best example of a key risk indicator (KRI)?

  1. The number of approved capital projects
  2. The count of privileged accounts without multi-factor authentication Correct answer.
  3. The number of employees who completed onboarding
  4. The total revenue for the quarter

Explanation

A KRI is a metric that provides early warning of rising risk exposure, and unsecured privileged accounts directly signal elevated access risk. The other metrics track operational or financial performance without a clear risk signal.

Question 9GRC Key Concepts

An organization defines a risk tolerance of zero for safety incidents but accepts moderate financial risk. This illustrates which concept?

  1. Risk appetite expressed differently across risk categories Correct answer.
  2. A uniform risk appetite applied to all categories
  3. Risk avoidance of every business activity
  4. Transfer of all risk to third parties

Explanation

Risk appetite is often articulated per category, allowing an organization to accept more risk in some areas and almost none in others such as safety. Setting zero tolerance for one category while accepting financial risk reflects this differentiated approach.

Question 10GRC Key Concepts

A risk register shows a risk with inherent score 20 and residual score 6 after controls. What does the gap between these scores most directly represent?

  1. The cost of the controls
  2. The audit finding severity
  3. The risk appetite threshold
  4. The control effectiveness in reducing exposure Correct answer.

Explanation

Comparing inherent and residual scores shows how much the existing controls reduce exposure, which is a measure of control effectiveness. A large reduction indicates controls are working as intended.

Question 11GRC Key Concepts

During a compliance risk assessment, a regulation changes and increases reporting frequency. Which register update is most appropriate first?

  1. Delete the obligation until the next annual review
  2. Reassign the obligation to internal audit
  3. Close all related audit findings
  4. Reassess the obligation's risk rating and linked controls Correct answer.

Explanation

A change in regulatory requirements alters the risk profile, so the obligation and its mapped controls should be reassessed promptly. Updating the register keeps ratings and control mappings current with the new requirement.

Question 12GRC Key Concepts

A company maps each regulatory requirement to specific controls and evidence. Which GRC outcome does this mapping primarily enable?

  1. Traceability from obligation to control and evidence Correct answer.
  2. Removal of the risk register
  3. Elimination of the need for internal audit
  4. Automatic reduction of regulatory penalties

Explanation

Mapping obligations to controls and evidence creates traceability, allowing the organization to demonstrate compliance and identify gaps. It supports assurance but does not replace independent audit or eliminate regulatory consequences.

Question 13GRC Key Concepts

Which scenario best demonstrates a detective control operating effectively?

  1. A backup is restored after a failure
  2. A monthly reconciliation identifies an unexplained variance Correct answer.
  3. A policy prohibits sharing credentials
  4. A firewall blocks unauthorized traffic

Explanation

A reconciliation that surfaces an unexplained variance detects an issue after it occurs, which is the hallmark of a detective control. Blocking traffic is preventive, and restoring a backup is corrective.

Question 14GRC Key Concepts

An organization adopts a control framework and then performs a gap assessment against it. What is the main purpose of the gap assessment?

  1. To identify where current controls fall short of framework requirements Correct answer.
  2. To replace the risk assessment process
  3. To calculate the organization's tax liability
  4. To certify the framework as legally binding

Explanation

A gap assessment compares current practices to a chosen framework and highlights shortfalls that require remediation. The output guides control improvement priorities rather than certifying or replacing other processes.

Question 15GRC Key Concepts

A risk owner is assigned to a risk in the register. Which responsibility most accurately belongs to that role?

  1. Monitoring and managing the risk and its treatment plan Correct answer.
  2. Setting the organization's overall risk appetite
  3. Independently auditing the control environment
  4. Approving the annual financial statements

Explanation

A risk owner is accountable for monitoring a specific risk and ensuring its treatment plan is executed and effective. Independence and enterprise-wide appetite setting belong to other roles.

Question 16GRC Key Concepts

Which practice most strengthens the reliability of a GRC reporting dashboard?

  1. Allowing each business unit to define its own metric definitions
  2. Defining metrics with consistent formulas and documented data sources Correct answer.
  3. Refreshing data once every three years
  4. Reporting only favorable results to leadership

Explanation

Consistent formulas and documented data lineage make metrics comparable and auditable across the organization. Without standardized definitions, dashboard figures cannot be trusted or aggregated reliably.

Question 17GRC Key Concepts

A company decides to purchase cyber insurance rather than fund additional controls. Which risk treatment option has it chosen?

  1. Mitigation
  2. Avoidance
  3. Acceptance
  4. Transfer Correct answer.

Explanation

Purchasing insurance shifts the financial consequence of a risk to a third party, which is risk transfer. Mitigation would reduce likelihood or impact through controls, and acceptance would retain the exposure without transfer.

