CGRC Policy Development 5 — Questions and Answers
Question 1: Which lifecycle phase comes IMMEDIATELY after a policy is formally approved?
- Policy retirement
- Policy communication and implementation (Correct answer)
- Policy gap analysis
- Policy exception handling
Correct answer: Policy communication and implementation
After approval, the policy must be communicated to affected parties and implemented before it can be enforced or evaluated.
Question 2: An organization operating in multiple jurisdictions should PRIMARILY address differing legal requirements through:
- One universal policy that ignores local variations
- A master policy with jurisdiction-specific addenda or supplements (Correct answer)
- Separate independent policy frameworks for each country
- Delegating compliance entirely to local legal counsel
Correct answer: A master policy with jurisdiction-specific addenda or supplements
A master policy with jurisdiction-specific supplements maintains global consistency while accommodating local legal differences.
Question 3: What is the PRIMARY purpose of version control in policy management?
- To restrict access to older policy versions
- To track changes over time and maintain an authoritative current version (Correct answer)
- To automate policy distribution to all employees
- To reduce the frequency of required policy reviews
Correct answer: To track changes over time and maintain an authoritative current version
Version control maintains a history of changes, clearly identifies the current approved version, and prevents confusion from multiple conflicting drafts.
Question 4: An acceptable use policy (AUP) MOST commonly governs:
- How the organization manages financial risks
- Employee use of organizational IT assets and systems (Correct answer)
- Vendor onboarding and offboarding procedures
- Board-level governance and committee structure
Correct answer: Employee use of organizational IT assets and systems
AUPs define acceptable and unacceptable use of organizational technology resources such as computers, networks, email, and internet access.
Question 5: Which metric BEST measures the effectiveness of a policy communication campaign?
- The number of pages in the policy document
- The percentage of employees who have acknowledged and understood the policy (Correct answer)
- The time it took to write the policy
- The number of policy exceptions granted
Correct answer: The percentage of employees who have acknowledged and understood the policy
Acknowledgment rates with comprehension checks directly measure whether the communication reached and was understood by the intended audience.
Question 6: When developing policies for a newly acquired subsidiary, the FIRST step should be to:
- Immediately apply all parent company policies without assessment
- Assess existing subsidiary policies and identify gaps relative to parent standards (Correct answer)
- Retire all subsidiary policies on the acquisition date
- Hire a consultant to write entirely new policies from scratch
Correct answer: Assess existing subsidiary policies and identify gaps relative to parent standards
Assessing existing policies first identifies what can be retained, what gaps exist, and what conflicts must be resolved before integration.
Question 7: The CGRC domain of Policy Development MOST aligns with which GRC pillar?
- Risk
- Compliance only
- Governance (Correct answer)
- Assurance
Correct answer: Governance
Policy development is a core governance activity that establishes the organizational rules, authority structures, and frameworks that guide risk and compliance activities.
CGRC Policy Development 5
Which lifecycle phase comes IMMEDIATELY after a policy is formally approved?