Which of the following is considered the last line defense in regard to a Governance, Risk managements, and compliance (GRC) program?

The correct answer is B. Internal controls. Internal controls are the last line of defense because they are the actual operational mechanisms that prevent, detect, and correct harmful events before damage materializes. In a GRC program, risk management identifies and prioritizes risks, the board sets direction and…

Risk Management and Risk Assessment

Question

Options

AInternal audit
BInternal controls
CBoard review
DRisk management

How the community answered

(47 responses)

A
2% (1)
B
89% (42)
C
6% (3)
D
2% (1)

Explanation

Internal controls are the last line of defense because they are the actual operational mechanisms that prevent, detect, and correct harmful events before damage materializes. In a GRC program, risk management identifies and prioritizes risks, the board sets direction and policy, and internal audit evaluates the effectiveness of the program after the fact - but internal controls are what physically and technically stop bad outcomes from occurring. If internal controls fail, no other GRC element can prevent the resulting harm; audit can only report it after the damage is done. This makes internal controls the foundational last-resort barrier that the entire GRC framework depends upon.

Topics

#GRC#Internal Controls#Risk Management

Community Discussion

No community discussion yet for this question.

Full HCISPP Practice