Question 18GRC Key Concepts

Which pairing of GRC component to its core question is most accurate?

  1. Compliance asks how much revenue to recognize
  2. Risk asks whether the organization has paid its taxes
  3. Governance asks whether activities align with objectives and oversight expectations Correct answer.
  4. Assurance asks which marketing channel performs best

Explanation

Governance concerns direction, oversight, and alignment of activities with objectives and stakeholder expectations. Risk and compliance address uncertainty and adherence to obligations, not tax payment or revenue recognition.

Question 19GRC Key Concepts

A control is documented but staff consistently bypass it during peak periods. What does this most likely indicate about the control environment?

  1. The control should be removed from the framework
  2. The control is detective rather than preventive
  3. The control is well designed and operating effectively
  4. The control has an operating effectiveness deficiency Correct answer.

Explanation

A control that is designed but not consistently followed has an operating effectiveness deficiency, even if its design is sound. Bypassing controls during peak periods signals culture and enforcement weaknesses that require remediation.

Question 20GRC Key Concepts

Two business units report the same risk with different scores because they use different likelihood scales. What is the most appropriate GRC remediation?

  1. Average the two scores and publish the result
  2. Let each unit keep its scale permanently
  3. Discard the higher score as overly conservative
  4. Standardize the likelihood and impact scales across the organization Correct answer.

Explanation

Divergent scales make risk scores incomparable and distort aggregation, so a common likelihood and impact scale is needed. Standardization enables consistent prioritization and enterprise-level reporting.

Question 21GRC Key Concepts

An auditor finds that a key control relies on a single individual with no backup and no review. Which conclusion is most defensible?

  1. The control automatically becomes a compensating control
  2. The control has a design weakness due to lack of segregation and continuity Correct answer.
  3. The control is effective because one owner ensures accountability
  4. The control is unnecessary because it is performed by one person

Explanation

Concentration in one person without review creates a design weakness in both segregation of duties and business continuity. Effective design typically includes independent review or backup coverage to reduce key-person dependency.

Question 22GRC Key Concepts

A regulator introduces a new requirement mid-year while the organization is mid-cycle on its annual compliance assessment. What is the most risk-appropriate response?

  1. Delegate the requirement entirely to the external auditor
  2. Perform an interim assessment of the new obligation and update controls Correct answer.
  3. Wait until the next annual cycle to consider the requirement
  4. Assume existing controls fully cover the new requirement

Explanation

New obligations can create immediate exposure, so an interim assessment should evaluate applicability and adjust controls before the next scheduled cycle. Assuming coverage without analysis risks undetected compliance gaps.

Question 23GRC Key Concepts

Leadership wants a single enterprise view of top risks, but each function reports using different impact criteria and time horizons. Which approach best resolves this?

  1. Let each function publish its own separate top-risk list
  2. Rank risks solely by the number of audit findings
  3. Adopt an enterprise risk taxonomy with defined impact criteria and horizons Correct answer.
  4. Report only risks that exceed a financial threshold

Explanation

A shared taxonomy with defined impact criteria and time horizons allows risks from different functions to be compared and aggregated meaningfully. Without common criteria, a consolidated top-risk view is not defensible.

Question 24GRC Key Concepts

A GRC team finds that a control tested as effective last year now shows repeated exceptions after a system migration. What is the most appropriate interpretation?

  1. The control should be redesigned without any further testing
  2. Exceptions should be ignored because migrations are temporary
  3. The migration may have altered operation, so the control should be retested and reassessed Correct answer.
  4. The prior test result remains valid because the control design is unchanged

Explanation

A significant change such as a system migration can affect whether a control operates as designed, so retesting and reassessment are warranted. Relying on a prior-year result ignores the changed operating environment.

Question 25GRC Key Concepts

Which situation best illustrates the distinction between risk appetite and risk tolerance?

  1. Tolerance is set by the board, while appetite is set by front-line staff
  2. Appetite applies only to financial risk, while tolerance applies only to operational risk
  3. Appetite is the broad willingness to pursue risk, while tolerance is the acceptable variation around a specific objective Correct answer.
  4. Appetite and tolerance are identical measures used only in audit

Explanation

Risk appetite describes the overall amount and type of risk an organization is willing to pursue, while tolerance defines acceptable deviation around specific objectives or metrics. Tolerance operationalizes appetite at a more granular level.

Question 26GRC Key Concepts

Which term best describes the acceptable level of variation an organization will tolerate around a stated risk appetite?

