I85PREP
⌘ K
GLIDE Exam study materials
GLIDE Exam study resources

GLIDE Exam practice questions

One question at a time. Build your GLIDE Exam understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Leadership and Governance

In a governance framework, which document typically defines the authority delegated to a project manager and the escalation path when that authority is insufficient?

  1. The project charter Correct answer.
  2. The governance charter
  3. The communications plan
  4. The risk register

Explanation

The project charter formally authorizes the project and names the project manager, and it conventionally records the level of authority granted along with the escalation route to the sponsor or steering body. It is the instrument that links delegated decision rights to accountability.

Question 2Leadership and Governance

A steering committee meets quarterly and reviews only exceptions above a defined threshold. Which governance design does this best illustrate?

  1. Consensus decision-making
  2. Zero-based governance
  3. Management by exception Correct answer.
  4. Participatory budgeting

Explanation

Management by exception reserves senior oversight for variances that exceed agreed tolerances, letting routine decisions stay at lower levels. It preserves escalation capacity for material issues and keeps the committee's attention on genuine deviations.

Question 3Leadership and Governance

Which role is primarily accountable for ensuring that a project's outputs realise the intended business benefits after delivery?

  1. The quality assurance lead
  2. The delivery team lead
  3. The business sponsor Correct answer.
  4. The project manager

Explanation

Benefit realisation is an ownership responsibility that sits with the sponsoring business role, who has the operational authority and longevity to embed outcomes. The project manager delivers outputs but usually hands over before benefits accrue.

Question 4Leadership and Governance

An organisation requires that no single person can both approve a payment and reconcile the corresponding bank record. Which governance control is this?

  1. Dual sign-off
  2. Segregation of duties Correct answer.
  3. Least privilege access
  4. Mandatory rotation

Explanation

Segregation of duties splits incompatible tasks across different people so that no individual can complete a transaction and conceal an error or fraud. Least privilege and rotation are related controls but address access scope and tenure rather than task incompatibility.

Question 5Leadership and Governance

Which trait most clearly distinguishes governance from day-to-day management?

  1. It sets direction, boundaries and accountability Correct answer.
  2. It tracks daily progress against plan
  3. It resolves technical design conflicts
  4. It schedules resources against tasks

Explanation

Governance establishes the frameworks, decision rights and accountability structures within which management operates. Management then executes within those boundaries, handling scheduling, design and progress tracking.

Question 6Leadership and Governance

A code of conduct requires staff to declare gifts above a set value. What is the primary governance purpose of this requirement?

  1. To make potential conflicts of interest visible Correct answer.
  2. To simplify procurement paperwork
  3. To raise revenue through disclosure fees
  4. To reward suppliers for loyalty

Explanation

Gift declarations exist to surface situations where personal interest could influence professional judgement, allowing the organisation to manage or remove the conflict. Transparency protects both the individual and the institution.

Question 7Leadership and Governance

Which body is normally accountable for approving stage-gate transitions and releasing contingency funds in a large programme?

  1. The architecture review group
  2. The audit committee
  3. The programme board Correct answer.
  4. The change advisory board

Explanation

The programme board holds delegated accountability for investment decisions, stage approvals and contingency release. Other boards provide specialist assurance or advice but do not own the funding decision.

Question 8Leadership and Governance

A leader consistently explains decisions in terms of the organisation's stated values and holds others to the same standard. Which leadership quality is being demonstrated?

  1. Adaptability
  2. Vision
  3. Decisiveness
  4. Integrity Correct answer.

Explanation

Integrity is demonstrated when stated values are consistently reflected in decisions and expectations of others. It builds trust because behaviour matches the espoused standard over time.

Question 9Leadership and Governance

A sponsor wants a project accelerated by two months. The project manager documents the impact on scope, cost and risk and presents options before any commitment. Which governance principle is being applied?

  1. Delegation of all decisions to the delivery team
  2. Avoidance of documented trade-offs
  3. Escalation of every change to the board
  4. Informed decision-making at the accountable level Correct answer.

Explanation

Sound governance requires that the person holding decision rights receives a clear statement of consequences and alternatives before deciding. This keeps accountability at the right level while ensuring the choice is evidence-based.

Question 10Leadership and Governance

A project manager discovers that a peer project is building a compatible component that could be reused. The manager raises this at the portfolio forum. Which governance mechanism does this demonstrate?

