GRC Policy and Procedure Management 2

Question 1

Which element is most critical when establishing a policy exception process?

Accepted Answer

Documentation of risk acceptance and compensating controls

Answer

A sound exception process requires documenting the risk being accepted and any compensating controls that reduce that risk.

Question 2

What is the primary purpose of a policy attestation process?

Accepted Answer

To confirm that employees have read and understood policies

Answer

Attestation formally confirms that employees have acknowledged and understood applicable policies, creating accountability.

Question 3

A company's information security policy conflicts with a newly enacted state privacy regulation. What should happen first?

Accepted Answer

Conduct a gap analysis to identify required policy changes

Answer

A gap analysis identifies exactly where the policy conflicts with the regulation so targeted updates can be made.

Question 4

Which of the following best describes a 'standard' in GRC context?

Accepted Answer

A specific mandatory requirement supporting a policy

Answer

Standards are mandatory, specific requirements that operationalize policies and define minimum acceptable levels of compliance.

Question 5

During policy review, stakeholders disagree on the acceptable use of personal devices for work email. What is the best next step?

Accepted Answer

Conduct a risk assessment to inform the decision

Answer

A risk assessment provides objective data on threats, vulnerabilities, and impacts to support informed stakeholder decision-making.

(GRC) Governance, Risk, and Compliance Certification Practice Test