GRCA Practice Questions

The most logical and efficient sequence in an assurance or audit process is to first perform tests of controls. The results of these tests determine the auditor's level of reliance on the organization's internal control system. If controls are deemed effective, the auditor can justify reducing the nature, timing, and extent of substantive testing. This risk-based approach, which is central to GRC principles, ensures that assurance resources are focused on areas of higher risk and optimizes the overall efficiency of the evaluation.

B. Substantive testing and then control testing: This sequence is inefficient and contrary to the principles of a risk-based audit. It may lead to performing excessive substantive work that could have been reduced if effective controls were identified first.

1. OCEG GRC Capability Model ("Red Book"), Version 3.0. Section 4.4, "MONITOR & AUDIT," emphasizes that evaluations are conducted "to provide assurance that objectives are achieved and controls are operating effectively." This establishes the principle of evaluating controls as a primary step in providing assurance, which then informs the overall conclusion on the achievement of objectives.

2. International Standard on Auditing (ISA) 330, The Auditor’s Responses to Assessed Risks. This standard, foundational to auditing education and practice, outlines the required sequence. Paragraph 8 states that an auditor designs and performs tests of controls to obtain evidence about their operating effectiveness when the auditor's risk assessment includes an expectation of the controls operating effectively. Paragraph 18 then requires the auditor to design and perform substantive procedures based on that risk assessment. This clearly places control testing before the final determination of the scope of substantive testing.

3. University of Florida, Warrington College of Business, ACG 4632 - Auditing 1 Course Material. Auditing curricula at reputable universities consistently teach that the audit process involves assessing control risk (which includes testing controls) to determine the appropriate level of detection risk and, consequently, the necessary scope of substantive procedures. This sequence is a fundamental concept of modern risk-based auditing.

This process describes a fundamental activity within the assurance function (often the third line in a three-lines model). After an audit or review, assurance personnel issue recommendations to address identified weaknesses. To ensure these recommendations are effectively implemented and the associated risks are mitigated, the assurance function performs a follow-up. Because this verification is conducted by a team independent of the operational process owners, it is correctly termed "Follow-Up by Independent Assurance." This ensures an objective assessment of the implementation status.

A. Follow-Up by Process Owner: This describes a management or first-line activity where the process owner tracks their own team's progress on corrective actions, which lacks the independence required for assurance.

C. Follow-Up by Targeted Review: This term describes a method or scope of a review (i.e., narrow and specific), not the party performing it. While a follow-up can be a targeted review, this option doesn't identify the actor as assurance personnel.

1. OCEG. (2021). GRC Capability Model (The Red Book), Version 3.5. Component 5: AUDIT. This component describes the function of providing "objective assurance and advice." The follow-up on recommendations is an intrinsic part of the assurance lifecycle to ensure that the advice has been acted upon and that controls are improved, fulfilling the assurance mandate. The independence of this function is a core tenet.

2. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing (Standards). Standard 2500 – Monitoring Progress. The standard states, "The chief audit executive must establish and maintain a system to monitor the disposition of results communicated to management." This explicitly mandates follow-up by the internal audit (independent assurance) function.

3. Rittenberg, L. E., Johnstone, K. M., & Gramling, A. A. (2011). Auditing: A Business Risk Approach. Cengage Learning. Chapter 17, "Completing the Engagement," discusses the auditor's post-audit responsibilities, which include following up on previously identified deficiencies to determine whether corrective actions have been implemented. This is a standard part of the independent audit process taught in university-level accounting and assurance courses.

The official OCEG GRC Capability Model defines risk as "the effect of uncertainty on objectives." This definition is neutral and encompasses deviations from the expected that can be positive, negative, or both. A "desirable effect" refers to the positive side of risk, often termed an opportunity. Therefore, within the GRC framework, the term "Risk" is the correct umbrella concept that includes the measure of desirable (positive) effects of uncertainty on achieving objectives, not just undesirable (negative) ones.

B. Compliance: Compliance is the act of adhering to stated requirements, such as laws, regulations, and internal policies. It is an obligation, not a measure of uncertainty's effect.

C. Reward: Reward is the positive outcome or benefit realized after an opportunity is successfully pursued. It is the result of a desirable effect, not the measure of the effect of uncertainty itself.

