8.6 Combining governance, risk and compliance

Question 1

What is a GRC framework?

Answer 1

A govenance, risk management and compliance management frameworks

Question 2

What is the rational for a GRC approach?

Answer 2

Governance, risk management and compliance management are inter-related and cannot be separated, so they must be integated. A silo approach is likely to be inefficient and leave gaps

Question 3

Which areas of an organisation are typically in scope for a GRC approach?

Answer 3

Finance
Information technology
Legal

Question 4

GRC consists of the following elements:

1 relevant p\_\_\_\_\_\_\_\_\_ and p\_\_\_\_\_\_\_\_\_\_\_
2 library of c\_\_\_\_\_\_\_\_\_
3 GRC m\_\_\_\_\_\_\_ used to report on events
4 results of risk a\_\_\_\_\_\_\_\_\_\_\_
5 incident m\_\_\_\_\_\_\_\_\_\_\_, to record any loss events
6 financial p\_\_\_\_\_\_\_\_\_ data
7 internal a\_\_\_\_\_ modules
8 action planning to address control w\_\_\_\_\_\_\_\_\_

Answer 4

policies and procedures
controls
metrics
assessments
management
performance
audit
weaknesses