[2025年03月]更新のGRCP問題集で時間限定！無料アクセスせよ！
GRCP問題集で2025年最新のOCEG GRCP試験問題
質問 # 83
How does Benchmarking contribute to the improvement of a capability?
- A. By evaluating the effectiveness of risk management campaigns.
- B. By identifying potential legal and regulatory issues.
- C. By assessing the impact of organizational culture.
- D. By comparing the capability's performance to industry standards or best practices.
正解：D
解説：
Benchmarkinginvolves comparing a capability's performance againstindustry standardsorbest practicesto identify areas for improvement and enhance overall effectiveness.
* How Benchmarking Contributes:
* Identifies Gaps: Reveals discrepancies between current performance and desired standards.
* Adopts Best Practices: Encourages learning from successful approaches used by other organizations.
* Promotes Excellence: Drives continuous improvement by setting higher benchmarks.
* Why Other Options Are Incorrect:
* A: Legal and regulatory issues are addressed through compliance assessments, not benchmarking.
* C: Culture assessments are separate from performance benchmarking.
* D: Risk management campaign evaluations focus on specific initiatives, not benchmarking.
References:
* OCEG GRC Capability Model: Recommends benchmarking as a tool for continuous improvement.
* COSO ERM Framework: Highlights industry comparisons in improving organizational capabilities.
質問 # 84
In the IACM, what is the role of Compound/Accelerate Actions & Controls?
- A. To enhance the brand image and reputation of the organization.
- B. To accelerate and compound the benefits of reducing costs.
- C. To identify and address any potential conflicts of interest that may compound or accelerate enforcement actions against the company.
- D. To accelerate and compound the impact of favorable events to increase benefits and promote the future occurrence.
正解：D
解説：
Compound/Accelerate Actions & Controls in the Integrated Actions and Controls Model (IACM) focus on amplifying the positive impact of favorable events and fostering conditions for their recurrence.
Objective:
Enhance the benefits derived from favorable events and outcomes.
Increase the likelihood and magnitude of future occurrences of such events.
Examples:
Leveraging positive market feedback to expand brand loyalty.
Scaling a successful project for broader application.
Why Other Options Are Incorrect:
A: Addresses conflicts, not the role of compound/accelerate controls.
B and D: These are outcomes, not primary roles of this category.
References:
OCEG IACM Framework: Discusses compounding benefits and promoting opportunities.
質問 # 85
What is the design option that involves ceasing all activity or terminating sources that give rise to the opportunity, obstacle, or obligation?
- A. Avoid
- B. Share
- C. Accept
- D. Control
正解：A
解説：
Avoid is a risk management strategy that involves stopping activities or removing sources of risk entirely.
Definition:
Avoidance eliminates the possibility of a risk occurring by ceasing the activity or terminating the risk source.
Examples:
Not entering a risky market.
Discontinuing a product line with regulatory risks.
Why Other Options Are Incorrect:
A (Accept): Involves acknowledging the risk and taking no additional action.
B (Share): Involves transferring part of the risk to another party (e.g., insurance).
D (Control): Involves reducing the likelihood or impact of a risk without eliminating it.
Reference:
ISO 31000 (Risk Management): Highlights avoidance as one of the core risk treatment options.
COSO ERM Framework: Explains risk avoidance as a strategic decision to eliminate exposure.
質問 # 86
Why is it important to design specific inquiry routines to detect unfavorable events?
- A. To prioritize the discovery of favorable events.
- B. To avoid the need for technology-based inquiry methods.
- C. To detect them as soon as possible.
- D. To prevent the need for observations and conversations.
正解：C
解説：
Designing specific inquiry routines to detect unfavorable events is critical toidentifying and addressing them as soon as possible, minimizing potential harm and enabling timely corrective actions.
* Importance of Early Detection:
* Reduces the likelihood of escalation or further impact.
* Ensures compliance with regulatory and organizational requirements.
* Why Inquiry Routines Matter:
* Focused inquiry routines allow for systematic identification of risks or issues.
* Enhance organizational resilience and responsiveness.
* Why Other Options Are Incorrect:
* A: The focus is on unfavorable events, not favorable ones.
* B: Technology-based methods are an integral part of inquiry routines, not something to avoid.
