Free OCEG GRCP Practice Exam with Questions & Answers

The effect of uncertainty on objectives, commonly referred to as risk, is assessed using two key measures: likelihood (probability of occurrence) and impact (severity of consequences). Together, these metrics form the basis of most risk assessment methodologies.

Key Points About Likelihood and Impact:

Likelihood: Measures the probability or frequency of a risk event occurring.

Impact: Measures the severity of the consequences if the risk event occurs.

Application in Risk Management:

The COSO ERM Framework and ISO 31000 emphasize assessing both likelihood and impact to evaluate and prioritize risks.

Risk = Likelihood × Impact is a common formula used in risk scoring and heat maps.

Why Option A is Correct:

Likelihood and impact are the two standard measures used to evaluate the effect of uncertainty on objectives.

Why the Other Options Are Incorrect:

B. Probability and consequence: These terms are similar to likelihood and impact but are less commonly used in risk management terminology.

C. Certainty and effect: Certainty is the opposite of uncertainty, and "effect" is not a measure but a result.

D. Accuracy and precision: These relate to measurement quality, not risk evaluation.

References and Resources:

ISO 31000:2018 – Highlights the use of likelihood and impact in risk assessments.

COSO ERM Framework – Provides methodologies for evaluating risks using likelihood and impact.

NIST RMF – Uses likelihood and impact as part of risk assessment and prioritization.

The governing board plays a central role in balancing the competing needs of stakeholders while ensuring the organization operates with integrity, reliability, and accountability. This aligns with governance principles that emphasize strategic oversight, risk management, and compliance.

Responsibilities of a Governing Board:

Strategic Oversight:

Guides the organization by setting objectives and ensuring alignment with its mission and values.

Balancing Stakeholder Needs:

Balances the interests of diverse stakeholders, such as shareholders, employees, customers, regulators, and the community.

Constrain and Conscribe:

Ensures that resources are appropriately allocated, risks are managed, and ethical standards are upheld.

Integrity and Reliability:

Enforces a culture of accountability and ethical behavior through governance policies and frameworks.

Why Option D is Correct:

The governing board is responsible for guiding the organization strategically, constraining it through policies, and conscribing its actions to ensure alignment with objectives and values.

Options A (risk manager), B (general counsel), and C (compliance unit) are specialized roles that focus on specific aspects of GRC, but they report to and operate under the guidance of the governing board.

Relevant Frameworks and Guidelines:

ISO 37000 (Governance of Organizations): Defines the role of governing bodies in balancing stakeholder needs and ensuring principled performance.

COSO ERM Framework: Emphasizes governance as a critical component of enterprise risk management.

In summary, the governing board ensures the organization achieves its objectives, manages uncertainty, and acts with integrity, making it the central body for balancing stakeholder needs.

Assurance Actions & Controls in the IACM are designed to validate and confirm that the organization's objectives are being achieved and that processes, controls, and systems are functioning effectively.

Key Points About Assurance Actions & Controls:

Purpose:

Assurance provides independent and objective evaluations of processes, controls, and outcomes to ensure reliability and accountability.

Examples include internal audits, compliance assessments, and external certifications.

Support for Assurance Personnel:

These controls assist assurance professionals, such as auditors or compliance officers, in delivering credible and effective assurance services.

Why Option A is Correct:

The role of Assurance Actions & Controls is to assist assurance personnel in delivering assurance services by providing reliable data, processes, and evaluations.

Why the Other Options Are Incorrect:

B: Assessing new products is a business development function, not an assurance activity.

C: Financial statement analysis falls under financial management, not assurance controls.

D: Creating a positive culture is a leadership activity, not an assurance function.

References and Resources:

COSO Internal Control – Integrated Framework – Discusses assurance activities.

IIA Standards – Provide guidance on assurance roles in internal auditing.

Suitable criteria in the assurance process are essential for evaluating the subject matter being assessed, ensuring that consistent and meaningful results are achieved.

Role of Suitable Criteria:

Provide a foundation for comparison, making it possible to measure the accuracy, reliability, and integrity of the subject matter being evaluated.

These criteria help standardize assessments across different evaluations and maintain consistency.

Why Other Options Are Incorrect:

A: Performance metrics assess operations but are not the primary role of criteria in the assurance process.

B: Ethical standards are important but are not the focus of the evaluation criteria used in assurance activities.

C: Resource allocation is a separate strategic task, not directly linked to assurance criteria.

