CGRC Compliance and Policy 3

Question 1

What is the primary purpose of a Regulatory Change Management process within a compliance program?

Accepted Answer

To track, assess, and implement changes to applicable laws and regulations

Answer

Regulatory Change Management ensures the organization identifies, evaluates, and responds to new or amended regulations affecting its operations.

Question 2

A healthcare organization must comply with both HIPAA and state privacy laws that are stricter than HIPAA. Which standard should govern their compliance program?

Accepted Answer

The state law, because it provides greater protection to individuals

Answer

HIPAA allows states to enact stricter privacy protections, and organizations must comply with the more stringent standard.

Question 3

Which element is MOST critical to include in an organization's written information security policy?

Accepted Answer

Scope, roles, responsibilities, and enforcement mechanisms

Answer

Effective security policies must define scope, assign roles and responsibilities, and specify how the policy will be enforced.

Question 4

Under GDPR, what is the maximum timeframe for notifying a supervisory authority after discovering a personal data breach?

Accepted Answer

72 hours

Answer

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Question 5

An organization's compliance policy requires annual vendor due diligence reviews. A critical vendor's contract renews mid-year without a review. This BEST represents which type of compliance failure?

Accepted Answer

An operational failure to execute a defined control

Answer

The policy (design) is sound, but the failure to execute the review on schedule is an operational control failure.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Compliance and Policy 3