Free GRC Auditor Certification Exam GRCA Exam Practice Test

Follow up should be restricted to the recommendations and action plan

• True. Only follow-up on planned actions and controls.
• False. Follow-Up should target the underlying risk. If the planned actions and controls are working, then the follow-up should identify and recommend changes.

When should Assessment Notification be announced?

• As late as possible in case there is fraud in the assessed area
• Depends on the Purpose and Parameters and whether fraud it suspected.
• As soon as possible to start planning

During Assessment Planning, it is important to conduct a complete risk assessment and conduct detailed testing to understand inherent risks and control risk.

• True. Everything needs to be fully understood before a plan can be finalized.
• False. Limited information gathering and procedures should be conducted to get an initial estimate of inherent risk and control risk so that planning can proceed.

Follow-up on the implementation status of the recommendation based on high priority, due or overdue items or time-sensitive items is known as:

• Follow-Up by Process Owner
• Follow-Up by Independent Assurance
• Follow-Up by Targeted Review

Which of these sources of evidence is MOST LIKELY to be MOST OBJECTIVE?

• Vocalized statements by the process owner
• Written report by an assurance professional
• Written report by the process owner

When inspecting information, the Content Criteria provides a guide to evaluating which of these

• Design of the control
• Substance of the operation in the field

What level of assurance is required for an assessment?

• Medium
• High
• Low
• An assessment may target any level of assurance. The key is to define this level prior to setting the purpose and parameters.

How would the following test be classified?The Assurance Provider inspects a RACI matrix for inclusion of best practice content.

• Control test
• Substantive test

Identifying root causes helps toBe more specific regarding who is to blameFind a solution to fixing not only this problem but potential other problems that result from the same root cause

• Latino
• A QUALIFIED assurance opinion or statement is
• An affirmative statement that subject matter conforms to the suitable criteria and is free from meaningful misunderstanding
• A statement that the assessment didn’t observe anything that makes us doubt whether subject
• matter conforms to the suitable criteria and is free from meaningful misunderstanding.
• A statement that the assessment encountered some limitations in what can be concluded and outside of those limitations a positive or negative statement can be offered.
• Explanation:
• A QUALIFIED assurance opinion or statement indicates that the assessment encountered some limitations, and outside of those limitations, a positive or negative statement can be offered. This type of opinion acknowledges that there are constraints that affected the scope or completeness of the assessment, but within the areas that could be reviewed, the assurance provider can still offer a conclusion. It is a way to communicate the assurance provider's findings while being transparent about any limitations that were encountered.
• Reference:
• IIA Standards for the Professional Practice of Internal Auditing AICPA Auditing Standards

Which disciplines are integrated into GRC?

• Audit and Assurance
• Governance and Oversight
• Strategy and Performance Management
• Quality and Conformance
• Information Privacy and Security
• Compliance and Ethics
• Risk and Decision Support
• All of these disciplines are integrated into GRC