* D: Observations and conversations are complementary to inquiry routines, not replaced by them.
References:
* ISO 31000 (Risk Management): Emphasizes proactive detection of risks and unfavorable events.
* OCEG GRC Capability Model: Discusses inquiry routines as part of a robust detection framework.
質問 # 87
Which category of actions & controls in the IACM includes formal statements and rules about organizational intentions and expectations?
- A. Policy
- B. Technology
- C. People
- D. Information
正解：A
解説：
The Policy category in the IACM encompasses formal statements, rules, and guidelines that articulate the organization's intentions and expectations.
Role of Policies:
Set boundaries and guidelines for behavior and decision-making.
Ensure consistency in actions and alignment with organizational goals.
Examples:
Code of conduct.
Data privacy and security policies.
Why Other Options Are Incorrect:
A: Information deals with data and communication, not formal statements.
B: People refer to human elements like roles and responsibilities.
C: Technology focuses on tools and systems.
Reference:
OCEG IACM Framework: Highlights the role of policies in formalizing organizational expectations.
質問 # 88
What is the term used to describe a cause that has the potential to result in harm?
- A. Opportunity
- B. Obstacle
- C. Prospect
- D. Hazard
正解：D
解説：
In GRC terminology, a hazard is a condition, situation, or factor that has the potential to cause harm or adverse effects. It is commonly used in the context of risk management, health and safety, and environmental compliance.
Definition of Hazard:
A hazard is the cause of potential harm, such as physical injury, financial loss, reputational damage, or legal violations.
Examples of hazards include weak cybersecurity controls, hazardous materials, or non-compliance with regulatory requirements.
Why Option A is Correct:
"Hazard" is the universally accepted term for a cause of potential harm in risk management frameworks (e.g., ISO 31000, COSO ERM).
"Prospect" (Option B) and "Opportunity" (Option C) are related to potential gains, not harm.
"Obstacle" (Option D) refers to a barrier or hindrance, not specifically a cause of harm.
Relevant Frameworks and Guidelines:
ISO 31010 (Risk Assessment Techniques): Discusses the identification and evaluation of hazards as part of risk assessment.
NIST SP 800-30 (Risk Assessment): Includes identification of threats, which can be considered analogous to hazards in the context of information security.
In summary, a hazard is a cause of potential harm that must be identified and mitigated to manage risks effectively in any organizational context.
質問 # 89
What factors should be considered when selecting the appropriate sender of a message?
- A. The purpose of communication, desired results, reputation with audience members, and shared culture and background with the audience.
- B. The sender's job title, office location, years of experience, and favorite communication channel.
- C. The sender's fluency in the language of the needed communication, cultural background, and comfort in communicating with the target audience.
- D. The sender's preference for formal or informal communication and their ability to respond appropriately to feedback.
正解：A
解説：
Selecting the appropriate sender for a message involves evaluating thepurpose of communication, desired outcomes, and the sender's credibility and rapport with the audience.
* Key Factors:
* Purpose: The message's intent (informing, persuading, resolving issues) determines the sender's role.
* Desired Results: The sender should be able to deliver the message effectively to achieve the intended outcomes.
* Reputation: The sender's credibility and trustworthiness influence how the audience perceives the message.
* Cultural Alignment: Shared culture or background enhances clarity and understanding.
* Why Other Options Are Incorrect:
* A: Fluency and cultural awareness are relevant but not the only factors.
* B: Communication preferences are less critical than effectiveness and audience alignment.
* D: Job title and experience may not always guarantee effective communication.
References:
* OCEG GRC Capability Model: Discusses factors influencing sender selection.
* Corporate Communication Best Practices: Emphasize audience-centric communication strategies.
質問 # 90
How do detective actions and controls contribute to managing performance?
- A. They detect and correct unfavorable events, which will lead to an increase in favorable events.
- B. They provide investigative capabilities in every part of the organization.
- C. They focus on promoting favorable events, which will lead to the reduction of unfavorable events.
- D. They indicate progress toward objectives by detecting events that help or hinder performance.
正解：D
解説：
Detective actions and controls play a critical role in identifying events that affect progress toward objectives, whether they are positive or negative.
Role of Detective Controls:
Monitor performance indicators to detect deviations from expected outcomes.
