ISACA Exam Questions

The PRIMARY reason for initiating a policy exception process is when:

The PRIMARY reason for initiating a policy exception process is when:

A.
operations are too busy to comply.

B.
the risk is justified by the benefit.

C.
policy compliance would be difficult to enforce.

D.
users may initially be inconvenienced.

Explanation:
Exceptions to policy are warranted in circumstances where compliance may be difficult or impossible and the risk of noncompliance is outweighed by the benefits. Being busy is not a justification for policy exceptions, nor is the fact that compliance cannot be enforced. User inconvenience is not a reason to automatically grant exception to a policy.