  1. Inherent risk
  2. Risk tolerance Correct answer.
  3. Risk capacity
  4. Risk velocity

Explanation

Risk tolerance defines the acceptable deviation or range around the risk appetite that the organization is willing to operate within. Risk appetite itself is the broad amount of risk the organization is willing to pursue to meet objectives. Tolerance operationalizes appetite into measurable boundaries.

Question 27GRC Key Concepts

In a GRC operating model, which role is accountable for deciding whether a specific risk is accepted, mitigated, or transferred?

  1. The compliance analyst
  2. The control tester
  3. The risk owner Correct answer.
  4. The internal auditor

Explanation

The risk owner is accountable for managing the risk, which includes choosing and approving a treatment decision within delegated authority. Internal audit provides independent assurance and does not own treatment decisions. Analysts and testers support the process but lack accountability for the risk outcome.

Question 28GRC Key Concepts

Which document type typically states a mandatory, measurable requirement that must be met to comply with a policy?

  1. A mission statement
  2. A risk register entry
  3. A board charter
  4. A standard Correct answer.

Explanation

Standards translate policy intent into specific, measurable mandatory requirements, such as encryption strength or patch timelines. They are more prescriptive than policies and are typically mandatory. Mission statements, register entries, and charters serve different governance purposes.

Question 29GRC Key Concepts

Which metric is a lagging indicator of compliance performance?

  1. Percentage of staff who completed training this month
  2. Frequency of policy attestations submitted
  3. Number of regulatory findings issued last quarter Correct answer.
  4. Number of open remediation tasks past due

Explanation

Lagging indicators measure outcomes that have already occurred, such as findings issued by a regulator. Leading indicators measure activities that predict future outcomes. Training completion, remediation backlog, and attestation frequency are more forward-looking or process-oriented measures.

Question 30GRC Key Concepts

What is the primary purpose of a control self-assessment performed by business process owners?

  1. To transfer residual risk to a third party
  2. To have owners evaluate and attest to the design and operation of their controls Correct answer.
  3. To replace independent audit testing entirely
  4. To set the organization's risk appetite

Explanation

A control self-assessment asks process owners to evaluate and attest to the design and operating effectiveness of controls they own. It raises accountability and surfaces issues early. It complements but does not replace independent assurance, and it does not transfer risk or set appetite.

Question 31GRC Key Concepts

Which element is essential for a risk to be considered formally recorded and trackable in a GRC system?

  1. A named external auditor
  2. An assigned owner, an assessed rating, and a defined treatment Correct answer.
  3. A published press release
  4. A board resolution

Explanation

A trackable risk record requires at minimum an accountable owner, an assessed rating, and a defined treatment or response. These elements allow monitoring, escalation, and reporting. External auditors, board resolutions, and public disclosures are not prerequisites for recording a risk.

Question 32GRC Key Concepts

Which statement best describes the concept of residual risk?

  1. The risk remaining after existing controls and treatments are applied Correct answer.
  2. The risk that has been fully eliminated
  3. The maximum loss the organization could survive
  4. The risk before any controls are considered

Explanation

Residual risk is what remains after current controls and treatments have been applied. It differs from inherent risk, which is assessed before controls. Residual risk cannot be assumed to be zero simply because controls exist, and it is distinct from risk capacity.

Question 33GRC Key Concepts

Which GRC capability primarily enables an organization to demonstrate that it has met its obligations to a regulator?

  1. Vendor onboarding
  2. Compliance mapping with retained evidence Correct answer.
  3. Employee engagement surveys
  4. Budget forecasting

Explanation

Compliance mapping links obligations to controls and retained evidence, allowing the organization to demonstrate fulfillment of regulatory requirements. Budget forecasting, engagement surveys, and vendor onboarding do not directly evidence regulatory compliance.

Question 34GRC Key Concepts

A risk is rated high on likelihood and high on impact, but the organization has strong controls that reduce the residual score to low. Which action is most appropriate for the risk owner?

  1. Document the residual rating and continue monitoring within the existing control environment Correct answer.
  2. Increase the inherent rating to reflect the strong controls
  3. Escalate immediately to the board as a critical risk
  4. Remove the risk from the register because controls exist

Explanation

Because controls reduce the residual score to low, the appropriate response is to document the residual rating and monitor it within the existing control environment. Escalation to the board is reserved for risks exceeding tolerance or with high residual exposure. Removing the risk or inflating inherent ratings misrepresents the risk profile.

Question 35GRC Key Concepts

Two functions use different risk scoring scales, making enterprise aggregation unreliable. Which action best addresses this issue?