Identify trends, anomalies, or incidents that help or hinder progress.
Contribution to Performance Management:
Provides insights into areas requiring attention or adjustment.
Enhances decision-making by offering real-time data on organizational progress.
Why Other Options Are Incorrect:
A: Detective controls focus on monitoring, not investigative capabilities.
B: While they detect unfavorable events, correction is a separate function (corrective controls).
D: Promoting favorable events is a proactive control function, not detective.
Reference:
COSO ERM Framework: Discusses the use of detective controls in monitoring performance.
OCEG GRC Capability Model: Highlights the role of detective actions in identifying performance deviations.
質問 # 91
Which Critical Discipline of the Protector Skillset includes skills to enhance stakeholder confidence and perform assessments?
- A. Audit & Assurance
- B. Security & Continuity
- C. Governance & Oversight
- D. Strategy & Performance
正解：A
解説：
TheAudit & Assurancediscipline in the Protector Skillset focuses on assessing organizational activities, processes, and systems to enhancestakeholder confidenceby ensuring transparency, reliability, and compliance.
* Enhancing Stakeholder Confidence:
* By performing audits and assurance activities, organizations validate that processes are functioning as intended and aligned with objectives and regulations.
* This builds trust among stakeholders, including investors, customers, and regulators.
* Performing Assessments:
* Auditors evaluate internal controls, risk management processes, and compliance mechanisms to ensure effectiveness.
* Examples include financial audits, operational audits, and compliance audits.
References:
* IIA Standards: Focuses on internal auditing and assurance practices.
* COSO Framework: Provides guidance for assessing internal control systems.
質問 # 92
In the context of uncertainty, what is the difference between likelihood and impact?
- A. Likelihood is a measure of the chance of an event occurring, while impact is the category or type of risk or reward from the event.
- B. Likelihood is a measure of the chance of an event occurring, while impact measures the economic and non-economic consequences of the event.
- C. Likelihood is a measure of the chance of an event occurring, while impact is the location of the event within the organization.
- D. Likelihood is the chance of an event occurring after controls are put in place, while impact measures the economic and non-economic consequences of the event.
正解：B
解説：
Likelihoodandimpactare key factors in evaluating uncertainty, especially in the context of risk and reward.
* Likelihood:
* Measures theprobabilityor chance of an event occurring.
* Example: The likelihood of a data breach based on historical trends.
* Impact:
* Measures theeconomic and non-economic consequencesof the event.
* Examples: Financial losses, reputational damage, or operational disruptions.
* Why Other Options Are Incorrect:
* A: Impact refers to consequences, not the location of the event.
* B: Impact is not limited to categories; it involves actual consequences.
* D: Likelihood considers controls but is not exclusively post-control.
References:
* ISO 31000 (Risk Management): Defines likelihood and impact as fundamental components of risk assessment.
* COSO ERM Framework: Emphasizes assessing both likelihood and impact in risk evaluation.
質問 # 93
What is the purpose of proactively developing communication channels within an organization?
- A. To ensure that all communication is delivered in written form only.
- B. To ensure that the channels are available before they are needed.
- C. To limit communication to a single channel for simplicity and cost savings.
- D. To formalize the process so that employees know that anything they communicate will be kept in records.
正解：B
解説：
Proactively developing communication channels ensures that they are established, tested, and functional before a critical need arises.
Purpose:
Facilitates timely and effective communication during both routine and emergency situations.
Ensures that communication processes do not face delays due to unprepared or unavailable channels.
Benefits:
Increases efficiency by having predefined methods for sharing information.
Promotes clear and reliable communication across all organizational levels.
Why Other Options Are Incorrect:
A: Communication channels should accommodate multiple formats (written, verbal, digital, etc.).
C: Record-keeping is important but not the primary purpose of proactive channel development.
D: Limiting communication to a single channel reduces flexibility and can hinder effectiveness.
Reference:
OCEG GRC Capability Model: Highlights the importance of proactive communication planning.
ISO 31000 (Risk Management): Discusses the role of communication in risk and operational management.
質問 # 94
What does the initialism GRC stand for?
