GRC Policy and Procedure Management 5

Question 1

An employee in a foreign subsidiary claims a corporate security policy violates local labor law. What should the GRC team do?

Accepted Answer

Consult legal counsel to determine whether a jurisdictional exception or policy modification is needed

Answer

Legal counsel must evaluate whether local law requires policy adaptation to avoid regulatory violations in that jurisdiction.

Question 2

Which document type provides the 'why' behind security requirements and sets management intent?

Accepted Answer

Policy

Answer

Policies communicate management's intent and the organization's position on a topic without prescribing specific implementation steps.

Question 3

During an audit, the auditor requests evidence that the acceptable use policy was in effect 18 months ago. What is needed?

Accepted Answer

An archived version of the policy as it existed 18 months ago

Answer

Auditors assessing historical compliance need the exact policy version that was in effect during the period under review.

Question 4

What is the risk of setting policy review cycles longer than 3 years?

Accepted Answer

Policies may become misaligned with evolving threats, regulations, and business changes

Answer

Long review cycles increase the likelihood that policies will not reflect current threats, technologies, or regulatory requirements.

Question 5

A guidelines document says employees 'should' encrypt sensitive emails. What does this language indicate?

Accepted Answer

Encryption is a recommended practice but not required

Answer

The word 'should' indicates a recommendation rather than a mandatory control, distinguishing guidelines from standards and policies.

(GRC) Governance, Risk, and Compliance Certification Practice Test