GRC Risk Assessment and Identification Techniques

Question 1

Which tool is most commonly used to document and track identified risks, their likelihood, potential impact, and assigned owners within an organization?

Accepted Answer

Risk register

Answer

Control matrix

Answer

Audit log

Answer

Policy repository

Question 2

A risk heat map that plots risks by likelihood on one axis and impact on the other is also known as a:

Accepted Answer

Risk matrix

Answer

Bow-tie diagram

Answer

Fault tree

Answer

Control map

Question 3

What is the primary difference between qualitative and quantitative risk assessment?

Accepted Answer

Qualitative uses descriptive rankings; quantitative uses numerical values and statistical methods

Answer

Qualitative uses monetary values; quantitative uses descriptive rankings

Answer

Qualitative is performed by auditors; quantitative is performed by management

Answer

Qualitative applies only to cyber risk; quantitative applies to financial risk

Question 4

In GRC, what does 'inherent risk' refer to?

Accepted Answer

The risk that exists before any controls or mitigating actions are implemented

Answer

The risk remaining after controls are applied

Answer

The risk transferred to a third party

Answer

The risk accepted by senior management

Question 5

Which risk identification technique involves gathering input from a panel of experts through multiple anonymous rounds of questionnaires to reach consensus?

Accepted Answer

Delphi technique

Answer

SWOT analysis

Answer

Fault tree analysis

Answer

Control self-assessment

Question 6

What is the relationship between risk appetite and risk tolerance in GRC?

Accepted Answer

Risk appetite is the broad level of risk accepted; risk tolerance is the acceptable variance around that level

Answer

They are synonymous terms used interchangeably

Answer

Risk tolerance defines strategic objectives; risk appetite defines day-to-day operations

Answer

Risk appetite applies to financial risk only; tolerance applies to operational risk

Question 7

A bow-tie analysis in risk management is best described as:

Accepted Answer

A diagram connecting risk causes on the left to consequences on the right with the hazard/risk event at the center

Answer

A matrix mapping controls to risks in a two-by-two grid

Answer

A ranking tool that assigns numeric scores to risks based on severity

Answer

A process flowchart showing audit procedures