GRC Principles and Models 2 — Questions and Answers
Question 1: Which GRC model principle emphasizes that risk management activities should be proportional to the size and complexity of the organization?
- Scalability (Correct answer)
- Transparency
- Integration
- Accountability
Correct answer: Scalability
Scalability ensures that GRC frameworks are appropriately sized and tailored to the organization's complexity, not applied in a one-size-fits-all manner.
Question 2: In the Three Lines of Defense model, who is responsible for the SECOND line of defense?
- Business unit managers and process owners
- Risk management and compliance functions (Correct answer)
- Internal audit
- External auditors
Correct answer: Risk management and compliance functions
The second line consists of risk management, compliance, and control functions that oversee and provide guidance to the first line.
Question 3: Which principle of GRC holds that all significant decisions and their rationale should be documented and available for review?
- Auditability (Correct answer)
- Integrity
- Confidentiality
- Non-repudiation
Correct answer: Auditability
Auditability requires that decisions, processes, and outcomes are documented so they can be independently reviewed and verified.
Question 4: The COSO ERM framework was updated in 2017 to emphasize which key integration?
- Integration of ERM with IT governance
- Integration of strategy and performance with risk management (Correct answer)
- Integration of compliance and legal functions
- Integration of internal and external audit
Correct answer: Integration of strategy and performance with risk management
The 2017 COSO ERM update explicitly linked enterprise risk management to strategy-setting and performance management.
Question 5: Which GRC principle ensures that the same risk assessment methodology is applied across all business units and departments?
- Consistency (Correct answer)
- Independence
- Completeness
- Timeliness
Correct answer: Consistency
Consistency in GRC means applying uniform criteria, methods, and standards so results are comparable across the organization.
Question 6: In a mature GRC model, 'risk appetite' is best described as:
- The maximum risk the organization can absorb before failing
- The amount of risk an organization is willing to accept to achieve its objectives (Correct answer)
- The residual risk remaining after controls are applied
- The threshold at which regulatory penalties are triggered
Correct answer: The amount of risk an organization is willing to accept to achieve its objectives
Risk appetite is the level of risk an organization is prepared to accept in pursuit of its strategic goals, set by senior leadership.
Question 7: Which ISO standard provides a framework specifically for risk management principles and guidelines applicable to any organization?
- ISO 27001
- ISO 31000 (Correct answer)
- ISO 9001
- ISO 22301
Correct answer: ISO 31000
ISO 31000 provides universal principles, a framework, and a process for managing risk applicable to any organization regardless of sector.
GRC Principles and Models 2
Which GRC model principle emphasizes that risk management activities should be proportional to the size and complexity of the organization?