- A. Governance, risk, and compliance
- B. Governance, risk, and controls
- C. Governing risk and compliance
- D. Government, regulation, and controls
正解：A
解説：
GRC stands forGovernance, Risk, and Compliance, a critical framework for organizations to ensure they operate ethically and effectively while adhering to laws, regulations, and industry standards.
* Governance: Refers to the organization's leadership, policies, and procedures that guide its activities to align with business objectives, ethical practices, and compliance requirements. Effective governance ensures strategic alignment and accountability.
* Risk: Encompasses identifying, assessing, managing, and mitigating risks that could impede the organization's objectives. This includes financial risks, operational risks, cybersecurity threats, and reputational risks.
* Compliance: Involves adhering to laws, regulations, industry standards, and internal policies.
Compliance ensures that the organization fulfills external and internal obligations to maintain trust and avoid legal penalties.
References:
* NIST Risk Management Framework (RMF): Emphasizes integrating GRC principles into risk assessment and management.
* COSO Framework: Offers detailed guidance on governance and internal control processes.
* ISO 31000 (Risk Management): Explains systematic risk management practices aligning with GRC objectives.
* Compliance documentation, such as GDPR for privacy and SOX for financial controls, highlights the importance of GRC in maintaining ethical and lawful operations.
質問 # 95
In the context of the Maturity Model, what characterizes practices at Level I?
- A. Practices are consistently improved over time.
- B. Practices are formally documented and consistently managed.
- C. Practices are improvised, ad hoc, and often chaotic.
- D. Practices are measured and managed with data-driven evidence.
正解：C
解説：
Level I in the Maturity Model represents the lowest level of process maturity, characterized by:
Improvised, Ad Hoc Practices:
Processes are informal, reactive, and lack standardization.
Activities are driven by immediate needs rather than planned procedures.
Chaotic Nature:
Organizations at this level face high variability and inefficiency in their operations.
There is minimal alignment with organizational goals or strategic objectives.
Indicators of Low Maturity:
Poor documentation and lack of repeatability in processes.
High dependency on individual effort rather than institutionalized practices.
Reference:
CMMI (Capability Maturity Model Integration): Defines Level I as "Initial" with disorganized processes.
OCEG GRC Capability Model: Highlights maturity stages for improving GRC practices.
質問 # 96
What is the difference between prescriptive norms and proscriptive norms?
- A. Prescriptive norms are related to financial performance, while proscriptive norms are related to ethical behavior.
- B. Prescriptive norms are optional guidelines, while proscriptive norms are mandatory rules.
- C. Prescriptive norms are established by government regulations, while proscriptive norms are established by industry standards.
- D. Prescriptive norms encourage behavior the group deems positive, while proscriptive norms discourage behavior the group deems negative.
正解：D
解説：
The distinction between prescriptive norms and proscriptive norms lies in the types of behaviors they influence:
* Prescriptive Norms:
* Encourage behaviors considered positive or desirable by the group.
* Example: Encouraging collaboration and teamwork.
* Proscriptive Norms:
* Discourage behaviors considered negative or undesirable by the group.
* Example: Prohibiting dishonesty or discrimination.
* Why Other Options Are Incorrect:
* A: Both types of norms can be mandatory depending on the context.
* B: Norms are not specifically tied to financial or ethical behavior alone.
* C: Norms arise from social or organizational expectations, not exclusively regulations or standards.
References:
* OCEG GRC Capability Model: Explains norms in the context of organizational culture.
* Behavioral Science Frameworks: Discuss the role of prescriptive and proscriptive norms in shaping behavior.
質問 # 97
What role do mission, vision, and values play in the ALIGN component?
- A. They provide clear direction and decision-making criteria and should be well-defined and consistently communicated throughout the organization.
- B. They outline the legal and regulatory requirements that the organization must satisfy and define how they relate to the business objectives.
- C. They specify the processes as well as the technology and tools used in the alignment process.
- D. They determine the allocation of financial resources within the organization.
正解：A
解説：
In the ALIGN component of the GRC Capability Model, mission, vision, and values serve as the foundational elements that guide organizational direction and decision-making.
Role in ALIGN:
Mission: Defines the organization's purpose and reason for existence.
Vision: Articulates long-term aspirations and desired future state.
Values: Establish ethical and cultural principles that influence behavior and decision-making.
