What is the recommended first step when you realize a policy is outdated?

• A. Document the issue, propose updates, and engage the appropriate policy owner for review.
• B. Ignore the issue until the policy's next formal review.
• C. Directly implement changes and publish them for staff to follow.
• D. Replace the policy with a new one without approval.

Answer: (A)

Starting with documenting the issue, proposing updates, and engaging the appropriate policy owner for review sets the right tone for policy governance. It creates a clear record of what’s outdated, what needs changing, and why, while assigning accountability to the person responsible for the policy. This ensures that proposed changes are grounded in evidence and aligned with existing controls before any edits are made. Involving the policy owner also ensures proper authorization and coordination across related policies, which helps prevent conflicting updates.

Ignoring the issue delays fixes and increases risk of noncompliance. Implementing changes or replacing the policy without review bypasses the required governance steps, potentially introducing errors or misalignment with other policies and procedures.