  1. Portfolio-level coordination of interdependencies Correct answer.
  2. Unilateral scope expansion
  3. Change freeze enforcement
  4. Independent quality audit

Explanation

Portfolio forums exist partly to detect and manage dependencies and duplication across projects. Surfacing a reuse opportunity there allows a coordinated decision rather than isolated action.

Question 11Leadership and Governance

During a gate review, evidence shows the business case assumptions are now materially weaker but the project is otherwise on schedule. What should the governing body do first?

  1. Approve continuation because schedule is on track
  2. Delegate the decision to the delivery team
  3. Close the project immediately without analysis
  4. Reassess the business case before approving continuation Correct answer.

Explanation

The business case is the justification for continued investment, so a material change in its assumptions requires reassessment before further funding is committed. Schedule performance alone does not validate the value proposition.

Question 12Leadership and Governance

A leader must deliver a contested restructuring. Staff report feeling unheard. Which approach best reflects sound governance leadership?

  1. Delegate the decision to an external consultant
  2. Announce the decision and discourage further discussion
  3. Delay the decision indefinitely until agreement is unanimous
  4. Explain the rationale and decision rights, then create structured channels for concerns Correct answer.

Explanation

Good governance leadership separates the legitimacy of the decision and who owns it from genuine consultation on implementation concerns. This maintains accountability while preserving trust and surfacing useful information.

Question 13Leadership and Governance

A programme has three projects whose deliverables all feed a single regulatory deadline. Which governance arrangement is most appropriate?

  1. A single accountable programme board with integrated dependency tracking Correct answer.
  2. Delegation of all three to separate external suppliers
  3. Three independent boards with no shared reporting
  4. A single board that reviews only financial variance

Explanation

Where deliverables converge on one critical outcome, accountability and dependency management should be integrated at programme level. Fragmented oversight hides cross-project slippage until it is too late to correct.

Question 14Leadership and Governance

A risk owner reports that a high-severity risk has exceeded its tolerance. What is the most appropriate governance response?

  1. Transfer the risk to a team with no budget
  2. Reduce the risk rating to avoid escalation
  3. Record it and continue without further action
  4. Escalate to the level holding authority to accept or fund mitigation Correct answer.

Explanation

Tolerance breaches must move to the level with authority to accept the exposure or commit resources to treat it. This preserves the link between risk ownership and decision authority.

Question 15Leadership and Governance

An organisation's governance manual has not been updated for four years, and staff routinely bypass it. Which diagnosis is most plausible?

  1. The staff require stricter disciplinary measures only
  2. The manual should be withdrawn entirely
  3. The framework has lost legitimacy and needs review with stakeholder input Correct answer.
  4. The governance function should be outsourced

Explanation

Frameworks that are outdated and widely bypassed typically lack relevance or ownership, so renewal with the people subject to them restores legitimacy. Purely punitive responses address symptoms without fixing the design gap.

Question 16Leadership and Governance

A project manager has authority to approve changes up to a stated cost threshold. A change exceeds it. What is the correct action?

  1. Refer the change to the body that holds authority above the threshold Correct answer.
  2. Defer the change indefinitely without notifying anyone
  3. Approve it because the manager judges it beneficial
  4. Split the change into smaller parts to stay under the threshold

Explanation

Delegated authority is bounded, and changes beyond the limit must go to the level that holds that authority. Splitting a change to evade the threshold defeats the control and is a governance breach.

Question 17Leadership and Governance

Which practice best strengthens the independence of an internal assurance function?

  1. Assurance staff also managing the work they review
  2. Reporting lines that sit outside the areas being assured Correct answer.
  3. Assurance scope set solely by the delivery team
  4. Assurance reports approved by the audited manager

Explanation

Independence requires that assurance providers are not subordinate to, or financially dependent on, the managers whose work they examine. Reporting outside the audited area preserves objectivity and the freedom to report unwelcome findings.

Question 18Leadership and Governance

A board receives a dashboard showing only cost and schedule. A serious safety culture issue emerges undetected. What governance weakness does this reveal?

  1. An unbalanced performance framework that omits non-financial indicators Correct answer.
  2. Excessive reporting frequency
  3. Over-reliance on qualitative data
  4. Too many independent assurance reviews

Explanation

Governance reporting must cover the full set of outcomes the organisation is accountable for, including safety, quality and compliance. A narrow cost-and-schedule lens leaves material risks invisible to the board until they crystallise.

