Principles and Models Flashcards
7 cards from real GRC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Principles and Models flashcards as text
Which governance concept describes the board's responsibility to ensure the organization acts in the long-term interests of shareholders and other stakeholders?
Answer: Agency theory
Agency theory addresses the relationship between principals (shareholders) and agents (management), and the board's role in aligning these interests.
Under ISO 31000:2018, what is the correct sequence of the risk management process?
Answer: Identify, Analyze, Evaluate, Treat
ISO 31000 defines the risk management process as: communication and consultation, scope/context/criteria, risk assessment (identify, analyze, evaluate), risk treatment, and monitoring/review.
Which term describes the scenario where an organization decides to accept a risk because the cost of mitigation exceeds the potential loss?
Answer: Risk acceptance
Risk acceptance (or retention) is a deliberate decision to tolerate a risk when the cost-benefit analysis shows mitigation is not economically justified.
The principle of 'tone at the top' in GRC governance refers to:
Answer: Leadership's visible commitment to ethics, compliance, and risk culture
Tone at the top reflects how senior leaders' attitudes and behaviors toward ethics and compliance set the cultural standard for the entire organization.
In GRC, a 'control objective' is best defined as:
Answer: A statement of the desired result or purpose to be achieved by implementing controls
A control objective states the goal that a control is designed to achieve, providing the basis for designing and evaluating the control.
Which risk response strategy involves shifting the financial consequence of a risk to a third party, such as through insurance?
Answer: Risk transfer
Risk transfer moves the financial burden of a risk to another party (e.g., insurer or vendor) while the organization may still retain some residual risk.
Which of the following best describes the relationship between governance, risk management, and compliance in an integrated GRC model?
Answer: They are interdependent disciplines that share data, processes, and objectives to create organizational value
An integrated GRC model recognizes that governance, risk, and compliance are mutually reinforcing and share common information, enabling better decision-making and efficiency.