Policy and Procedure Management Flashcards
7 cards from real GRC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Policy and Procedure Management flashcards as text
Which element is most critical when establishing a policy exception process?
Answer: Documentation of risk acceptance and compensating controls
A sound exception process requires documenting the risk being accepted and any compensating controls that reduce that risk.
What is the primary purpose of a policy attestation process?
Answer: To confirm that employees have read and understood policies
Attestation formally confirms that employees have acknowledged and understood applicable policies, creating accountability.
A company's information security policy conflicts with a newly enacted state privacy regulation. What should happen first?
Answer: Conduct a gap analysis to identify required policy changes
A gap analysis identifies exactly where the policy conflicts with the regulation so targeted updates can be made.
Which of the following best describes a 'standard' in GRC context?
Answer: A specific mandatory requirement supporting a policy
Standards are mandatory, specific requirements that operationalize policies and define minimum acceptable levels of compliance.
During policy review, stakeholders disagree on the acceptable use of personal devices for work email. What is the best next step?
Answer: Conduct a risk assessment to inform the decision
A risk assessment provides objective data on threats, vulnerabilities, and impacts to support informed stakeholder decision-making.
What is the recommended retention period consideration for superseded policy versions?
Answer: Retain them according to the records retention schedule for audit and legal purposes
Superseded policy versions may be needed to demonstrate compliance during audits covering historical periods or for litigation.
Which metric best measures the effectiveness of a policy management program?
Answer: Percentage of employees completing annual policy acknowledgment
Acknowledgment rates directly measure whether employees are engaging with policies, which is a leading indicator of compliance.