GRC Principles and Models 4

Question 1

Which framework introduced the concept of 'Capability Maturity Model' adapted for GRC programs to measure process improvement?

Accepted Answer

CMMI

Answer

The Capability Maturity Model Integration (CMMI) provides a scale from Level 1 (Initial) to Level 5 (Optimizing) to measure the maturity of organizational processes including GRC.

Question 2

In the context of GRC, 'control self-assessment' (CSA) is best described as:

Accepted Answer

A process where management and staff evaluate their own controls' effectiveness

Answer

Control self-assessment involves process owners and employees evaluating the adequacy and effectiveness of controls in their own area of responsibility.

Question 3

Under the COBIT framework, which domain is primarily concerned with setting direction and aligning IT with business goals?

Accepted Answer

Align, Plan and Organize

Answer

The 'Align, Plan and Organize' (APO) domain in COBIT addresses how IT strategy and planning align with business objectives.

Question 4

The FAIR (Factor Analysis of Information Risk) model is distinctive because it:

Accepted Answer

Quantifies information risk in financial terms

Answer

FAIR is a quantitative risk analysis model that expresses information risk in monetary terms, enabling direct comparison with business costs and benefits.

Question 5

Which principle in governance theory holds that those who make decisions should be held answerable for the outcomes of those decisions?

Accepted Answer

Accountability

Answer

Accountability is the obligation of decision-makers to answer to stakeholders for their actions and the results those actions produce.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC Principles and Models 4