Question 1
What is a key outcome of higher GRC maturity?
Correct Answer:
Cross-functional process automation
Explanation:
Cross-functional process automation is a hallmark of higher GRC maturity. As organizations advance in governance, risk, and compliance, workflows become integrated across departments, enabling automated controls, coordinated evidence gathering, and seamless approvals that span risk, IT, legal, and operations. This integration standardizes processes, reduces manual effort, accelerates cycle times, and provides a single, real-time view of risk and compliance across the enterprise. Higher maturity also moves away from relying on spreadsheets and fragmented data, instead leveraging a centralized platform with automated reporting and dashboards that support timely, data-driven decisions. Fragmented risk data and delaying decisions stand in contrast to a mature GRC state, where harmonized data and automation enable faster and more reliable action.
Question 2
Which statement is true of a Risk Response task?
Correct Answer:
The Risk Response task is automatically progressed through the states using a workflow
Explanation:
Risk Response tasks in ServiceNow IRM are governed by a workflow that drives their lifecycle. The workflow defines the states a task can move through—such as open, in progress, implemented, and closed—and the conditions or approvals that transition it from one state to the next. Because these transitions are encoded in the workflow, the system automatically progresses the Risk Response task through its states without requiring manual state changes. That automatic progression is what makes this statement true. Note that a risk can have more than one related Risk Response task, especially when multiple controls or remediation actions are tracked separately. Roles alone don’t rigidly restrict who can be assigned to a Risk Response task—the assignment is governed by the configured permissions and rules, not solely by a specific role like risk_manager or risk_admin.
Question 3
Control Objectives are not active until the parent policy is in which state?
Correct Answer:
Published
Explanation:
Control objectives activate only when the parent policy is Published. Policies typically move through stages like Draft, Awaiting Approval, Published, and sometimes Review after updates. While a policy is in Draft or Awaiting Approval, it’s not in effect, so the control objectives attached to it aren’t active, and they don’t influence risk assessments or control testing. Publishing marks the policy as approved and current, enabling the associated control objectives to become active and guiding enforcement, evidence collection, and assurance activities. After publishing, any changes may trigger a new review or re-publish, but activation hinges on that Published state.
Question 4
Which of the following is NOT a parent table for GRC: Risk Management tables?
Correct Answer:
Task
Explanation:
In GRC: Risk Management, certain tables act as the top-level containers for related artifacts, with other records linking to them as children. Item, Content, and Document function as these parent tables because they hold the primary objects that other IRM records reference or relate to. A Task, however, is used to represent work to be done on a specific item or content and is not itself a container for other IRM records. It’s typically a child record linked to a parent like an Item or Content rather than a parent of other records. So the Task table isn’t a parent table in the risk management data model. You can confirm by inspecting the table relationships in ServiceNow, where parent tables show child relationships and Task appears as a child under an Item or Content rather than hosting other IRM records.
Question 5
Which option best lists the entities included when configuring an assessment scheduler for RAM?
Correct Answer:
Entities from designated entity classes
Explanation:
When configuring an assessment scheduler for RAM, you scope which records to assess by selecting designated entity classes. RAM uses entity classes to group the kinds of items you want evaluated, so the scheduler will include only entities that belong to those classes. This targeted scope keeps the assessments relevant and manageable, rather than pulling in every active record or dimming the focus with unrelated data. The other options don’t fit because they either broaden the scope beyond what RAM is intended to assess (any active entity), relate to the content of a RAM rather than which items to assess (a published RAM), or are too generic and ignore the class-based organization RAM relies on (objects from ServiceNow tables).
Question 1
Exam overview

About this Exam

The Institute of Risk Management (IRM) qualifications are the globally recognised gold standard for professionals dedicated to managing risk.

Designed for aspiring and established risk managers, compliance officers, and business leaders, particularly within the United Kingdom's robust financial and corporate sectors, these certifications provide the definitive toolkit to identify, assess, and mitigate complex threats.

Whether you are aiming for the International Certificate in Risk Management or the more advanced International Diploma, this path demonstrates your commitment to protecting an organisation’s value, reputation, and future in an increasingly volatile world.

More details

Additional Information

What the Course Entails and Exam Details

The comprehensive IRM curriculum dives deep into the core concepts of Enterprise Risk Management (ERM).

Depending on the specific qualification level, you will explore the overarching framework of risk governance, risk architecture, and the crucial role of risk culture within different organisational structures.

You will master practical techniques for risk identification, methods for qualitative and quantitative risk analysis, and strategies for effective risk treatment and reporting.

Furthermore, the syllabus connects these foundational principles to contemporary business challenges, including regulatory compliance, strategic decision-making, and the ethical considerations inherent in risk management in the UK context.


What to Expect in the Final Exam

Knowing what to expect on exam day is key to reducing anxiety and ensuring peak performance.

For introductory IRM exams like the International Certificate, you will typically face a strictly timed, Multiple Choice Question (MCQ) format, which may consist of around 60 questions to be completed within 90 minutes.

The questions are meticulously designed to test both your recall of definitions and, more importantly, your ability to apply ERM concepts to realistic scenarios.

A passing score (often approximately 60% to 70%, though this can vary by session) must be achieved, but you can approach the test with confidence knowing there is generally no negative marking for incorrect answers, so it is always in your best interest to provide an answer for every question.


How to Study and Exam Centers

Successful candidates do not rely on chance; they utilise a structured, multifaceted study approach.

Begin by creating a dedicated study schedule that spans several months, allocating sufficient time to master each module of the IRM’s official textbook and study guides, which are your primary resources.

Reinforce this learning by consistently taking practice exams; these are invaluable for gauging your understanding and acclimating to the time pressure of the actual test.

You may choose to book a slot at a designated physical testing center, such as the numerous Pearson VUE locations available in major UK cities like London, Manchester, Birmingham, and Edinburgh.

Alternatively, the IRM offers the option of secure, remote proctoring via an online portal, allowing you to complete the exam from the comfort of your own home or office, provided your setup meets the strict technical and environmental requirements.


Job Opportunities from the Course

Earning an IRM qualification significantly enhances your professional credibility and unlocks diverse career opportunities across numerous UK industries, including financial services, insurance, healthcare, and government.

Completion of this certification path can lead directly to, or accelerate your progression into, specialized roles such as:

  • Risk Analyst

  • Operational Risk Specialist

  • Compliance Officer

  • Internal Auditor (with a risk focus)

  • Enterprise Risk Manager

  • Business Continuity Manager

  • Chief Risk Officer (long-term career aspiration)


Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.
No fixed duration is currently configured for this quiz.
Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.
Yes. You can retake the practice test again as you continue studying during your available access period.
After your access is confirmed, you can continue into the complete practice exam from this quiz flow.
Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.
Keep studying

Related Questions