nerdexam
Isaca

CGEIT · Question #150

A CIO just received a final audit report that indicates there is inconsistent enforcement of the enterprise's mobile device acceptable use policy throughout all business units. Which of the…

The correct answer is B. Review the relevance of existing policy. To address inconsistent enforcement of an acceptable use policy, the initial action should be to review the policy's current relevance and clarity before proceeding with enforcement or training.

Submitted by fatema_kw· Apr 18, 2026Governance of Enterprise IT

Question

A CIO just received a final audit report that indicates there is inconsistent enforcement of the enterprise's mobile device acceptable use policy throughout all business units. Which of the following should be the FIRST step to address this issue?

Options

  • AIncorporate compliance metrics into performance goals.
  • BReview the relevance of existing policy.
  • CMandate awareness training for all mobile device users.
  • DImplement controls to enforce the policy.

How the community answered

(41 responses)
  • A
    5% (2)
  • B
    78% (32)
  • C
    2% (1)
  • D
    15% (6)

Why each option

To address inconsistent enforcement of an acceptable use policy, the initial action should be to review the policy's current relevance and clarity before proceeding with enforcement or training.

AIncorporate compliance metrics into performance goals.

Incorporating compliance metrics into performance goals is a subsequent step for ongoing measurement and improvement, after the policy's foundational relevance and enforceability have been confirmed.

BReview the relevance of existing policy.Correct

Before any enforcement actions or training initiatives, it is fundamental to ensure that the existing policy is still relevant, clear, comprehensive, and applicable to the current operational environment. An outdated or ambiguous policy cannot be consistently enforced, regardless of controls or training efforts.

CMandate awareness training for all mobile device users.

Mandating awareness training is crucial for policy adherence, but it will not resolve inconsistencies if the underlying policy itself is flawed or irrelevant in its current form.

DImplement controls to enforce the policy.

Implementing controls to enforce the policy is an operational step that should only occur once the policy has been validated as relevant and enforceable, otherwise, it risks enforcing an ineffective or outdated policy.

Concept tested: Policy review and lifecycle management

Topics

#Policy Management#IT Governance#Compliance#Audit Response

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGEIT Practice