Significance:
These elements provide clarity and alignment across all levels of the organization.
They ensure consistency in decision-making and communication of goals and priorities.
Why Other Options Are Incorrect:
A: Mission, vision, and values guide decisions but do not dictate specific processes or tools.
B: Financial resource allocation is influenced by strategic priorities but not directly determined by mission, vision, and values.
C: Legal and regulatory requirements are external obligations, not the focus of mission, vision, and values.
Reference:
OCEG GRC Capability Model: Describes mission, vision, and values as integral to alignment.
Balanced Scorecard Framework: Emphasizes their role in defining organizational strategy.
質問 # 98
What is the duality of compliance, and how does it relate to risk?
- A. The duality of compliance involves addressing both compliance with obligations and compliance-related risks. Compliance involves meeting mandatory and voluntary obligations, while compliance-related risks involve addressing the risk of negative outcomes associated with non-compliance.
- B. The duality of compliance refers to the trade-off between investing in compliance measures and allocating resources to other business areas.
- C. The duality of compliance refers to the balance between financial gains and ethical considerations in business decisions.
- D. The duality of compliance refers to the distinction between domestic and international regulations that an organization must follow.
正解：A
解説：
The duality of compliance recognizes two key aspects:
Compliance with Obligations:
Organizations must meet mandatory (legal/regulatory) and voluntary (standards/policies) obligations.
Examples: Adhering to GDPR, HIPAA, or ISO standards.
Compliance-Related Risks:
Risks include fines, reputational damage, or operational disruptions resulting from non-compliance.
Effective compliance programs proactively mitigate these risks.
Why Other Options Are Incorrect:
A: Compliance encompasses more than geographic distinctions in regulations.
B: Resource allocation is a management issue, not the essence of compliance duality.
D: Ethical considerations are part of broader governance, not specific to compliance duality.
Reference:
ISO 37301 (Compliance Management Systems): Discusses compliance obligations and related risks.
COSO ERM Framework: Connects compliance activities to risk management.
質問 # 99
Which are some considerations to keep in mind when establishing a communication framework?
- A. Reducing the frequency of communication to avoid information overload.
- B. Ensuring external communications are always formal while most internal communication can be more informal.
- C. Using only one communication channel for all types of messages so that sending and receipt can be tracked.
- D. Selecting the appropriate sender, recipient, intention, message, cadence, and channel.
正解：D
解説：
Establishing a communication framework involves defining clear and effective processes that consider the sender, recipient, intention, message, cadence, and channel.
Key Considerations:
Sender and Recipient: Ensuring the right people are involved in the communication process.
Intention: Clearly defining the purpose and goals of the communication.
Message: Crafting a clear and concise message tailored to the audience.
Cadence: Determining the appropriate frequency of communication to maintain engagement without causing overload.
Channel: Selecting the most effective medium for the message (email, meetings, instant messaging, etc.).
Why Other Options Are Incorrect:
A: Reducing frequency without assessing the need may hinder effective communication.
C: Formality depends on the context and audience, not the type of communication.
D: Limiting to one channel reduces flexibility and may not suit all scenarios.
Reference:
OCEG GRC Capability Model: Emphasizes the role of a comprehensive communication framework in achieving objectives.
ISO 31000 (Risk Management): Discusses communication as part of effective risk management practices.
質問 # 100
Why is it essential to make the mission, vision, and values explicit within an organization?
- A. It is necessary to comply with industry regulations and standards.
- B. It is important for gaining and maintaining buy-in from all stakeholders.
- C. It helps the workforce understand and make decisions at all levels, preventing the organization from operating on ad hoc beliefs and interests.
- D. It is crucial for developing the organization's training and development programs aligned with the mission, vision, and values.
正解：C
解説：
Making the mission, vision, and values explicit ensures clarity and consistency across the organization, guiding decision-making and avoiding ad hoc or misaligned behaviors.
Why Explicit Statements are Essential:
Clarity for Decision-Making: Provides a consistent framework for all levels of the workforce.
Alignment: Ensures that organizational actions reflect shared priorities and principles.
Avoids Ad Hoc Behavior: Prevents decisions driven by personal biases or unaligned interests.
Why Other Options Are Incorrect:
A: Stakeholder buy-in is important but is not the primary reason for explicit statements.