Question 19Leadership and Governance

Two senior managers disagree over ownership of a cross-functional deliverable, and work stalls. Which governance action resolves this most directly?

  1. Ask both managers to co-own the deliverable indefinitely
  2. Suspend the deliverable until consensus emerges
  3. Confirm a single accountable owner through the agreed decision-rights framework Correct answer.
  4. Escalate to the whole organisation by email

Explanation

Stalled work at boundaries is usually a symptom of unclear accountability, which the decision-rights framework exists to settle. Naming one accountable owner converts shared ambiguity into a clear point of responsibility.

Question 20Leadership and Governance

A leader delegates a decision but retains the accountability for its outcome. Which statement best captures this relationship?

  1. Authority may be delegated while accountability remains with the delegator Correct answer.
  2. Delegation removes the delegator from any further involvement
  3. Accountability transfers fully whenever authority is delegated
  4. Authority and accountability can never be separated

Explanation

Delegation passes decision rights to another person, but the delegator remains answerable to higher authority for the result. This is why delegation must be accompanied by clear boundaries and reporting.

Question 21Leadership and Governance

A not-for-profit's board includes several members who also sit on the board of a major funder. What governance concern arises most directly?

  1. A conflict of interest that may compromise independent oversight Correct answer.
  2. An overly long board tenure policy
  3. A lack of technical expertise on the board
  4. An excess of operational detail at board level

Explanation

Overlapping roles with a significant funder can compromise the board's ability to challenge and decide independently. The concern is structural independence rather than skills, tenure or operational focus.

Question 22Leadership and Governance

An organisation wants assurance that its governance arrangements remain fit for purpose as it grows. Which mechanism provides this most directly?

  1. Increasing the number of steering committees
  2. Extending project durations
  3. Annual refresh of the staff newsletter
  4. Periodic independent review of the governance framework Correct answer.

Explanation

Fitness for purpose is tested through independent, periodic review against the organisation's scale, risk profile and objectives. Adding committees or lengthening projects changes structure without evaluating whether it works.

Question 23Leadership and Governance

A sponsor repeatedly overrides project manager decisions in front of the team, then asks the manager to enforce standards. Which governance principle is most clearly undermined?

  1. Consistency between delegated authority and visible support Correct answer.
  2. Frequency of status reporting
  3. Documentation of meeting minutes
  4. Selection of delivery methodology

Explanation

Delegation only functions when the authority granted is visibly respected by the delegator. Public reversal without process erodes the manager's credibility and teaches the team that delegated decisions do not hold.

Question 24Leadership and Governance

A board approves a strategy but the executive team's incentives reward only short-term cost reduction. What is the most likely governance consequence?

  1. Incentives have no effect on strategic delivery
  2. The strategy will be delivered faster than planned
  3. The board's approval becomes legally invalid
  4. Strategy implementation drifts toward cost cutting despite stated intent Correct answer.

Explanation

Governance alignment requires that reward systems reinforce the approved strategy, otherwise rational actors follow the incentives. Persistent misalignment produces silent drift between stated direction and actual behaviour.

Question 25Leadership and Governance

A governance body wants to approve a large investment but holds limited technical expertise. Which arrangement best preserves both accountability and decision quality?

  1. Retain the decision but require structured independent technical advice with documented rationale Correct answer.
  2. Approve without advice to avoid delay
  3. Transfer the decision permanently to the technical advisers
  4. Ask the supplier to certify its own proposal

Explanation

Accountable bodies can strengthen decisions by obtaining independent advice while keeping the decision with those answerable for the outcome. Transferring the decision or relying on self-interested certification breaks the accountability chain.

Question 26Leadership and Governance

Which statement best describes the difference between governance and management in an organisation?

  1. Governance sets direction and oversight, while management delivers within that framework Correct answer.
  2. Governance applies only to public bodies, while management applies to all organisations
  3. Governance handles external reporting, while management handles internal reporting
  4. Governance is performed by external auditors, while management is performed by staff

Explanation

Governance establishes the framework of direction, accountability, risk appetite and oversight within which delivery occurs. Management executes within that framework, making day-to-day decisions and allocating resources. The two are complementary but distinct in purpose and accountability.

Question 27Leadership and Governance

What does the principle of accountability require of a person who has delegated a task?

  1. They must personally complete any task that carries material risk
  2. They transfer both the work and the final responsibility to the delegate
  3. They must seek written approval before delegating any task
  4. They remain answerable for the outcome even after delegating the work Correct answer.

Explanation

Delegation transfers authority to act but not ultimate accountability, which stays with the delegating person. The delegator must therefore monitor progress and remain answerable for results. This separation of authority from accountability is a core governance principle.

Question 28Leadership and Governance

Which arrangement best supports effective oversight of an executive team by a governing body?

  1. The governing body receives assurance from sources independent of the executive Correct answer.
  2. The executive team sets the governing body's agenda and information pack
  3. The governing body meets once a year to review the annual accounts
  4. The governing body includes several executives from the same organisation

Explanation

Effective oversight depends on information and assurance that do not originate solely from those being overseen. Independent assurance allows the governing body to test executive claims. Frequency and agenda control also matter, but independence is the decisive factor here.

Question 29Leadership and Governance

A governance framework assigns decision rights, escalation paths and reporting lines. Which outcome does this primarily enable?

  1. Faster recruitment of specialist staff
  2. Elimination of all delivery risk
  3. Reduced need for any project documentation
  4. Clear accountability for decisions and their outcomes Correct answer.

Explanation

Defining who decides, who is informed and how issues escalate makes accountability explicit and traceable. People then know where decisions sit and who answers for them. It does not remove risk or documentation needs, nor does it govern recruitment specifically.

Question 30Leadership and Governance

A regulator requires an organisation to demonstrate that its board challenged a major investment decision. Which evidence best satisfies this requirement?

  1. A signed approval sheet listing board members who voted in favour
  2. A press release announcing the investment after the decision
  3. A project plan showing the investment's expected payback period
  4. Minutes recording the questions raised, the answers given and the conditions imposed Correct answer.

Explanation

Challenge is evidenced by a record of the scrutiny applied: the questions asked, responses received and any conditions attached to approval. Such minutes show that the board tested the proposal rather than merely endorsing it. Approval signatures or publicity do not demonstrate the quality of challenge.

Question 31Leadership and Governance

A newly formed programme has no documented escalation route for issues that cross project boundaries. Which governance action should be taken first?

  1. Refer every cross-boundary issue directly to the external auditor
  2. Instruct project managers to resolve all cross-boundary issues themselves
  3. Suspend the programme until a permanent governance manual is complete
  4. Define and publish an escalation path with named decision owners and timeframes Correct answer.

Explanation

The gap is a missing escalation mechanism, so the proportionate first step is to define who decides, at what threshold and within what timeframe. Publishing this makes the route usable immediately. The other responses either remove necessary oversight or bypass the accountable decision-makers.

Question 32Leadership and Governance

An organisation's audit committee reports to the chief executive rather than to the board. What is the main governance weakness?

  1. The committee will duplicate the work of project assurance
  2. The committee's independence from executive influence is compromised Correct answer.
  3. The committee will lack sufficient technical expertise
  4. The committee will be unable to review financial statements

Explanation

Assurance is only credible when it can report candidly without depending on the people it examines. Reporting to the chief executive places the committee within the executive line it is meant to scrutinise. Independence, not technical skill or scope, is the defect created here.

Question 33Leadership and Governance

A sponsor approves a business case but declines to state any tolerance for cost or schedule variance. What is the most likely governance consequence?

  1. The project manager cannot escalate issues because no thresholds exist Correct answer.
  2. The business case will be invalidated at the next review
  3. The finance function will automatically absorb any overspend
  4. The project team will deliver faster because it has more freedom

Explanation

Tolerances define the boundaries within which a manager may operate and the point at which escalation is triggered. Without stated tolerances, the manager has no agreed basis for deciding when to escalate. The absence of limits does not create speed, automatic funding or automatic invalidation.

Question 34Leadership and Governance

A steering group is asked to approve a project that conflicts with a stated strategic priority. Which response best reflects sound governance?

  1. Defer the decision and request an assessment against the strategic priority Correct answer.
  2. Approve the project because the business case shows a positive return
  3. Refer the decision to the project manager for a recommendation
  4. Reject the project without recording any reason

Explanation

Governance bodies align investment with strategy; where a conflict exists, the decision needs explicit assessment rather than an automatic yes or no. Deferring for a documented strategic assessment preserves both rigour and the audit trail. A positive financial return alone does not resolve a strategic conflict.

Question 35Leadership and Governance

A leader wants decisions to be made closer to the frontline. Which change most directly supports this while preserving accountability?

