IGP Information Governance Framework & Policies 4 — Questions and Answers
Question 1: In the context of IG frameworks, 'accountability' means that:
- All employees share equal responsibility for all information assets
- A senior executive or designated officer is responsible for the IG program and its outcomes (Correct answer)
- Only IT staff are accountable for data security incidents
- Accountability is distributed equally across all departments
Correct answer: A senior executive or designated officer is responsible for the IG program and its outcomes
Accountability requires that a senior executive or designated officer take ownership of the IG program, ensuring it is resourced, enforced, and aligned with organizational goals.
Question 2: Which of the following is a key characteristic of an effective IG policy lifecycle?
- Policies are written once and never revised
- Policies undergo regular review and updates to reflect regulatory and business changes (Correct answer)
- Policies are created solely by IT without business input
- Policies are distributed only to senior management
Correct answer: Policies undergo regular review and updates to reflect regulatory and business changes
Effective IG policies must be periodically reviewed and updated to remain aligned with evolving laws, regulations, business needs, and technology changes.
Question 3: A company's IG framework should address privacy requirements under which US federal law applicable to healthcare information?
- FERPA
- GLBA
- HIPAA (Correct answer)
- COPPA
Correct answer: HIPAA
HIPAA (Health Insurance Portability and Accountability Act) governs the privacy and security of protected health information (PHI) and must be addressed in healthcare IG frameworks.
Question 4: What is the primary purpose of an IG policy exception process?
- To allow employees to permanently opt out of all IG requirements
- To provide a controlled, documented mechanism for temporarily deviating from a policy when business needs require it (Correct answer)
- To automatically exempt executives from compliance obligations
- To replace the policy with a more lenient standard
Correct answer: To provide a controlled, documented mechanism for temporarily deviating from a policy when business needs require it
An exception process allows documented, risk-assessed deviations from policy when strict adherence is impractical, maintaining governance while accommodating legitimate business needs.
Question 5: Which element distinguishes a 'standard' from a 'policy' in an IG framework hierarchy?
- Standards are optional; policies are mandatory
- Standards provide specific, measurable requirements that support policy compliance (Correct answer)
- Standards are written by vendors; policies are written internally
- Standards apply only to IT systems while policies apply to all information
Correct answer: Standards provide specific, measurable requirements that support policy compliance
Standards define specific, quantifiable requirements (e.g., password length minimums) that operationalize policies, making compliance measurable and auditable.
Question 6: An organization implementing a new IG framework should prioritize stakeholder engagement PRIMARILY because:
- It reduces the cost of IG software licenses
- Buy-in from key stakeholders increases adoption and ensures the framework reflects real business needs (Correct answer)
- It allows the IG team to delegate all work to other departments
- Regulatory agencies require documented stakeholder meetings
Correct answer: Buy-in from key stakeholders increases adoption and ensures the framework reflects real business needs
Stakeholder engagement builds organizational buy-in, surfaces critical requirements from different business units, and increases the likelihood of successful IG program adoption.
Question 7: Which metric is MOST useful for measuring IG policy compliance?
- Number of IG policies published on the intranet
- Percentage of employees who have completed required IG training (Correct answer)
- Total number of records stored in the repository
- Annual IG budget expenditure
Correct answer: Percentage of employees who have completed required IG training
Training completion rates directly indicate whether employees have been exposed to and acknowledged IG requirements, serving as a key compliance metric.
IGP Information Governance Framework & Policies 4
In the context of IG frameworks, 'accountability' means that: