Governance, Risk, and Compliance (GRC) Fundamentals

Question 1

In a Governance, Risk, and Compliance program, what is the primary function of a policy as opposed to a procedure?

It provides the step-by-step technical actions staff must perform for a task It defines the specific configuration baselines applied to each system asset It states management's high-level intent and expected behavior across the organization It records recommended settings that teams may adopt at their own choosing

Correct Answer: It states management's high-level intent and expected behavior across the organization

A policy is a high-level governance document that communicates management's intent, direction, and expected behavior across the entire organization, setting the tone for all other documents.

The step-by-step technical actions describe a procedure, not a policy. Recommended settings teams may adopt at will describe a guideline, which is optional rather than mandatory. Specific configuration baselines applied to systems describe a standard, which defines mandatory technical requirements.

Key concept: the document hierarchy in GRC where policies express strategic intent while procedures, standards, and guidelines provide the detailed implementation.

Question 2

In a GRC program, which term describes standardized documents that translate broad governance intentions into required, enforceable actions for staff?

Procedures Policies Guidelines Frameworks

Correct Answer: Policies

Policies are formal, standardized documents that convert high-level governance goals and management intent into mandatory, enforceable rules that staff must follow.

Frameworks are structured reference models or best-practice blueprints, not mandatory internal directives. Guidelines offer optional, recommended advice rather than enforceable requirements. Procedures provide the step-by-step how-to instructions for carrying out policies, not the overarching mandates themselves.

The key concept tested is the governance document hierarchy, distinguishing enforceable policies from supporting procedures, guidelines, and frameworks.

Question 3

What does the term 'inherent risk' represent in a risk management practice?

The gap between current risk and the desired target risk The amount of risk that leadership agrees to accept The level of risk that stays after controls are applied The level of risk present before any controls are applied

Correct Answer: The level of risk present before any controls are applied

Inherent risk is the raw, natural level of risk that exists before any safeguards or controls are put in place to reduce it.

The level of risk that stays after controls are applied describes residual risk, not inherent risk. The amount of risk leadership agrees to accept describes risk appetite or acceptance, a decision about tolerance rather than the starting risk level. The gap between current and desired target risk describes a risk gap analysis, not the baseline risk itself.

Key concept: distinguishing inherent risk from residual risk, risk appetite, and risk gap in the risk management lifecycle.

Governance, Risk, and Compliance (GRC) Fundamentals

CC - Governance, Risk, and Compliance (GRC) Fundamentals Example Questions

Question 1

Question 2

Question 3

Begin Your Cybersecurity Career

Other Domain 2: Security Governance concepts