CGRC Compliance Programs 6

Question 1

A cloud service provider's FedRAMP-authorized system has an approved POA&M. During continuous monitoring, the provider discovers that a High-severity vulnerability remediation will miss its scheduled completion date by 45 days because a vendor patch is delayed. Which action BEST aligns with a compliance program that is operating as designed?

Accepted Answer

Update the POA&M with a revised completion date, milestone changes, and justification, and report the deviation to the authorizing official, with compensating controls documented

Answer

POA&M items must be kept current. A schedule slip requires a documented revised date, a justification (e.g., vendor dependency), and notification to the authorizing official, ideally with compensating controls. Closing the item or reclassifying severity to avoid a deadline is improper, and waiting for the annual assessment violates continuous monitoring expectations.

Question 2

An organization inherits a control (physical access to the data center) from a colocation provider that holds a SOC 2 Type II report. The report contains a qualified opinion on the physical access criterion and lists a Complementary User Entity Control (CUEC) requiring customers to review badge access lists quarterly. What is the MOST appropriate compliance program response?

Accepted Answer

Document the control as partially inherited, assess the exception's impact on the organization's risk, implement the CUEC, and add compensating controls or a risk decision as needed

Answer

A qualified opinion means the provider's control did not operate effectively in some respect, so inheritance cannot be taken at face value. The customer must still perform its CUEC responsibilities and evaluate the exception, applying compensating controls or documenting a risk decision. Type I does not test operating effectiveness, and removing the control from the SSP misrepresents the shared responsibility.

Question 3

During an internal audit of a compliance program, the auditor finds that control testing is performed by the same team that operates the controls, and results are reported only to the control owners' manager. Which governance model change BEST addresses this weakness under the three lines of defense concept?

Accepted Answer

Move testing to an independent second-line compliance or risk function, with results reported to a risk or audit committee, and keep internal audit as a third-line assurance provider

Answer

Control owners (first line) should not be the sole testers of their own controls. Independent second-line monitoring with reporting to a governance body, plus separate third-line internal audit assurance, restores objectivity. Having internal audit do all testing compromises its independence, and increasing frequency does not address self-review bias.

Question 4

A multinational organization is subject to both HIPAA and GDPR for a shared patient-data platform. A compliance program team is mapping the two regimes into a unified control framework. Which approach is MOST defensible when requirements conflict, for example on breach notification timing and data retention?

Accepted Answer

Apply the most stringent applicable requirement for each control objective, document the legal basis and any jurisdiction-specific exceptions, and obtain legal counsel review

Answer

A harmonized control set normally uses the most stringent applicable requirement per control objective (e.g., the 72-hour GDPR notification window versus HIPAA's 60 days), with documented legal rationale and counsel review for true conflicts such as retention limits versus record-keeping duties. Choosing the weaker standard risks non-compliance in the stricter jurisdiction.

Question 5

A compliance program's key risk indicator (KRI) for overdue control attestations has remained green for 12 months. An independent review finds that attestations are routinely auto-approved by a workflow after 5 days with no response. What is the PRIMARY compliance program deficiency?

Accepted Answer

The metric measures completion activity rather than control effectiveness, so it provides false assurance

Answer

Auto-approval on silence makes the metric reflect process throughput, not that owners actually verified their controls. The KRI therefore gives false assurance. Effective compliance metrics should measure outcomes or evidence of effectiveness, and the attestation design should require affirmative responses.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Compliance Programs 6