CGRC Governance Principles 5 — Questions and Answers
Question 1: Which governance artifact maps organizational roles to specific responsibilities for risk and compliance activities?
- Risk register
- RACI matrix (Correct answer)
- Control catalog
- Risk appetite statement
Correct answer: RACI matrix
A RACI matrix defines who is Responsible, Accountable, Consulted, and Informed for each activity, clarifying governance responsibilities.
Question 2: A company's board receives a monthly dashboard of compliance metrics. This practice best demonstrates which governance principle?
- Transparency and oversight (Correct answer)
- Risk tolerance
- Operational efficiency
- Legal compliance
Correct answer: Transparency and oversight
Providing the board with regular compliance metrics demonstrates transparency and enables effective oversight by the governing body.
Question 3: Which of the following represents a governance failure rather than a pure operational failure?
- A server crash due to hardware failure
- Systematic overriding of expense approval controls by senior management (Correct answer)
- A typo in a customer invoice
- Network latency during peak hours
Correct answer: Systematic overriding of expense approval controls by senior management
Systematic management override of controls indicates a breakdown in governance structures designed to ensure accountability and proper oversight.
Question 4: In ISO 37000 (Governance of Organizations), which principle focuses on ensuring the organization creates value for stakeholders while managing trade-offs?
- Accountability
- Strategy
- Value generation (Correct answer)
- Risk governance
Correct answer: Value generation
ISO 37000's value generation principle requires governing bodies to ensure the organization creates sustainable value while balancing stakeholder interests.
Question 5: Which scenario best illustrates a conflict of interest that undermines governance effectiveness?
- A CFO presenting financial results to the board
- A board member voting on a contract award to a company they own (Correct answer)
- An employee reporting a compliance concern to HR
- A manager approving their own team's budget
Correct answer: A board member voting on a contract award to a company they own
A board member voting on a contract with a company they own has a direct financial interest that compromises their objectivity and independence.
Question 6: Which activity is most associated with the 'oversight' function of governance as distinct from 'management'?
- Approving individual purchase orders
- Monitoring organizational performance against strategic objectives (Correct answer)
- Hiring department staff
- Configuring IT security controls
Correct answer: Monitoring organizational performance against strategic objectives
Governance oversight focuses on monitoring whether management is achieving strategic objectives, not on executing day-to-day operational tasks.
Question 7: Which of the following best describes 'ethical culture' as a component of governance?
- A written code of ethics filed with regulators
- Shared values and behaviors that guide decision-making throughout the organization (Correct answer)
- The HR department's disciplinary process
- Annual ethics training completion rates
Correct answer: Shared values and behaviors that guide decision-making throughout the organization
Ethical culture encompasses the lived values and behavioral norms that guide how people actually make decisions, going beyond formal documents or training.
CGRC Governance Principles 5
Which governance artifact maps organizational roles to specific responsibilities for risk and compliance activities?