Policy and Procedure Management Flashcards
7 cards from real GRC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Policy and Procedure Management flashcards as text
What is the purpose of mapping policies to regulatory requirements in a compliance matrix?
Answer: To demonstrate coverage and identify compliance gaps
A compliance matrix shows which policies address which requirements, making gap identification and audit evidence gathering more efficient.
A policy owner role is BEST described as:
Answer: The executive accountable for the policy's content, accuracy, and enforcement
The policy owner is accountable for ensuring the policy remains accurate, current, and effectively implemented.
Which of the following is a risk of having too many overlapping policies?
Answer: Conflicting requirements may confuse employees and create compliance gaps
Overlapping or conflicting policies create ambiguity about which requirement to follow, increasing the risk of non-compliance.
What is the primary function of a policy governance committee?
Answer: To oversee policy development, approval, and lifecycle management across the enterprise
A policy governance committee provides cross-functional oversight to ensure policies are consistent, current, and aligned with organizational goals.
When communicating a new password policy, which approach is most effective for ensuring compliance?
Answer: Combine mandatory training, manager briefings, and technical controls that enforce requirements
A multi-channel approach combining awareness, management reinforcement, and technical enforcement maximizes policy adoption.
A procedure contains outdated system screenshots after a software upgrade. What is the correct action?
Answer: Update the procedure and route it through the change management and approval process
Procedure changes require controlled updates through an approval process to ensure accuracy and maintain version integrity.
What does 'policy scope' define?
Answer: Which systems, people, and processes the policy applies to
Scope defines the boundaries of policy applicability, clarifying who and what is covered to prevent ambiguity.