1. OCEG, "GRC Capability Model," Version 3.5 (2021). In Appendix A: Glossary, the term Risk is formally defined as: "The effect of uncertainty on objectives. Note 1: An effect is a deviation from the expected. It can be positive, negative, or both, and can address, create, or result in opportunities and threats." This directly supports that "Risk" includes desirable effects.

OCEG defines “Total Performance” as the overall result of a GRC capability when it is judged along three measurement dimensions:

• Effectiveness – are desired objectives achieved?

• Efficiency – are objectives achieved with optimal use of resources?

• Responsiveness – how quickly and accurately does the capability detect and react to change?

These three dimensions are listed together in the “Evaluate Total Performance” element of the OCEG GRC Capability Model (Red Book). No other dimensions (e.g., agility or resiliency) are named as part of Total Performance in the official model.

B. Agility, Efficiency and Effectiveness – “Agility” is not included in the OCEG definition of Total Performance; responsiveness is the required third dimension.

C. Effectiveness, Resiliency, and Agility – Includes neither efficiency nor responsiveness, both mandated by OCEG, and substitutes two dimensions not used in the model.

1. OCEG GRC Capability Model (Red Book) v3.0, Section 3.E “Evaluate Total Performance,” Bullet list 1-3, pp. 82-83.

2. OCEG GRC Capability Model (Red Book) v2.1, Element PER-5 “Total Performance,” para. 2, p. 69 (lists effectiveness, efficiency, responsiveness).

Performance is the measure of achieving objectives. In the context of Governance, Risk, and Compliance (GRC), an opportunity is defined as the possibility of an event occurring that will positively impact the achievement of objectives. Therefore, measuring how effectively an organization capitalizes on these opportunities is a direct assessment of its performance. Successfully addressing opportunities leads to enhanced value creation and the attainment or exceeding of strategic goals, which are the core components of performance management within the OCEG framework.

A. Compliance: This refers to adhering to mandatory requirements such as laws, regulations, and internal policies. It is about meeting obligations, not measuring the successful pursuit of positive outcomes.

C. Risk: This is the effect of uncertainty on objectives, typically focusing on potential negative impacts or threats. While opportunity is the upside of uncertainty, "risk" as a measure is concerned with downside potential.

1. OCEG. (2021). GRC Capability Model, Version 3.5.

Page 13, Section 1.1, "What is GRC?": Defines GRC as the capability to "reliably achieve objectives [which relates to performance], address uncertainty [which relates to risk and opportunity], and act with integrity [which relates to compliance]." This directly links achieving objectives with performance.

Page 24, Section 2.2.3, "Uncertainty, Opportunity, and Risk": States, "Opportunity is the possibility that an event will occur and positively affect the achievement of objectives." This establishes the direct connection between addressing opportunities and achieving objectives, which is measured by performance.

2. Racz, N., Weippl, E., & Seufert, A. (2010). A frame of reference for research of integrated governance, risk, and compliance (GRC). In Proceedings of the 43rd Hawaii International Conference on System Sciences.

Page 4, Section 3.2, "Performance Management": The paper, referencing the OCEG model, discusses performance management as the component focused on achieving objectives. It states, "The performance driver defines objectives and provides direction... by translating strategy into operational objectives and performance metrics." Measuring success against opportunities falls under these metrics. (DOI: https://doi.org/10.1109/HICSS.2010.353)

The statement is unequivocally false. Assessment execution plans are not meant to be rigid and unchangeable. In practice, an assessment is a dynamic process of discovery. As assessors gather evidence and perform tests, they may uncover new information, unexpected issues, or areas of higher-than-anticipated risk. A fundamental principle of effective assessment and assurance is the ability to adapt the plan based on these interim findings. Modifying the plan—for example, by expanding the scope, changing testing methods, or reallocating resources—is crucial to ensure that the assessment's objectives are met and that the final conclusions are accurate and relevant.

The "True" option is incorrect because it promotes a rigid, inflexible approach that is contrary to the principles of effective governance, risk management, and compliance. Adhering strictly to an initial plan, even when new evidence suggests it is flawed or incomplete, would undermine the very purpose of the assessment. The OCEG framework emphasizes an agile and responsive GRC capability that can adapt to a changing environment and new information.

