Compliance, Ethics, and Culture CGEIT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A government agency has a culture of risk aversion, where employees are reluctant to report IT incidents for fear of blame. The agency's GRC program is struggling to identify systemic issues. Which cultural change is most important to improve GRC effectiveness?

   • AIncrease the number of internal audits to catch unreported incidents.
   • BImplement a whistleblower hotline for anonymous reporting of IT issues.
   • CMandate that all employees complete annual ethics training.
   • DEncourage a 'no-blame' culture where employees can report incidents without fear of punishment.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A large enterprise is merging with another company that has a very different culture regarding data privacy. The combined IT governance team wants to align the two cultures to support consistent compliance. Which approach is most effective?

   • ACreate a new privacy policy that is a compromise between the two existing policies.
   • BImmediately implement a mandatory training program on the new privacy policy for all employees.
   • CConduct a cultural assessment to understand the values and behaviors of both organizations before designing integration plans.
   • DAdopt the stricter of the two privacy policies and enforce it across the merged entity.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of organizational culture negatively impacting GRC effectiveness?

   • AThe organization has a formal whistleblower policy.
   • BThe board reviews GRC metrics quarterly.
   • CEmployees routinely bypass security controls to meet deadlines because 'getting the job done' is valued over following procedures.
   • DEmployees attend mandatory compliance training sessions.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A software company discovers that a feature it released collects more personal data than disclosed in its privacy policy. The legal team says the company is not yet in violation of any law, but the ethics committee is concerned about user trust. The IT governance board must decide how to respond. Which action best integrates ethics into compliance and governance?

   • AConduct an ethical impact assessment, then adjust the feature to minimize data collection and communicate the change transparently.
   • BUpdate the privacy policy to reflect the actual data collection and notify users of the change.
   • CImmediately stop the feature and remove all collected data, even if it means losing revenue.
   • DWait until a regulatory requirement forces a change, then update the privacy policy accordingly.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of a control that can be implemented to mitigate a compliance risk?

   • AIgnoring compliance risks that are unlikely to occur.
   • BDisabling security monitoring to reduce false alarms.
   • CDeleting all audit logs to reduce storage costs.
   • DImplementing automated access controls to ensure only authorized personnel can access sensitive data.
   Reveal Solution Discussion Select an answer first