14d • ❓ GRC Questions
GRC Scenario: What would you do next?
Quick practice question for you all.
You’re testing a quarterly user access review.
The control owner sends you:
- A spreadsheet showing all users reviewed
- Manager approvals
- A completion date within the required quarter
Everything looks good at first.
But you notice the employee population came directly from the control owner. You don’t have anything showing that the list is complete or came from the system of record.
Would you pass the control?
A) Yes, the review was completed and approved
B) No, the population completeness hasn’t been validated
C) Pass it, but document the limitation
D) Request another manager approval
Drop your answer below. I’ll post how I’d approach it from an auditor/control-testing perspective later today.
0
2 comments
GRC Scenario: What would you do next?
powered by
skool.com/grc-career-path-4325
Career changers and early-career cybersecurity professionals trying to land their first dedicated GRC role.
Suggested communities
Powered by