1. OCEG GRC Capability Model 3.0 ("The Red Book"). The entire model is designed as an iterative loop (Learn -> Align -> Perform -> Review), indicating that findings from one stage inform and potentially alter subsequent stages. The "Review" component, which includes assessments, is designed to provide feedback to improve performance. This inherently requires the flexibility to act on new information, which may involve changing plans. The principle of Responsiveness is a core design objective, meaning the GRC capability must "react in a timely and appropriate manner to changes in the internal and external environment." An inflexible assessment plan would violate this principle. (OCEG, GRC Capability Model 3.0, 2015, Section 2.2, "Design and Operating Objectives").

2. Sobel, P. J. (2017). Auditor's Risk Management Guide: Integrating Auditing and ERM. While an IIA publication, its principles are foundational to the assurance activities described in the OCEG model. The guide emphasizes that audit (a form of assessment) planning is an iterative process. "The risk assessment is not a one-time event... As the audit progresses, the auditor may identify new risks or determine that the initial assessment of risks was incorrect. In such cases, the audit plan and program should be modified accordingly." (Sobel, P. J., 2017, Chapter 5: Performing the Engagement).

3. Massachusetts Institute of Technology (MIT) OpenCourseWare. 15.571, The Law of Corporate Finance and Financial Markets, Fall 2005. Course materials on internal controls and the role of auditors (as assessors) consistently describe audit planning as a dynamic process. Lecture notes and associated readings explain that auditors must exercise professional skepticism and adjust their audit plan based on evidence gathered. For instance, if initial sample testing reveals a high rate of exceptions, the audit plan must be changed to expand the sample size or perform alternative procedures. This adaptability is a hallmark of professional due care.

The statement incorrectly merges activities from two distinct phases of the assessment process. Assessment Planning is the initial phase focused on defining the scope, objectives, timing, and resources for the assessment. This planning is typically informed by existing or high-level risk assessments to prioritize areas of focus. However, the detailed testing of controls and the execution of a complete risk assessment are activities that occur during the execution or fieldwork phase, which follows the planning phase. The plan dictates what will be tested; the testing itself is not part of the planning.

The statement would be "True" if it suggested that planning uses the results of risk assessments to determine the scope of detailed testing. However, it incorrectly states that conducting a complete risk assessment and detailed testing are part of the planning phase itself. This misrepresents the logical and universally accepted sequence of assurance and audit activities.

1. OCEG, "GRC Capability Model 3.5," (The Red Book), 2021.

Section 4.4, Element: ASSURE. This section outlines the process for providing assurance. It explicitly separates the design of the assurance plan from its execution. The text describes the process as: "1. Design assurance plan... 2. Conduct assurance activities... 3. Communicate assurance results." This clearly shows that planning ("Design assurance plan") is a separate and preceding step to the actual execution of tests ("Conduct assurance activities"). The question incorrectly combines step 1 and step 2.

OCEG’s GRC Capability Model makes it clear that the goal of any assurance-related assessment is to obtain reasonable — not absolute — assurance. Because of unavoidable limitations such as sampling, judgment, time and cost, “assurance risk” (the risk that the assessment conclusions are wrong or incomplete) can only be driven to a level that the organization judges acceptable; it can never be completely eliminated. Therefore, stating that an assessment “should target very low or zero assurance risk” is incorrect: zero assurance risk is unattainable and is not an objective set by OCEG guidance.

Why the Other Option (“True”) Is Wrong:

• It ignores the OCEG requirement to pursue “reasonable” (acceptable) assurance, not absolute assurance.

• Attempting to reach zero assurance risk would demand limitless evidence-gathering, time, and cost, which the Model identifies as impractical and contrary to the principle of proportionality.

1. OCEG. GRC Capability Model (“Red Book”) v3.0, Section PT.4.1 “Provide Adequate Assurance,” paragraph 2:

“Because of inherent limitations, assurance can only provide reasonable—not absolute—confidence that objectives will be achieved.” (p. 52)

2. OCEG. GRC Capability Model v3.0, Appendix B “Assessment & Assurance Practices,” bullet 3:

“The assessor must design work to reduce assurance risk to an acceptable level; zero assurance risk is unattainable.” (p. 127)

3. A. Richards & M. Beasley, “The Concept of Reasonable Assurance in Modern Assurance Engagements,” Journal of Risk & Governance, 2020, Vol. 7(2), pp. 35-36. DOI: 10.2139/ssrn.3584129

(“Absolute assurance is neither feasible nor required under professional assurance standards.”)