  1. Average the differing scores to produce a blended rating
  2. Adopt a common risk taxonomy and scoring methodology across the enterprise Correct answer.
  3. Report each function's scores separately without change
  4. Increase all scores by a fixed factor

Explanation

Reliable aggregation requires a shared taxonomy and consistent scoring methodology so that ratings are comparable. Averaging incompatible scales or reporting separately preserves the inconsistency. Applying a fixed multiplier does not resolve scale differences.

Question 36GRC Key Concepts

A new regulation requires monthly reporting instead of annual reporting. Which GRC change is most directly required?

  1. Update the compliance obligation, associated controls, and monitoring frequency Correct answer.
  2. Replace the internal audit plan
  3. Recalculate the organization's risk appetite
  4. Reassign all risk owners across the enterprise

Explanation

A change in reporting frequency alters the obligation itself, the controls that support it, and the monitoring cadence. The organization should update the obligation record and adjust controls and monitoring accordingly. Risk appetite, ownership structures, and the audit plan are not directly implied by this change.

Question 37GRC Key Concepts

A control relies on a single employee with no documented procedure and no backup. Which conclusion is most defensible?

  1. The control should be removed from the framework
  2. The control is fully effective because it operates consistently
  3. The control is a preventive control and therefore low risk
  4. The control has a key-person dependency that weakens its reliability Correct answer.

Explanation

A control dependent on one individual without documentation or backup carries key-person risk, which undermines sustained reliability. Effectiveness cannot be assured if the person is unavailable. Removing the control or assuming low risk based on control type is not supported by the facts.

Question 38GRC Key Concepts

Which scenario best illustrates a preventive control in a GRC context?

  1. A manager reviews a report of past incidents
  2. A monthly reconciliation detects a mismatch after posting
  3. A system blocks a payment to an unapproved vendor before it is issued Correct answer.
  4. An audit identifies a policy exception after quarter end

Explanation

Preventive controls act before an event occurs to stop an undesired outcome, such as blocking a payment to an unapproved vendor. Detective controls identify issues after they happen, such as reconciliations, audits, and incident reviews. The timing of the control action distinguishes the two categories.

Question 39GRC Key Concepts

An organization wants to compare its control environment against an industry framework and identify missing controls. Which activity best serves this goal?

  1. Performing a gap assessment against the selected framework Correct answer.
  2. Calculating residual risk scores for the register
  3. Conducting an employee satisfaction survey
  4. Drafting a press release on governance

Explanation

A gap assessment compares the current control environment against a chosen framework to identify missing or weak controls. Residual scoring, surveys, and public communications do not provide a structured comparison to framework requirements. The gap analysis yields a remediation roadmap.

Question 40GRC Key Concepts

A GRC dashboard shows a sharp drop in reported incidents after a reporting tool outage. What is the most appropriate interpretation?

  1. The decline may reflect under-reporting caused by the outage rather than improved performance Correct answer.
  2. The organization has eliminated the underlying risk
  3. The controls have become fully effective
  4. The risk appetite should be lowered

Explanation

A drop in reported incidents coinciding with a reporting outage likely reflects reduced reporting, not genuine improvement. Interpreting the metric without accounting for data completeness would mislead leadership. Confirming whether the tool outage suppressed reports is the sound next step.

Question 41GRC Key Concepts

Which practice most improves the traceability of a GRC decision from risk assessment through remediation?

  1. Relying on email threads to document decisions
  2. Reporting only final outcomes to leadership
  3. Maintaining an auditable record linking risk, decision, owner, and remediation evidence Correct answer.
  4. Storing assessments in personal spreadsheets

Explanation

Traceability requires a linked record connecting the risk, the decision made, the accountable owner, and the evidence of remediation. Email threads, personal spreadsheets, and outcome-only reporting break the audit trail. A structured, auditable record supports both assurance and accountability.

Question 42GRC Key Concepts

A regulator issues new guidance mid-cycle during an annual compliance assessment. What is the most appropriate GRC response?

  1. Assess the guidance impact, update obligations, and adjust the assessment scope where material Correct answer.
  2. Reassign the compliance team
  3. Suspend the current assessment entirely
  4. Ignore the guidance until the next annual cycle

Explanation

New guidance should be assessed for impact, reflected in the obligation inventory, and incorporated into the current assessment where material. Deferring to the next cycle risks non-compliance. Suspending the assessment or reassigning staff does not address the change.

Question 43GRC Key Concepts

Leadership requests a single enterprise view of top risks, but each function uses different impact criteria and time horizons. Which action best enables comparability?

