Know How to Define Effective Policies, Controls and Guidelines (2.5.2, 2.5.2.1-3) ITIL-4-STRATEGIC-LEADER-MODULES Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An IT department wants to ensure that its service desk meets response time targets. The department head proposes adding a control that automatically escalates any ticket not answered within 15 minutes. However, the service desk manager is concerned about the impact on staff morale and the potential for unnecessary escalations. What should the organization do to define an effective control?

   • AReplace the control with a guideline that encourages staff to answer tickets quickly.
   • BImplement the control as proposed to ensure strict adherence to response time targets.
   • CRemove the response time target and rely on the service desk's professional judgment.
   • DDefine a control that monitors response times and escalates only when the target is at risk, with a reasonable threshold.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What does the principle of proportionality mean when defining effective controls?

   • AControls should be applied only to high-risk areas
   • BControls should be proportionate to the risk and cost of implementation
   • CControls should be the same for all processes regardless of risk
   • DControls should be as strict as possible to ensure compliance
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A financial services firm is developing a new policy for handling customer data. The policy must be enforceable across multiple regions with different regulatory requirements. The compliance team proposes a single, detailed policy that specifies exact procedures for every possible scenario. Which approach should the organization take to ensure the policy is effective?

   • ACreate a high-level policy that states principles and requirements, supported by regional guidelines and controls.
   • BAdopt the detailed policy as proposed to ensure consistency and compliance.
   • CDevelop separate, unrelated policies for each region to avoid conflicts.
   • DWrite a policy that is intentionally vague to allow maximum flexibility for regional teams.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   How do policies, controls, and guidelines interrelate in an organization?

   • APolicies set direction, guidelines provide flexible guidance, and controls monitor compliance and performance
   • BThey are independent and have no effect on each other
   • CGuidelines are mandatory, policies are flexible, and controls are optional
   • DControls set direction, policies provide guidance, and guidelines monitor performance
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A healthcare provider is developing a new policy for patient data access. The policy must be clear, relevant, and aligned with the organization's objective of improving patient care while ensuring privacy. The policy team is considering how to involve stakeholders. What should they do to ensure the policy is effective?

   • AEngage stakeholders from clinical, administrative, and IT teams to gather input and review drafts.
   • BCreate a policy that is broad enough to cover all possible future scenarios.
   • CCopy a policy from another healthcare organization to save time.
   • DWrite the policy based on legal requirements and distribute it to staff for information.
   Reveal Solution Discussion Select an answer first