hardMultiple ChoiceObjective-mapped
CISM Practice Question: During an audit, it was found that the…
During an audit, it was found that the organization's information security policy is not being followed by business units. Which of the following is the MOST effective way for the information security manager to improve compliance?
⚠ Common exam trap
Many candidates choose awareness training (B) as a quick fix, but CISM emphasizes that non-compliance due to policy misalignment requires policy revision, not just more training or enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establish a policy review committee with business unit representatives to align policy with operational needs.
The most effective way to improve compliance is to align the policy with operational realities by involving business unit representatives in a policy review committee. When policies conflict with business processes, users will bypass them; adjusting the policy to be both secure and practical increases voluntary adherence. This addresses the root cause—policy misalignment—rather than treating symptoms like lack of awareness or enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Establish a policy review committee with business unit representatives to align policy with operational needs.
Why this is correct
Involving stakeholders increases buy-in and practical compliance.
- ✗
Provide additional security awareness training focused on policy requirements.
Why it's wrong here
Training is helpful but may not be sufficient if policies are not aligned with business processes.
- ✗
Escalate non-compliance to senior management for disciplinary action.
Why it's wrong here
Disciplinary action may create resistance and does not address root causes.
- ✗
Increase the frequency of automated policy compliance checks.
Why it's wrong here
Monitoring alone does not improve compliance; it only detects non-compliance.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.