Which of the following should be the GREATEST concern to an IS auditor evaluating an organization's policies?

The correct answer is D. Policies do not identify adequate controls or processes to protect the organization. Policies that do not identify adequate controls or processes to protect the organization represent the greatest concern, as this undermines the very purpose of having policies - to enforce security, compliance, and risk management. Without adequate controls, the organization is…

Submitted by chiamaka_o· Apr 18, 2026Information Security Program Development and Management

Question

Options

APolicies are not formally acknowledged and signed by employees.
BPolicies are not updated on an annual basis.
CPolicies are not reviewed by the chief information officer (CIO).
DPolicies do not identify adequate controls or processes to protect the organization.

How the community answered

(23 responses)

A
22% (5)
B
13% (3)
C
4% (1)
D
61% (14)

Explanation

Policies that do not identify adequate controls or processes to protect the organization represent the greatest concern, as this undermines the very purpose of having policies - to enforce security, compliance, and risk management. Without adequate controls, the organization is left vulnerable to threats and regulatory non-compliance.

Topics

#Security Policies#Policy Evaluation#Control Adequacy#IS Audit Concerns

Community Discussion

No community discussion yet for this question.

Full CISM Practice