GRC Policy and Procedure Management 2

Question 1

Which element is most critical when establishing a policy exception process?

Accepted Answer

Documentation of risk acceptance and compensating controls

Answer

Automatic approval after 30 days

Answer

Exception requests submitted only by executives

Answer

Exceptions granted permanently without review

Question 2

What is the primary purpose of a policy attestation process?

Accepted Answer

To confirm that employees have read and understood policies

Answer

To punish employees who violate policies

Answer

To replace policy training programs

Answer

To automate policy enforcement

Question 3

A company's information security policy conflicts with a newly enacted state privacy regulation. What should happen first?

Accepted Answer

Conduct a gap analysis to identify required policy changes

Answer

Continue following the existing policy until it expires

Answer

Immediately suspend the conflicting policy sections

Answer

Delegate the conflict resolution to IT department

Question 4

Which of the following best describes a 'standard' in GRC context?

Accepted Answer

A specific mandatory requirement supporting a policy

Answer

A high-level statement of management intent

Answer

A recommended optional practice

Answer

A legal requirement from a regulatory body

Question 5

During policy review, stakeholders disagree on the acceptable use of personal devices for work email. What is the best next step?

Accepted Answer

Conduct a risk assessment to inform the decision

Answer

The CISO decides unilaterally and publishes the policy

Answer

Delay the policy until consensus is naturally reached

Answer

Adopt the most restrictive option without analysis

Question 6

What is the recommended retention period consideration for superseded policy versions?

Accepted Answer

Retain them according to the records retention schedule for audit and legal purposes

Answer

They should be immediately deleted to avoid confusion

Answer

Keep only the most recent two versions

Answer

Retention is optional and at department discretion

Question 7

Which metric best measures the effectiveness of a policy management program?

Accepted Answer

Percentage of employees completing annual policy acknowledgment

Answer

Total number of policies published

Answer

Policy exception request volume only

Answer

Number of policy documents in the repository