Guiding Principles And GRC practice questions

Focus on value

Why it fails: Value is important, but leveraging existing materials specifically addresses starting point assessment.

Optimize and automate

Why it fails: There is no automation aspect highlighted here.

Think and work holistically

Why it fails: Holistic thinking involves end-to-end integration rather than simple asset reuse.

Start where you are

Why it fails: Start where you are means assessing existing assets and capabilities before changing them, not designing new automated guardrails. It is tempting because the cloud team already has provisioning tooling, but the scenario's emphasis on building controls into templates demonstrates Progress iteratively with feedback.

Collaborate and promote visibility

Why it fails: Collaborate and promote visibility concerns breaking silos and sharing information across teams, not encoding approval gates into provisioning templates. It is tempting because audit and cloud teams must align, but the principle illustrated by automated guardrails that preserve developer speed is Progress iteratively with feedback.

Focus on value

Why it fails: Focus on value concerns understanding what customers perceive as valuable, not embedding approval gates into provisioning templates. It is tempting because governance ultimately protects value, but the principle demonstrated by automated guardrails that keep delivery flowing is Progress iteratively with feedback.

Start where you are AND Progress iteratively with feedback

Why it fails: These are helpful for deployment pacing but do not capture the core strategic intent of ESG alignment.

Keep it simple and practical AND Optimize and automate

Why it fails: While practical, this combination misses the broader strategic value and holistic supply chain nature of ESG.

Collaborate and promote visibility AND Keep it simple and practical

Why it fails: Collaborating with suppliers is useful, but the strategic drive requires value and holistic impact.

Optimize and automate

Why it fails: Optimise and automate concerns streamlining and automating workflows, typically through technology, rather than convening cross-functional stakeholders to diagnose a process. It is tempting because reducing a three-week approval delay sounds like a candidate for automation, but the workshop itself is mapping dependencies across legal, security, development and operations, which is collaboration and visibility work.

Keep it simple and practical

Why it fails: Keep it simple and practical concerns eliminating unnecessary steps and complexity from a process, not gathering four departments to map that process. It is tempting because a three-week approval chain may contain redundant steps, but simplification follows diagnosis; the workshop itself is cross-functional mapping, which addresses organisational silos rather than procedural complexity.

Focus on value

Why it fails: Focus on value concerns understanding what consumers actually want and measuring outcomes, not assembling representatives to trace a workflow's delays. It is tempting because faster compliance approvals do deliver value, but the workshop's purpose is mapping why approvals take three weeks across four teams, which is about breaking down silos and improving flow of work.

Start where you are AND Collaborate and promote visibility

Why it fails: While assessment and visibility matter, the phased rollout strategy is inherently iterative and value-focused.

Optimize and automate AND Keep it simple and practical

Why it fails: This scenario is about phased scoping, not technical automation.

Think and work holistically AND Start where you are

Why it fails: Holistic thinking would involve looking at all 50 units, which the CISO is intentionally avoiding for now.

Start where you are

Why it fails: Starting where you are means assessing existing services and reusing what already works; it offers no mechanism for challenging a blanket RTO mandate on cost grounds. It suits incremental improvement of current processes, not resolving a conflict between compliance requirements and budget.

Keep it simple and practical

Why it fails: Keep it simple and practical concerns eliminating unnecessary complexity in how work is done, not questioning whether a uniform 4-hour RTO across all systems is justified. It fits streamlining an agreed process, whereas this conflict is about aligning requirements with value and cost.

Optimize and automate

Why it fails: Optimize and automate addresses improving and automating existing workflows, so it cannot resolve a dispute over whether non-critical blogs genuinely need a 4-hour RTO. It is the right principle once processes are agreed and you want to increase their efficiency.

Think and work holistically

Why it fails: While holistic, examining the current operational baseline is specifically starting where you are.

Focus on value

Why it fails: Value is not the primary driver of baseline discovery here.

Optimize and automate

Why it fails: Interviews are manual conversations, not automation.

Progress iteratively with feedback AND Start where you are

Why it fails: Policy-as-Code is an automation and simplification strategy.

Collaborate and promote visibility AND Focus on value

Why it fails: While collaboration happens, the technical mechanism is automation and practical streamlining.