Inconsistent incentives refer to rewards or recognition that are applied unevenly or unfairly across employees or business partners. These inconsistencies can result in negative perceptions, including favoritism and mistrust, which can erode morale, collaboration, and loyalty.

Key Impacts of Inconsistent Incentives:

Perceptions of Favoritism:

Employees or business partners may feel that others are unfairly rewarded or treated preferentially, leading to resentment.

Example: Only rewarding a select few employees for group efforts without clear criteria.

Erosion of Trust:

Inconsistent application of incentives can undermine trust in management or leadership.

Example: Changing bonus criteria without transparency may cause employees to doubt the fairness of the system.

Decreased Morale and Engagement:

Employees or partners may become disengaged if they perceive unfairness, leading to reduced collaboration and performance.

Why Option B is Correct:

Inconsistent incentives create perceptions of favoritism and mistrust, harming relationships and organizational culture.

Why the Other Options Are Incorrect:

A. Reduce the risk of legal disputes: Inconsistent incentives are more likely to increase, not reduce, the risk of legal or contractual disputes.

C. Increase employee motivation and productivity: Perceived unfairness typically reduces, rather than increases, motivation and productivity.

D. Improve the company’s public image: Negative perceptions due to inconsistent incentives can damage, not enhance, a company’s reputation.

References and Resources:

ISO 37001:2016 – Highlights the risks of inconsistent incentive systems in anti-bribery management.

COSO ERM Framework – Discusses the importance of fair and transparent incentives in achieving organizational objectives.

Harvard Business Review – Research on the effects of fairness and consistency in incentive programs.

The two types of Proactive Actions & Controls in the IACM are:

Prevent/Deter Actions & Controls:

Focus on avoiding unfavorable events and reducing risks before they occur.

Example: Implementing security protocols to deter cyberattacks.

Promote/Enable Actions & Controls:

Facilitate the realization of opportunities and favorable outcomes.

Example: Employee training programs to improve productivity.

Why Other Options Are Incorrect:

A: Reactive and passive actions are not proactive by definition.

C: Centralization/decentralization pertains to organizational structure.

D: Quantitative and qualitative are methods, not categories of controls.

“Total Performance” in GRC-aligned performance and risk thinking refers to achieving organizational objectives in a way that is not narrowly optimized for a single outcome (profit, growth, or compliance), but balanced across the characteristics needed for sustainable success. Option D reflects the commonly used definition: total performance is the balance of effectiveness (achieving intended outcomes), efficiency (optimized use of resources), responsiveness (ability to sense and react to change), and resilience (ability to withstand disruption and recover). This aligns with integrated governance approaches that treat performance, risk, and compliance as interconnected—over-optimizing one dimension often weakens another (e.g., extreme efficiency can reduce resilience; growth can increase risk exposure). Boards and executives therefore use governance, risk appetite, internal control, and assurance mechanisms to sustain this balanced state over time. Options A–C are important strategic goals for some organizations, but they are not the ultimate goal of total performance as defined in integrated GRC models.

Improvement plans typically introduce new processes, controls, roles, technologies, or behavioral expectations. Without structured change management, even well-designed improvements often fail due to confusion, resistance, inconsistent adoption, or lack of reinforcement. Incorporating change management activities—such as stakeholder analysis, communication planning, training, leadership sponsorship, readiness assessments, rollout sequencing, and feedback loops—increases awareness, builds understanding, and improves acceptance of the change across affected organizational units. This directly supports GRC objectives: controls must be understood and embedded into daily work to be “operating effectively,” and governance expects evidence that changes were implemented consistently, not just documented. Change management also helps manage transition risks (service disruption, control gaps, unintended consequences) and supports sustainability through reinforcement and measurement after implementation. Options A, B, and C are either incorrect or too narrow: change management does not reduce training needs (it usually includes training), it is not primarily about accounting accuracy, and while it can help M&A integration, its broad purpose in improvement plans is ensuring people adopt and maintain the new way of working—best captured by option D.

Beliefs are fundamental ideas or assumptions individuals or groups hold within an organization. These beliefs shape the culture and influence behavior in significant ways.

Definition:

Beliefs stem from experiences, perceptions, and cultural influences, forming the foundation of values and principles.

Influence on Behavior:

Beliefs inform decision-making, align employee actions with organizational values, and guide ethical practices.

Organizational Impact:

Shared beliefs create a cohesive culture, align goals, and foster trust among stakeholders.