GRC Risk Assessment and Identification Techniques 3

Question 1

Which risk identification method involves structured interviews and workshops with business stakeholders to surface risks from those closest to the processes?

Accepted Answer

Facilitated risk workshops and interviews

Answer

Facilitated workshops and interviews engage process owners and subject-matter experts directly, leveraging their knowledge to identify risks that may not be visible from data alone.

Question 2

A Control Self-Assessment (CSA) is a technique where:

Accepted Answer

Management and staff assess the effectiveness of controls over their own processes

Answer

CSA empowers process owners and their teams to evaluate control effectiveness themselves, promoting accountability and surfacing risk insights without waiting for formal audits.

Question 3

When assessing risk likelihood (probability), which scale is commonly used in qualitative risk assessment?

Accepted Answer

Ordinal scales such as Rare / Unlikely / Possible / Likely / Almost Certain

Answer

Qualitative likelihood assessments use descriptive ordinal scales to categorize how frequently a risk event might occur, without requiring precise statistical probabilities.

Question 4

What is the primary purpose of a risk appetite statement in an organization?

Accepted Answer

To communicate the amount and type of risk the board and senior management are willing to accept in pursuit of objectives

Answer

A risk appetite statement formally articulates the board-approved boundaries of acceptable risk-taking, guiding strategic decisions and operational risk management.

Question 5

Which concept describes the process of systematically identifying potential risks by examining all assets, threats, and vulnerabilities in a structured manner?

Accepted Answer

Risk identification

Answer

Risk identification is the process of finding, recognizing, and describing risks before they can be analyzed or treated, forming the first step of the risk management cycle.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC Risk Assessment and Identification Techniques 3