Start where you are AND Think and work holistically

Why it fails: This describes technical automation and policy integration, not baseline discovery.

Start where you are

Why it fails: Discovering the sheet is the start, but the educational response is collaborative.

Optimize and automate

Why it fails: While password managers automate encryption, the core action here is educational collaboration.

Focus on value

Why it fails: Value is not the primary behavioral focus of choosing education over punishment.

Focus on value

Why it fails: Value is the end goal, but checking existing templates specifically relates to starting point inventory.

Think and work holistically

Why it fails: Holistic thinking spans end-to-end value streams.

Optimize and automate

Why it fails: Using out-of-the-box templates is configuration reuse, not automation.

Mapping out the complete end-to-end customer journey across multiple departments.

Why it fails: Mapping end-to-end journeys aligns with 'Think and work holistically'.

Establishing weekly cross-functional standup meetings between security and development teams.

Why it fails: Cross-functional meetings embody 'Collaborate and promote visibility'.

Automating software deployment pipelines using GitHub Actions.

Why it fails: Automating deployment pipelines is an example of 'Optimize and automate'.

Applying 'Optimize and automate' by disabling all audit logging to speed up clinician login times.

Why it fails: Disabling audit logging violates HIPAA compliance and destroys risk traceability.

Applying 'Start where you are' by assuming all legacy medical devices are secure without conducting asset discovery.

Why it fails: Assuming security without discovery violates risk assessment practices.

Roll out the anti-bribery policy to all global offices simultaneously on day one.

Why it fails: A simultaneous global rollout contradicts iterative progress, which favours phased pilots whose feedback informs later stages before wider deployment. Organisation-wide launches are correctly used once a policy is proven and stable, but applying one on day one removes the feedback loop needed to refine the anti-bribery controls.

Wait for external auditors to mandate specific policy sections before making any changes.

Why it fails: Waiting for external auditors inverts the principle: iterative progress requires the organisation to act, gather feedback and refine, not defer to an external mandate. Auditor-driven remediation is correctly used when responding to a formal nonconformity finding, but it stalls the voluntary, incremental improvement ISO 37001 implementation demands.

Draft a 500-page governance handbook before engaging any stakeholders.

Why it fails: Drafting a 500-page handbook before engaging stakeholders inverts the principle, which starts with a small minimum viable increment and refines it through stakeholder feedback. Documentation is a legitimate later output once scope and controls are agreed, but producing it upfront delays learning and locks in unvalidated assumptions.

Delegate all risk management decisions entirely to the software development leads.

Why it fails: Delegating all risk decisions to development leads removes the risk function's oversight and creates unmanaged risk. It is tempting because it accelerates decisions, but the principle calls for simplifying controls, not transferring accountability away from those accountable for enterprise risk.

Conduct a 3-month comprehensive audit of all historical agile deployments before releasing new code.

Why it fails: A three-month retrospective audit adds delay and analysis rather than removing the bottleneck, contradicting 'keep it simple and practical'. It is tempting because auditing historical deployments feels like evidence-based governance, but that principle favours streamlining controls to the minimum needed, not exhaustive review.

Remove all compliance gates for agile teams to maximize deployment speed.

Why it fails: Removing all compliance gates eliminates risk controls entirely, which is not simplification but abandonment of governance. It is tempting because it maximises deployment speed, yet 'keep it simple and practical' means retaining necessary controls while removing wasteful steps, not deleting compliance.

Collaborate and promote visibility

Why it fails: Collaboration addresses siloed knowledge, not the paralysis caused by attempting full-scope analysis; the stem needs progress via small, iterative steps. It is tempting because stakeholder input genuinely improves risk visibility, and it would be correct where risk assessments suffer from missing perspectives rather than an over-ambitious single-pass scope.

Optimize and automate

Why it fails: Optimize and automate concerns streamlining and mechanising workflows, not scoping an oversized risk exercise into manageable steps. It is tempting because automation reduces manual effort, and would be correct when repetitive tasks need tooling, but the paralysis stems from attempting everything at once, which progress-iteratively addresses.

