Program Monitoring and Metrics CDPSE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A privacy team has two different audiences for its quarterly metrics report: the board of directors and the IT operations team. The board is interested in high-level risk and compliance, while the IT team is interested in operational details and control performance. What is the most appropriate way for the privacy team to report to these two audiences?

   • ASend the same detailed report to both audiences to ensure consistency and transparency.
   • BCreate two versions of the report: a high-level summary for the board and a more detailed operational report for the IT team.
   • CReport only the metrics that are positive to both audiences to maintain a favorable view of the program.
   • DReport only to the board, as they are the primary decision-makers, and have the IT team access the raw data directly.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization's privacy metrics show that the rate of DSAR completion within the legal timeframe has dropped from 95% to 85% over two quarters. The privacy team has identified that the increase in DSAR volume is the primary cause. What is the most appropriate action for the privacy team to take?

   • ARecommend allocating additional resources or streamlining the DSAR process to handle the increased volume without missing deadlines.
   • BReport the decline to management and state that the legal deadline is unrealistic given the current volume.
   • CChange the metric to exclude DSARs that are considered complex, as they are not representative of normal operations.
   • DStop tracking the metric until the volume returns to normal levels.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A privacy team is analyzing data from its training metrics. The data shows that the completion rate for a new module on data minimization is 60%, which is lower than the 90% completion rate for other modules. What is the most appropriate conclusion for the privacy team to draw from this analysis?

   • AThe lower completion rate indicates a potential gap in understanding or engagement with the data minimization topic that may require further investigation.
   • BThe data minimization module is too difficult and should be removed from the training program.
   • CThe metric is not important because it is only about training, not about actual privacy breaches.
   • DThe training program is a failure because one module has a low completion rate.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A privacy team has completed its quarterly analysis of privacy metrics. The data shows that the average time to complete DSARs has increased from 15 days to 25 days, while the number of DSARs has remained stable. The team needs to report this to the executive steering committee. What is the most effective way to present this information?

   • AReport that the privacy program is performing well because the number of DSARs has not increased.
   • BPresent the raw data table with all monthly DSAR processing times for the past year.
   • CState that the increase is due to seasonal variations and no action is needed.
   • DHighlight the increase in processing time and recommend an investigation into the root cause, such as resource constraints or process bottlenecks.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A multinational corporation has implemented a new privacy program. The privacy officer wants to ensure that data subject access requests (DSARs) are handled within the legally required timeframe. Which metric should the privacy team define to monitor this requirement most effectively?

   • ANumber of DSARs escalated to the legal department
   • BPercentage of DSARs completed within the regulatory deadline
   • CAverage time taken to complete a DSAR
   • DTotal number of DSARs received per month
   Reveal Solution Discussion Select an answer first