Source: [LinkedIn](https://www.linkedin.com/pulse/auditing-governance-risk-compliance-ask-gerardus-blokdyk/)
Author: [Gerardus Blokdyk](https://www.linkedin.com/in/gerardblokdijk/)
Publication date: January 7, 2022
Retrieved from  on January 10, 2022

Relevant ISO 27001 clauses/controls:
- [[MyVault/👩🏼‍⚖️ Standards and Regulations/ISO 27001 2013/ISO 27001 C 9 Performance evaluation]]
- [ISO 27001 A 18 Compliance](../../Standards/ISO27x/legacy/ISO%2027001%202013/ISO%2027001%20A%2018%20Compliance.md)

Related:
[External audits](../../🎇%20Sparks/External%20audits.md)
[ISO 27001 audit process](../../Standards/ISO27x/ISO%2027001%20audit%20process.md)


1.  Can you assess the impact any pending regulatory change will have on your business including governance, compliance and risk management frameworks?
2.  If effective, pan organization risk management goes beyond compliance and IT risk, what steps should your organization take to ensure early and ongoing GRC success?
3.  If your organization chooses a vendor for GRC automation, is your organization more at risk when its compliance data resides in a public or private cloud setting?
4.  What are the key principles of Enterprise Risk Management and how does this link to Corporate Governance compliance requirements?
5.  Is your organizations approach to governance, risk management and compliance integrated, holistic and organization wide across all components of strategy, processes, people and technology?
6.  What added value can eternal GRC frameworks bring to your organizations risk management program?
7.  Is risk management (culture, process and structures) in your organization connected to corporate strategy, and is it driven from the board and not seen as a compliance exercise?
8.  If a substantial portion of the reporting process is handed over to machines, will management judgment be forced to take a back seat in matters of risk management, compliance and overall governance?
9.  Have you reached a point when some directors and boards and some governance, compliance and risk management practices have become a hinder rather than a help?
10.  How do you ensure that IT GRC works?
11.  Is cybersecurity addressed in your organizations enterprise risk management strategy or your organizations GRC program?
12.  What key advantage does a Governance Risk and Compliance framework offer when compared to retaining separate and independent risk control functions?
13.  With sophistication / complexities defining GRC programs, is your organization equipped to deal with governance, risk and compliance on its own?
14.  A discipline that deserves attention in the GRC domain is the choice of the communication medium. Does the risk report always have to be an Excel matrix or a force ranked hierarchical list?
15.  How do you persuade your organization that there is value in bringing in a GRC system when you are talking to business owners who simply see it as a regulatory or compliance requirement?
16.  How does compliance with a particular external governance requirement impact organizational risk and value delivery?
17.  With what industry standards do your providers comply in terms of its security governance, risk and compliance systems and policies?
18.  Since developing an Enterprise Risk Management program, has your organization realized which benefits from the ERM program?
19.  Will millenials knuckle down and follow organizational GRC (governance, risk management and compliance) rules that control how and what business related material is transmitted via text?
20.  How have your organizations risk management objectives and activities changed as a result of market turmoil?
21.  Are your compliance and risk management governance programs robust enough for this era of heightened regulatory scrutiny?
22.  Do your organizations management information systems capture and provide reliable, timely and relevant information sufficient to support effective enterprise risk management?
23.  What is your organizations level of integration of processes and technology for governance, risk management and compliance?
24.  How can your organization keep data costs contained while still meeting Governance, Risk and Compliance (GRC) objectives such the 2018 European GDPR regulations?
25.  How does your organization ensure that it only conducts business with entities that are not listed on some type of high risk or sanctioned party list?
26.  What are your top 10 risks?
27.  What do you do to strengthen your data security to enable governance, risk management, retention, Cybersecurity and compliance with privacy regulations?
28.  What provisions does your monitoring plan provide regarding partner compliance with any risk mitigation measures established in agreements?
29.  Has management adopted an appropriate and cost effective array of risk responses at the activity level of your organization to reduce inherent risks to levels in line with established risk tolerances?
30.  Are issues, risks, exceptions/acceptances, and top risks monitored in an issue management system; IT governance, risk, and compliance (IT GRC) tool; and/or risk register?
31.  Does your organization have an overall risk framework that addresses the risks your organization is exposed to, how it views those risks, and how it manages them?
32.  Is it clear that a review covers all material controls including financial, operational and compliance controls, and risk management systems?
33.  Are you confident that there are no gaps in risk coverage and that they have visibility into how issues roll up and impact the strategic mission or business risks?
34.  What roles are held within your organization by the primary buyers of Governance, Risk and Compliance (GRC) solutions?
35.  Do you need security services that include tracking Governance, Risk Management, and Compliance (GRE/GRC) with controls?
36.  Have you added value and reduced risk to your engineering processes through the policies, procedures, and standards adopted in compliance with external governance requirements?
37.  How can compliance and IT managers ensure GRC automation processes integrate smoothly with existing organization processes?
38.  How do you assess the adequacy of maintenance project management standards, methodologies, and practices. Does your organization have adequate maintenance standards and controls?
39.  How can operational risk management principles be leveraged to improve corporate governance, compliance and reputation management?
40.  Is the effective management of risk a value add / organizational advantage to your organization?
41.  How will this really pay off in the end?
42.  How do you improve the audit management process in your organization by documenting artifacts, organizing work papers, and creating audit reports?
43.  Has management taken a portfolio view to assure that the selected risk responses have reduced the entity’s overall residual risk to a level within the identified risk appetite for the organisation?
44.  Do you develop a higher degree of productivity, risk reduction, and compliance through the implementation of changes to your governance solution?
45.  What are the highest impact actions that will overtly demonstrate a strong and significant governance, risk and compliance culture?
46.  What should be the level of collaboration between your vendors and the BPM organizations risk and compliance function?
47.  How confident are you that your governing authority (board or other oversight committees) get adequate information about risk and compliance to use in determining success in achieving objectives?
48.  Do you have an effective integrated software solution for managing and reporting compliance, ethics, governance and risk issues?
49.  How can your organization address the growing gap between needs and current capabilities when it comes to managing risk and implementing a compliance framework?
50.  How concerned is your organization about the level of security or IT risk in adopting technologies or technology initiatives?
51.  What percentage of the Data Governance, GRC or Access Control management budget will be allocated for controlling access to unstructured information?
52.  Are IT governance, IT risk management and IT compliance managed by a central body within your organization?
53.  What are the implications of integrating governance, risk and compliance in Business Intelligence systems on corporate performance management?
54.  If data risks are detected, can this risk be managed in an automated way to assure data for compliance and governance?
55.  Will your GRC investment enhance functionality and deliver business value?
56.  How do you assess the security and integrity of system and application software. Does your organization have adequate quality assurance and testing programs?
57.  In what ways is your organization adversely impacted by redundant or inconsistent processes for governance, assurance and/or management of performance, risk and compliance?
58.  Is your organizations risk appetite consistent with the risk management philosophy and aligned with business strategy?
59.  How well are your organizations policies and objectives on risk and compliance understood throughout your organization?
60.  Is any GRC tool is required for automation for compliance reporting and audit management?
61.  What change has there been to the cost of your governance, risk and compliance efforts over the past two years, and what change do you expect over the next two years?
62.  What can risk and compliance professionals do to help bridge the gap and inspire everyone in the business to own risk?
63.  How do your organizations risk professionals build trust with your peers and other leaders across the business to help them know you are protecting your organization and supporting them in the role?
64.  How do you communicate about risk management so that people in your organization are all concerned about the same thing?
65.  How are risk management and the design and operation of control activities monitored by those charged with governance ?
66.  What is the degree of convergence between governance, risk and compliance across entities in your organization?
67.  Do you enhance risk management effectiveness using other nontraditional risk data points, for example, with data from external data and information providers?
68.  Would you have a single centralized tool, for all your organizations to use?
69.  Are more mature results for IT GRC related to better business results, better data protection, and regulatory compliance results?
70.  How seriously do you think the challenges of governance, risk and compliance are taken at board level in your organization?
71.  Has your organization completed a comprehensive risk assessment that considers regulatory, market, reputational, operational, and technology exposure?
72.  If data governance, GRC or access control management is specifically earmarked in the budget for it then what is its approximate percentage of this within the total security budget?
73.  Does a vendor providing the software have sufficient experience, financial stability, and support infrastructure to ensure the success of the software?
74.  How do you enable collaboration on GRC across business functions, and instill an effective risk assessment and mitigation discipline?
75.  How do you assess the quality of any open source code system documentation. Does your organization have appropriate system design and coding standards?
76.  How do you ensure it actually provides the next generation of business process and ROI that would justify the significant risk and costs?
77.  Which cross border data transfer governance components maximize in control cloud benefits and reduce the risk of regulatory non compliance?
78.  How does your organization effectively account for internal and external network connectivity, and boundaries and functions of security domains in its risk assessment?
79.  How does your organization decide whether the benefits of implementing a second generation GRC solution outweigh the cost?
80.  Which smart grid focus areas are considered to be top priorities at your organization from a regulatory compliance and governance perspective?
81.  If your organization uses enterprise Governance, Risk, and Compliance (eGRC) tools, what benefits or returns has your organization realized?
82.  Can GRC be approached systematically, or does it need to be approached at a people and process level first, and automated later when the technology is available to support it?
83.  How do other organizations choose the right tools for complex organizational tasks like environmental management or risk management?
84.  How are other organizations evaluating the business case for GRC technology enablement to safeguard assets, prevent fraud, enable GRC processes and comply with increasingly complex regulations?
85.  Is there a need for greater governance and dialogue within your organization to ensure that compliance with complex issues is achieved?
86.  Does the generally high level of confidence that the risk identification process will identify emerging risks suggest that your organization is over confident in processes?
87.  How do you rate how well your organization manages all areas of organizational risk exposure (strategic, financial, operational, compliance, reputational, etc.)?
88.  Does your organization have appropriate project documentation standards?
89.  Should Governance, Risk Management, and Compliance be tackled as one problem, or does your organization have scope creep?
90.  What is the relative significance of reputational risk and peer competition in driving compliance with a corporate reporting requirement?
91.  What do you consider to be the most significant barriers to greater convergence of governance, risk and compliance at your organization?
92.  Does your organization have adequate development standards and controls?
93.  How does an integrated approach improve your day to day operations?
94.  What benefits or returns has your organization realized from its Governance, Risk, and Compliance tools?
95.  Is there a uniform framework to align the various risk specializations regarding governance, risk, and compliance assessments so you can reduce the cost burden on the business?
96.  Where does GRC currently fit into the broader concept of your organizations program of self-defense and how do you see it developing going forward?
97.  How do you assess your organizations enterprise-wide data storage methodologies. Has your organization appropriately planned its data storage process?
98.  What security features, and what kind of HR policies, are you putting in place within your organization to get technology to take off from a GRC perspective?
99.  Are your board and senior management knowledgeable about the content and operation of your compliance program and do they oversee and monitor its implementation and effectiveness?
100.  Does your organization have a code of conduct, and how does it enforce compliance?