B: While regulations may require formal statements, this is not their core purpose.
C: Training programs are a derivative benefit, not the primary reason.
Reference:
OCEG GRC Capability Model: Stresses the importance of clear articulation of mission, vision, and values.
Corporate Governance Frameworks: Highlight their role in aligning workforce actions and decisions.
質問 # 101
Culture is difficult or even impossible to "design" because:
- A. There are too many subcultures.
- B. It takes too long.
- C. It is an emergent property.
- D. People are not motivated to change.
正解：C
解説：
Culture is considered anemergent property, meaning it arises naturally from the shared values, beliefs, behaviors, and interactions within an organization.
* Why Culture is Hard to Design:
* It is not something that can be imposed or dictated; instead, it develops organically over time.
* Attempts to "design" culture must focus on influencing core elements (e.g., leadership behavior, shared values) rather than directly creating it.
* Emergent Nature:
* Culture evolves from complex interactions among people and systems, making it difficult to control or predetermine.
* Why Other Options Are Incorrect:
* A: Motivation can drive change, but culture's complexity is a deeper challenge.
* C: While culture-building may take time, this is not the primary reason for its design challenges.
* D: Subcultures exist but are part of the emergent nature of overall culture.
References:
* COSO ERM Framework: Explains culture as a dynamic, evolving component of organizational behavior.
* Organizational Culture Models: Highlight emergent properties of shared values and beliefs.
質問 # 102
What type of activities are typically included in post-assessments?
- A. Employee performance evaluations and appraisals.
- B. Lessons learned, root-cause analysis, after-action reviews, and other evaluative activities.
- C. Financial audits and budget reviews.
- D. Market research and customer surveys.
正解：B
解説：
Post-assessments involve evaluative activities that review events, processes, or projects to identify lessons learned and areas for improvement.
Common Post-Assessment Activities:
Lessons Learned: Captures insights to apply in future efforts.
Root-Cause Analysis: Identifies underlying issues that contributed to outcomes.
After-Action Reviews: Provides structured feedback on what went well and what could improve.
Purpose:
Ensures continuous improvement and refinement of strategies, processes, and capabilities.
Promotes a culture of learning and adaptation.
Why Other Options Are Incorrect:
A: Financial audits focus on financial reporting, not post-assessment of processes or projects.
B: Employee evaluations are personnel-focused, not process-focused.
C: Market research is unrelated to post-assessment activities within organizational capabilities.
Reference:
ISO 31000 (Risk Management): Recommends post-assessment activities for continuous improvement.
COSO ERM Framework: Highlights lessons learned and root-cause analysis in post-event reviews.
質問 # 103
What is the difference between a mission and a vision?
- A. The mission is a short-term financial goal, while the vision is a long-term non-financial goal.
- B. The mission is what a for-profit organization should have, while the vision is for non-profit organizations.
- C. The mission is determined by external stakeholders, while the vision is determined by internal stakeholders.
- D. The mission states the organization's purpose and direction, while the vision is an aspirational objective that states what the organization aspires to be.
正解：D
解説：
Themissionandvisionof an organization serve distinct but complementary purposes:
* Mission:
* Defines the organization'spurpose, direction, and core values.
* Answers: "Why do we exist?"
* Example: "To provide sustainable energy solutions to underserved markets."
* Vision:
* Represents an aspirationalfuture statethe organization strives to achieve.
* Answers: "What do we aspire to become?"
* Example: "To be the world's leading renewable energy provider."
* Why Other Options Are Incorrect:
* B: Both mission and vision involve internal input and stakeholder considerations.
* C: Mission and vision are broader than financial goals.
* D: Both mission and vision are relevant for all types of organizations.
References:
* Corporate Strategy Frameworks: Emphasize clear articulation of mission and vision for strategic alignment.
* Balanced Scorecard Methodology: Discusses mission and vision as integral to strategic planning.
質問 # 104
......
OCEG GRCP 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
OCEG GRCP試験実践テスト問題：https://www.goshiken.com/OCEG/GRCP-mondaishu.html
最新の無料GRCP別格問題集をダウンロード：https://drive.google.com/open?id=1QrX6KQ9NrDBwmebw6Xg1zGLXw0_yWPhD