ISC2 Governance, Risk and Compliance (CGRC) Practice Question

The initial assessment (or audit) report is produced immediately after evidence collection and analysis are complete. It documents the assessor's preliminary findings, identified control deficiencies, and associated risks while they are still unremediated, giving stakeholders the information they need to decide on appropriate risk responses. A final assessment report is issued only after management responses and corrective actions are validated; a risk response plan is developed subsequently to address accepted or mitigated risks; and a lessons-learned report is typically generated after remediation to capture improvement opportunities, not to present initial findings.