The Overdue Policy Refresh
A mid-sized payments firm has a governance framework stating that all policies are reviewed annually. The Acceptable Use Policy was last reviewed 26 months ago. The Compliance Manager flagged this in a quarterly report; the Head of Risk says the policy is 'still substantively fine' and that reviewing it is a paperwork exercise. Meanwhile, two internal audit findings in the past year cited staff confusion over personal-device rules that the policy addresses ambiguously. The board's audit committee has asked why the governance framework is not being followed. The firm has 400 employees and operates in two jurisdictions with slightly different data-handling expectations.
1. Is the Head of Risk's position defensible? Analyze the governance failure and its implications.
Read the worked answer
The position is not defensible as stated. The annual review requirement is a control in the governance framework; treating it as optional because the content 'seems fine' is exactly the kind of discretion a framework exists to remove. Two audit findings citing ambiguity in the very area the policy covers are direct evidence the policy is not substantively fine - they are symptoms of an unreviewed, stale document.
The failure is a governance design and operating issue, not a documentation issue. Either the framework's review cadence is unrealistic (and should be re-designed with risk-based triggers), or the organization tolerates non-compliance with its own controls, which undermines every other control. The audit committee question is really asking: can we trust the framework?
The correct response is to (1) remediate the policy now, prioritizing the device rules flagged by audit; (2) investigate why the review slipped - ownership unclear? no tracking mechanism?; and (3) decide whether annual review is the right cadence or whether risk-based triggers plus a lighter annual attestation is more honest. Either way, the framework must match actual practice or be changed.
2. What should the Compliance Manager recommend to the audit committee?
Read the worked answer
A short, factual recommendation:
- Acknowledge the breach of the stated cadence without minimizing it.
- Root cause: identify whether the gap is a single policy or systemic (sample other policies for review dates).
- Remediation plan with dates: refresh the Acceptable Use Policy, resolving the device-rule ambiguity audit flagged, and reconcile the two jurisdictions' data-handling expectations.
- Control fix: add a review-date tracker with named owners and escalation before lapse, so the framework is enforced by mechanism rather than memory.
- Framework decision: propose risk-based review triggers (regulatory change, incident, audit finding) layered on a maximum interval, and get the committee to approve the revised cadence so the framework reflects reality.
The framing matters: the committee wants assurance the framework is trustworthy, so the answer must address both the specific lapse and the reliability of the control environment around it.