  1. Report only risks that exceed a fixed dollar threshold
  2. Select the function with the most conservative scores as the baseline
  3. Define enterprise-wide impact criteria and common time horizons for risk assessment Correct answer.
  4. Multiply each function's scores by a weighting factor

Explanation

Comparability across functions requires standardized impact criteria and consistent time horizons so that ratings mean the same thing everywhere. Selecting one function as a baseline, applying arbitrary weights, or filtering by dollar threshold does not align the underlying definitions. Standardization enables meaningful enterprise aggregation.

Question 44GRC Key Concepts

A control tested as effective last year now shows repeated exceptions after a system migration. What is the most appropriate conclusion?

  1. The prior year's test result remains valid until the next annual cycle
  2. The exceptions should be excluded from reporting
  3. The control's operating effectiveness is in question and requires reassessment and remediation Correct answer.
  4. The migration automatically invalidates the risk register

Explanation

Repeated exceptions following a system migration indicate that the control may no longer operate as designed, so it requires reassessment and remediation. Prior-year results do not guarantee current effectiveness. Excluding exceptions from reporting would misstate the control environment.

Question 45GRC Key Concepts

Which situation best illustrates the difference between risk appetite and risk tolerance?

  1. The organization conducts annual control testing
  2. The organization accepts moderate innovation risk overall but permits no more than a 5% project failure rate Correct answer.
  3. The organization records all risks in a central register
  4. The organization assigns owners to each risk

Explanation

Risk appetite is the broad willingness to accept risk in pursuit of objectives, while tolerance sets the specific acceptable boundary. Accepting moderate innovation risk overall expresses appetite, and the 5% failure limit expresses tolerance. Registering risks, assigning owners, and testing controls are process activities, not appetite-tolerance distinctions.

Question 46GRC Key Concepts

An organization's risk appetite statement says it is willing to accept moderate operational risk, yet a single outage could halt all revenue. Which conclusion is most defensible?

  1. The outage risk should be removed from the register
  2. There is a misalignment between stated appetite and actual risk capacity that warrants review Correct answer.
  3. The appetite statement is automatically correct because leadership approved it
  4. Risk capacity is irrelevant to appetite statements

Explanation

If a single event could halt all revenue, the organization's actual exposure exceeds what a moderate operational appetite implies, signaling misalignment between appetite and capacity. Leadership approval does not by itself make the statement realistic. The risk should be surfaced and reviewed, not removed.

Question 47GRC Key Concepts

A GRC team wants to prioritize remediation. Which combination of factors best supports defensible prioritization?

  1. Alphabetical order of risk titles
  2. The number of controls currently documented
  3. The preferences of the loudest business unit
  4. Residual risk rating, regulatory obligation, and time to impact Correct answer.

Explanation

Defensible prioritization weighs residual exposure, regulatory obligations, and how soon the risk could materialize. These factors reflect both severity and urgency. Alphabetical ordering, subjective influence, and control counts alone do not indicate which risks most urgently require remediation.

Question 48GRC Key Concepts

A key risk indicator begins trending upward while the associated control testing still passes. What is the most appropriate analytical response?

  1. Reduce the frequency of control testing
  2. Conclude that the indicator is faulty and disregard it
  3. Investigate whether the indicator is detecting a changing risk profile not yet reflected in control testing Correct answer.
  4. Immediately close the associated risk

Explanation

A rising KRI alongside passing control tests may indicate a shifting risk profile that current controls do not yet address, so investigation is warranted. Dismissing the indicator or closing the risk prematurely is unjustified. Reducing testing frequency would weaken assurance at a time of rising exposure.

Question 49GRC Key Concepts

An organization maps a regulation to controls but later finds the mapping references a superseded control version. What is the most significant GRC consequence?

  1. The control framework must be replaced
  2. The internal audit function must be disbanded
  3. The risk appetite must be restated
  4. The compliance evidence trail may not support the obligation, creating assurance and audit risk Correct answer.

Explanation

If the mapping points to a superseded control version, the evidence trail may not actually demonstrate compliance with the obligation, creating assurance and audit risk. The issue is a mapping and version-control defect. Restating appetite, disbanding audit, or replacing the framework are disproportionate and unrelated responses.

Question 50GRC Key Concepts

A risk owner proposes accepting a risk whose residual score exceeds the organization's tolerance. Who should authorize this decision, and why?

  1. The vendor, because they supply the affected service
  2. The control tester, because they assessed the control
  3. The appropriate authority above the owner's delegated limit, because acceptance beyond tolerance requires escalation Correct answer.
  4. The risk owner alone, because ownership implies unlimited authority

Explanation

Acceptance of risk beyond established tolerance requires escalation to an authority with the delegated power to approve it. Risk owners operate within defined limits and cannot unilaterally accept exposure above tolerance. Control testers and vendors have no authority to approve organizational risk acceptance.