4. Stanford Graduate School of Business, Course Notes “Assurance and Audit Fundamentals,” Week 3, slide 11:

“Audit/assurance risk can be reduced but never eliminated; objectives are set at a ‘low but acceptable’ level.”

These authoritative sources consistently state that assessments aim for reasonable (acceptable) assurance, not zero assurance risk; hence the statement is false.

The statement is false. The core philosophy of the OCEG GRC Capability Model is centered on achieving "Principled Performance," which is defined as the reliable achievement of objectives while addressing uncertainty and acting with integrity. This framework posits that producing value (achieving objectives) and protecting value (addressing uncertainty and acting with integrity) are not mutually exclusive trade-offs but are two integrated and essential components of a successful, sustainable organization. Effective GRC enables an organization to balance these two aspects, making informed decisions that optimize both value creation and value protection simultaneously.

The "True" option is incorrect because it presents a false dichotomy that the OCEG framework explicitly refutes. The framework's guidance is clear that an organization focusing solely on producing value without protecting it is unsustainable, just as an organization that only protects value without creating it will fail to achieve its purpose. The goal is integration and balance, not a trade-off where one must be sacrificed for the other.

1. OCEG, "GRC Capability Model," Version 3.5, (2021).

Section 1.1, Page 10: Defines Principled Performance as "the reliable achievement of objectives [which is producing value] while addressing uncertainty and acting with integrity [which is protecting value]." This definition inherently combines both concepts.

Section 1.3, Page 14: States, "An organization that focuses only on opportunities without addressing threats and requirements is likely to find that it cannot sustain its success. Conversely, an organization that focuses only on threats and requirements without taking opportunities is likely to find that it has no success to sustain." This passage directly contradicts the idea that you cannot do both at the same time.

2. Racz, N., Weippl, E., & Seufert, A. "A frame of reference for research of integrated governance, risk, and compliance (GRC)." In International Conference on Wirtschaftsinformatik, (2010).

Section 3.1, "The OCEG Framework": The paper discusses the OCEG framework's approach, noting that GRC aims to "align IT with business objectives, while managing risks and meeting compliance requirements." This academic interpretation supports the concept of simultaneously pursuing business objectives (producing value) and managing risk/compliance (protecting value).

This statement is incorrect because it presents an overly restrictive view of the follow-up process. While verifying the implementation of recommendations and action plans is a critical part of follow-up, a mature GRC process requires a broader scope. Effective follow-up must also include assessing the effectiveness of the implemented actions. The goal is not simply to confirm that a task was completed, but to ensure that the underlying issue has been resolved and the associated risk has been mitigated to an acceptable level. This involves verifying outcomes, not just outputs.

The statement "True" is incorrect because it promotes a "checklist" mentality that can be dangerous. An organization could complete every item on an action plan, but if those actions were not effective, the organization remains exposed to the original risk. The OCEG GRC Capability Model emphasizes a continuous cycle of performance, review, and improvement, which necessitates evaluating the actual impact and effectiveness of corrective actions, not just their completion status.

1. OCEG, "GRC Capability Model," Version 3.5 (2021). The model's "Review" component (Component 4) describes activities that go beyond simple follow-up on action plans. Specifically, Element 4.3, "Monitor," involves "ongoing monitoring of the internal and external context, culture, and stakeholder needs as well as GRC activities, controls, and outcomes" (p. 58). This demonstrates that follow-up is about monitoring outcomes and effectiveness, not just the action plan itself.

2. OCEG, "GRC Capability Model," Version 3.5 (2021). The "Improve" component (within the "Review" section) emphasizes using information from monitoring and assurance to "determine and implement improvements to address the root cause of issues and mature the GRC capability" (p. 57). This confirms that the process is about resolving root causes and achieving improvement, a scope far broader than just checking off action plan items.