GRC Policy and Procedure Management 3

Question 1

What distinguishes a procedure from a policy in the GRC policy hierarchy?

Accepted Answer

Procedures provide step-by-step instructions for implementing policies

Answer

Procedures are operational documents that describe the specific steps employees must take to comply with higher-level policies.

Question 2

An organization publishes a new data classification policy but employees continue using the old scheme. What is the most likely root cause?

Accepted Answer

Insufficient communication and training on the new policy

Answer

Without effective communication and training, employees lack awareness of policy changes and revert to familiar practices.

Question 3

Which governance body typically has final approval authority for enterprise-level security policies?

Accepted Answer

The Board of Directors or executive leadership

Answer

Enterprise-level policies reflect organizational risk appetite and require Board or executive approval to carry appropriate authority.

Question 4

A policy states that access reviews must occur 'regularly.' Why is this language problematic?

Accepted Answer

Vague language cannot be consistently audited or enforced

Answer

Vague terms like 'regularly' are not measurable, making it impossible to verify compliance or hold anyone accountable.

Question 5

When should a policy undergo an unscheduled review?

Accepted Answer

After a significant security incident, regulatory change, or major business change

Answer

Trigger-based reviews ensure policies remain relevant when significant events occur between scheduled review cycles.

(GRC) Governance, Risk, and Compliance Certification Practice Test