GRC Policy and Procedure Management 3

Question 1

What distinguishes a procedure from a policy in the GRC policy hierarchy?

Accepted Answer

Procedures provide step-by-step instructions for implementing policies

Answer

Procedures are optional; policies are mandatory

Answer

Procedures are written by regulators; policies by management

Answer

Procedures apply only to IT; policies apply organization-wide

Question 2

An organization publishes a new data classification policy but employees continue using the old scheme. What is the most likely root cause?

Accepted Answer

Insufficient communication and training on the new policy

Answer

The new policy was never formally approved

Answer

Data classification is inherently too complex

Answer

The old scheme was mandated by regulators

Question 3

Which governance body typically has final approval authority for enterprise-level security policies?

Accepted Answer

The Board of Directors or executive leadership

Answer

The IT help desk team

Answer

Individual department managers

Answer

External auditors

Question 4

A policy states that access reviews must occur 'regularly.' Why is this language problematic?

Accepted Answer

Vague language cannot be consistently audited or enforced

Answer

The word 'regularly' is too technical for most employees

Answer

Access reviews should not be required by policy

Answer

The term should be replaced with 'occasionally'

Question 5

When should a policy undergo an unscheduled review?

Accepted Answer

After a significant security incident, regulatory change, or major business change

Answer

Only when the annual review cycle arrives

Answer

Whenever an employee requests a review

Answer

Only when auditors request it

Question 6

What role does a policy management tool (software) play in a mature GRC program?

Accepted Answer

It centralizes policy storage, version control, workflow, and attestation tracking

Answer

It eliminates the need for policy owners

Answer

It automates policy creation without human input

Answer

It replaces the need for a policy framework

Question 7

Which principle ensures that a policy is enforceable across the organization?

Accepted Answer

Senior management must visibly support and comply with the policy

Answer

The policy must be written in legal language only

Answer

Only IT personnel are required to follow the policy

Answer

The policy must reference at least three external frameworks