GRC Risk Assessment and Identification Techniques 2

Question 1

Which analytical framework examines Political, Economic, Social, Technological, Legal, and Environmental factors to identify external risks?

Accepted Answer

PESTLE analysis

Answer

SWOT analysis

Answer

COSO framework

Answer

ISO 31000

Question 2

In quantitative risk assessment, Monte Carlo simulation is used to:

Accepted Answer

Run thousands of random scenarios to model the probability distribution of potential outcomes

Answer

Rank risks qualitatively using color-coded heat maps

Answer

Assign controls to risks based on cost-benefit ratios

Answer

Calculate inherent risk before applying controls

Question 3

What is the definition of 'residual risk' in a GRC context?

Accepted Answer

The portion of risk that remains after controls and mitigation measures have been applied

Answer

The total of all identified risks before assessment

Answer

The risk transferred to insurers or third parties

Answer

The maximum possible loss from a single risk event

Question 4

Key Risk Indicators (KRIs) are best described as:

Accepted Answer

Leading metrics that provide early warning signals that a risk may be increasing

Answer

Lagging metrics that confirm a risk event has already occurred

Answer

Policy documents that define acceptable risk thresholds

Answer

Audit findings documenting control deficiencies

Question 5

Fault tree analysis (FTA) is a risk assessment technique that:

Accepted Answer

Uses a top-down, deductive logic diagram to trace causes leading to an undesired top event

Answer

Identifies all potential benefits of a control environment

Answer

Maps process flows to compliance requirements

Answer

Ranks risks numerically by expected monetary value

Question 6

Scenario analysis in GRC is primarily used to:

Accepted Answer

Evaluate the potential impact of specific hypothetical risk events on the organization

Answer

Automate risk reporting across business units

Answer

Replace the need for a risk register

Answer

Calculate the annualized loss expectancy of cyber incidents

Question 7

In risk assessment, Expected Monetary Value (EMV) is calculated as:

Accepted Answer

Probability of risk occurrence multiplied by the financial impact of the risk

Answer

The sum of all risk scores across all business units

Answer

The cost of controls divided by residual risk exposure

Answer

The annualized premium paid for risk transfer through insurance