Think and work holistically

Why it fails: Think and work holistically emphasises understanding how components interrelate within the whole system, which encourages broader scope rather than narrowing it. It is tempting because holistic thinking improves risk coverage, and would suit assessing cross-team dependencies, but the stem needs work broken into smaller increments, which progress-iteratively provides.

Start where you are

Why it fails: Starting where you are means reusing existing assets and data rather than rebuilding from scratch; it says nothing about integrating separate teams, so it does not address the silo. It would be correct when an organisation already owns tooling it should leverage instead of procuring replacements, not when two functions must be joined.

Focus on value

Why it fails: Focus on value concerns prioritising work that delivers measurable business outcomes, not the structural separation between compliance and development. It would be the right principle when selecting which initiatives to fund or sequence, whereas the stem's issue is that two interdependent teams share no collaboration or data flow.

Keep it simple and practical

Why it fails: Siloed compliance and development teams duplicate data entry and manual reconciliation, violating the simplicity and practicality principle. That principle is tempting because it sounds like a general efficiency slogan, and it would be the correct answer when a design adds unnecessary complexity rather than breaking integration.

Bypass the change advisory board (CAB) entirely for all future incidents without updating the formal risk policy.

Why it fails: Bypassing the CAB without amending the formal risk policy leaves the governance gap intact, so the same conflict recurs and auditability is lost. It is tempting because emergency changes often skip review, but that shortcut belongs to a defined emergency-change procedure, not permanent unmanaged bypass.

Escalate the compliance officer's authority to veto any emergency changes to protect system stability.

Why it fails: Escalating veto authority entrenches the outdated policy that caused the delay, so the GRC conflict persists rather than being resolved holistically. It is tempting because compliance officers do guard change integrity, but that role fits stable regulated environments, not an incident review demanding policy revision.

Outsource incident response to a third party to avoid internal policy conflicts.

Why it fails: Outsourcing incident response transfers the work but not the underlying policy conflict, which remains in the organisation's own change management process. It is tempting because third parties can supply specialist response capacity, yet that suits capability gaps, not reconciling internal GRC policy with incident needs.

Delegate risk appetite definitions entirely to software developers.

Why it fails: Developers cannot own risk appetite; it is set by governance and leadership, and delegation without oversight breaks accountability under 'optimise risk'. Delegating technical risk decisions is tempting where teams own delivery, but appetite definition remains a governing-body responsibility, not a development task.

Transfer all risk to cyber insurance carriers and remove internal security controls.

Why it fails: Cyber insurance cannot absorb all risk; residual risk and control ownership remain with the organisation, and removing internal controls breaches governance and the 'optimise risk' practice. Insurance transfers financial impact only, and is tempting where a specific, bounded risk is genuinely cheaper to insure than to mitigate.

Enforce strict compliance controls uniformly regardless of business impact to guarantee zero security breaches.

Why it fails: Uniform controls ignoring business impact contradict 'Focus on value' and the 'optimise risk' practice, which balances cost, risk and value; zero breaches is unattainable. Such rigidity is tempting where regulatory or safety obligations demand identical treatment, but here it stalls revenue-generating features without reducing overall risk.

Switch from Excel spreadsheets to a shared Microsoft Word document.

Why it fails: A shared Word document retains manual entry and human tracking, so missed renewals persist; it merely relocates the spreadsheet without adding scheduling or alerting. Optimize and automate requires tooling that records expiry dates and notifies owners automatically. Word suits narrative policy documents, not structured certificate lifecycle tracking with date-driven reminders.

Hire two additional compliance analysts to manually check spreadsheets daily.

Why it fails: Adding headcount preserves the manual spreadsheet process, so renewals still depend on human checking and remain prone to being missed. The Optimize and automate principle calls for tooling that schedules and triggers certificate renewal alerts automatically. Manual analysts would fit only where judgement cannot be codified, such as adjudicating ambiguous contractual risk.

Eliminate vendor risk reviews to speed up procurement.

Why it fails: Removing vendor reviews takes away a control rather than improving it, leaving third-party compliance unchecked and raising supply chain risk. 'Optimise and automate' is about doing necessary work more efficiently and reliably, not deleting it. Speeding procurement at the expense of risk management also conflicts with the principle of focusing on value for the organisation.