  1. Delegating defined decision rights with matching limits and reporting Correct answer.
  2. Requiring frontline staff to seek approval for every decision
  3. Removing all reporting requirements for frontline teams
  4. Centralising all decisions in a weekly leadership meeting

Explanation

Subsidiarity works when authority is delegated together with clear boundaries and a reporting line that keeps accountability visible. Defined decision rights let staff act locally while leaders retain oversight. Removing reporting or centralising decisions defeats the aim.

Question 36Leadership and Governance

A governing body approves a strategy that depends on major digital investment, but none of its members has technology experience. Which action best strengthens governance?

  1. Delegate all technology decisions to the chief information officer without review
  2. Add an independent member with relevant digital expertise and require plain-language reporting Correct answer.
  3. Postpone the strategy until every member completes a technology qualification
  4. Rely on the technology supplier to confirm that the strategy is achievable

Explanation

Governing bodies need enough relevant competence to challenge what they approve, and independent expertise combined with accessible reporting supplies it. This keeps accountability with the board rather than transferring it to suppliers or executives. Requiring universal qualifications is disproportionate and unnecessary.

Question 37Leadership and Governance

A programme board keeps approving change requests that individually look small but collectively exceed the approved budget. Which control weakness does this reveal?

  1. Change requests are being raised by the wrong level of staff
  2. The board lacks a register of stakeholder interests
  3. The board meets too frequently to review changes properly
  4. Changes are assessed in isolation without cumulative impact analysis Correct answer.

Explanation

Small approvals can aggregate into material overspend when each is judged alone. Sound governance reviews cumulative change against the approved baseline and tolerance. Frequency of meetings or the seniority of requesters does not explain the drift.

Question 38Leadership and Governance

A public body must choose between two viable options for a service redesign. Which governance approach best supports a defensible decision?

  1. Document the criteria, weight them transparently and record the rationale Correct answer.
  2. Delay the decision until all stakeholders reach full consensus
  3. Select the option favoured by the most senior manager present
  4. Choose the lowest-cost option to minimise public scrutiny

Explanation

Defensible decisions rest on pre-agreed criteria, transparent evaluation and a recorded rationale that can withstand later scrutiny. This allows the reasoning to be examined even if circumstances change. Deference to seniority, indefinite delay or cost alone weakens the basis for the choice.

Question 39Leadership and Governance

An executive director chairs the committee that sets their own performance targets and approves their own remuneration. Which governance principle is most directly breached?

  1. Continuity of senior leadership
  2. Segregation of duties and avoidance of self-oversight Correct answer.
  3. Subsidiarity in operational decision-making
  4. Proportionality in risk management

Explanation

No one should be the sole arbiter of their own performance or reward, because self-oversight removes independent challenge. Separating these roles protects both the individual and the organisation's credibility. The other principles concern decision level, risk scaling and succession, not self-review.

Question 40Leadership and Governance

A board receives assurance reports prepared by the same team that delivers the projects being reported on. What is the most significant implication?

  1. The reports will be delivered later than scheduled
  2. The reports may understate problems because the preparer has an interest in the outcome Correct answer.
  3. The reports will breach data protection requirements
  4. The reports will necessarily contain factual errors

Explanation

Assurance prepared by the delivery team is self-assessment, and self-interest tends to produce optimistic reporting. The board may therefore receive a misleadingly favourable picture. The concern is bias rather than accuracy, timeliness or data protection.

Question 41Risk Management and Compliance

Which statement best defines risk in a compliance and risk-management context?

  1. The total amount of capital a firm holds in reserve
  2. The effect of uncertainty on objectives, combining likelihood and impact Correct answer.
  3. A legal penalty imposed by a regulator after an audit
  4. Any event that has already caused a documented financial loss

Explanation

Risk is conventionally defined as the effect of uncertainty on objectives, assessed through the likelihood that something occurs and the impact if it does. Loss events and penalties are realized outcomes rather than the risk itself, and capital is a response to risk, not its definition.

Question 42Risk Management and Compliance

A firm rates a risk as high likelihood with low impact. Under a standard heat-map approach, how is such a risk usually treated?

  1. Escalated to the board as a critical risk requiring immediate capital
  2. Excluded from the risk register because impact is low
  3. Transferred in full to an external insurer
  4. Monitored and controlled through routine operational procedures Correct answer.

