GRC Risk Assessment and Identification Techniques 3

Question 1

Which risk identification method involves structured interviews and workshops with business stakeholders to surface risks from those closest to the processes?

Accepted Answer

Facilitated risk workshops and interviews

Answer

Automated control testing

Answer

Regression analysis

Answer

External benchmarking only

Question 2

A Control Self-Assessment (CSA) is a technique where:

Accepted Answer

Management and staff assess the effectiveness of controls over their own processes

Answer

External auditors independently evaluate all key controls

Answer

Regulators review control documentation submitted by the organization

Answer

IT systems automatically test control configurations

Question 3

When assessing risk likelihood (probability), which scale is commonly used in qualitative risk assessment?

Accepted Answer

Ordinal scales such as Rare / Unlikely / Possible / Likely / Almost Certain

Answer

Net present value (NPV) scale

Answer

Binary (yes/no) classification only

Answer

Dollar-weighted probability index

Question 4

What is the primary purpose of a risk appetite statement in an organization?

Accepted Answer

To communicate the amount and type of risk the board and senior management are willing to accept in pursuit of objectives

Answer

To list every identified risk and its financial impact

Answer

To document the results of an annual internal audit

Answer

To define the IT security patch management schedule

Question 5

Which concept describes the process of systematically identifying potential risks by examining all assets, threats, and vulnerabilities in a structured manner?

Accepted Answer

Risk identification

Answer

Risk monitoring

Answer

Risk response planning

Answer

Risk acceptance

Question 6

In risk prioritization, which combination of factors typically determines a risk's priority for treatment?

Accepted Answer

Likelihood of occurrence and magnitude of potential impact

Answer

Cost of control implementation and audit frequency

Answer

Regulatory penalty amounts and board meeting schedule

Answer

Vendor reputation and geographic location

Question 7

SWOT analysis contributes to risk identification by helping an organization:

Accepted Answer

Identify internal Strengths and Weaknesses alongside external Opportunities and Threats

Answer

Calculate the annualized loss expectancy for each threat

Answer

Map regulatory requirements to internal control frameworks

Answer

Assign risk ownership to specific business unit leaders