GRC Risk Assessment and Identification Techniques

Question 1

Which tool is most commonly used to document and track identified risks, their likelihood, potential impact, and assigned owners within an organization?

Accepted Answer

Risk register

Answer

A risk register is the primary GRC artifact for cataloging risks along with their attributes such as likelihood, impact, owner, and mitigation status.

Question 2

A risk heat map that plots risks by likelihood on one axis and impact on the other is also known as a:

Accepted Answer

Risk matrix

Answer

A risk matrix (heat map) uses a two-axis grid of likelihood and impact to visually prioritize risks by their severity.

Question 3

What is the primary difference between qualitative and quantitative risk assessment?

Accepted Answer

Qualitative uses descriptive rankings; quantitative uses numerical values and statistical methods

Answer

Qualitative assessments categorize risks using descriptive scales (high/medium/low), while quantitative assessments assign numerical probabilities and financial impact figures.

Question 4

In GRC, what does 'inherent risk' refer to?

Accepted Answer

The risk that exists before any controls or mitigating actions are implemented

Answer

Inherent risk is the level of risk in the absence of any controls or mitigating measures, representing the raw exposure.

Question 5

Which risk identification technique involves gathering input from a panel of experts through multiple anonymous rounds of questionnaires to reach consensus?

Accepted Answer

Delphi technique

Answer

The Delphi technique uses iterative, anonymous expert surveys to converge on a consensus view of risk likelihood and impact.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC Risk Assessment and Identification Techniques