Explanation

High-frequency, low-severity risks are typically handled through standardized controls and routine monitoring rather than board escalation. Their frequent occurrence makes them costly in aggregate, so they still belong on the register and within operational control frameworks.

Question 43Risk Management and Compliance

In the three-lines model, which group provides independent assurance over the effectiveness of risk management and controls?

  1. The second line, comprising the risk and compliance function
  2. The first line, comprising front-office business units
  3. The external auditor engaged by shareholders
  4. The third line, comprising internal audit Correct answer.

Explanation

Under the three-lines model, the first line owns and manages risk, the second line provides oversight and challenge, and the third line, internal audit, gives independent assurance to the governing body. External audit serves shareholders and is not part of the internal three-lines structure.

Question 44Risk Management and Compliance

A compliance officer is designing a control that checks every transaction against a sanctions list before settlement. What type of control is this?

  1. A detective control applied after the fact
  2. A preventive control applied before the event Correct answer.
  3. A compensating control used only when primary controls fail
  4. A directive control consisting of policy guidance only

Explanation

Controls that stop an unwanted event before it occurs, such as pre-settlement screening, are preventive. Detective controls identify problems after they happen, and compensating controls substitute for a primary control that is unavailable.

Question 45Risk Management and Compliance

Which risk response involves accepting the possibility of loss without taking action to reduce it?

  1. Retention Correct answer.
  2. Avoidance
  3. Mitigation
  4. Transfer

Explanation

Risk retention means the organization accepts the exposure and bears any resulting loss, which may be deliberate or unconscious. Avoidance eliminates the activity, mitigation reduces likelihood or impact, and transfer shifts the financial consequence to a third party.

Question 46Risk Management and Compliance

A firm's residual risk exceeds its stated risk appetite for a product line. What is the most appropriate governance action?

  1. Record the excess in the register and continue without change
  2. Reduce the exposure through additional controls or exit, and escalate as required Correct answer.
  3. Reclassify the risk as low likelihood to bring it within appetite
  4. Defer the decision until the next annual risk review

Explanation

Risk appetite defines the level of risk the organization is willing to accept, so exposures above it require remediation, additional controls, or exit, together with escalation under the governance framework. Merely documenting or relabeling the exposure does not bring it within appetite.

Question 47Risk Management and Compliance

Under a risk-based approach, how should a compliance function allocate monitoring resources?

  1. Randomly, to avoid any appearance of bias
  2. Toward the units that generate the most revenue
  3. Equally across all business units to demonstrate fairness
  4. Toward the areas with the highest assessed risk and weakest controls Correct answer.

Explanation

A risk-based approach directs finite resources to the exposures that matter most, meaning higher inherent risk and weaker control environments. Equal or revenue-based allocation ignores the risk profile and can leave significant exposures under-monitored.

Question 48Risk Management and Compliance

Which element is essential for a risk register to remain useful to management?

  1. It is kept confidential from business units to prevent leaks
  2. It is updated regularly with owners, ratings, and status of mitigating actions Correct answer.
  3. It records only risks that have already materialized
  4. It lists every conceivable risk regardless of materiality

Explanation

A risk register supports decision-making only when it is current, assigns ownership, and tracks ratings and remediation status. Exhaustive lists without prioritization, or registers limited to realized events, add little value and obscure the significant exposures.

Question 49Risk Management and Compliance

What is the primary purpose of a compliance risk assessment?

  1. To replace the internal audit function during the year
  2. To calculate the exact financial penalty a regulator will impose
  3. To certify that the firm has no compliance breaches
  4. To identify, rate, and prioritize compliance exposures so controls can be targeted Correct answer.

Explanation

A compliance risk assessment identifies applicable obligations, evaluates the likelihood and impact of breaches, and prioritizes exposures so that controls and monitoring can be targeted. It is a forward-looking management tool, not a certification of zero breaches or a substitute for audit.

Question 50Risk Management and Compliance

A new regulation takes effect in three months. Which sequence best reflects a sound implementation process?

  1. Update policies, then identify obligations, then test controls
  2. Delegate entirely to external counsel and take no internal action
  3. Identify obligations and gaps, design and implement controls, then test and monitor Correct answer.
  4. Test controls, then draft policies, then identify obligations

Explanation

Effective implementation begins with identifying the new obligations and assessing gaps against current practice, then designing and embedding controls before testing and ongoing monitoring. Testing before controls exist or drafting policies before understanding obligations reverses the logical sequence.