712-50 Question 53
Single answerCompile, analyze, and report compliance programsA newly appointed CISO is consolidating the organization’s compliance reporting across PCI DSS, ISO/IEC 27001, SOX, and regional privacy regulations. Internal audit has complained that current reports are lengthy, control-by-control spreadsheets that do not show whether compliance gaps create material business risk. The board has asked for a quarterly compliance report that supports funding decisions and demonstrates whether the compliance program is improving over time. Which approach should the CISO take FIRST to compile, analyze, and report the compliance program in a way that is most useful to executive leadership?
- A
Create a unified compliance framework that maps regulatory and contractual requirements to common controls, then report trends, residual risk, remediation status, and exceptions by business impact
- B
Provide separate detailed reports for each regulation so the board can review every unmet requirement and determine the severity of each finding independently
- C
Limit reporting to the number of open findings and overdue remediation items because quantitative metrics are more objective than risk-based summaries
- D
Focus the report on controls that passed testing to demonstrate program maturity and include failed controls only in an appendix for the audit committee
Show answer and explanation
Correct answer: A
Explanation
The best answer is to establish a unified compliance framework and produce risk-based executive reporting. In mature compliance programs, the objective is not just to demonstrate that assessments occurred, but to compile obligations efficiently, analyze control performance across frameworks, and report what matters for business decisions. Mapping multiple requirements to a common control library is consistent with common GRC practice and with the structure used in standards and frameworks such as ISO/IEC 27001 and related control catalogs, PCI DSS requirement mapping exercises, and widely adopted governance approaches like the NIST Cybersecurity Framework and NIST SP 800-53-based control rationalization. For board-level reporting, best practice is to present summarized compliance posture, key risk indicators, trend lines, remediation progress, exceptions, and the business impact of material gaps. This enables leadership to understand where compliance deficiencies overlap with operational, legal, financial, or reputational risk and to allocate resources accordingly. Raw compliance data belongs in supporting documentation, while executive reports should emphasize materiality, trends, accountability, and residual risk.
- A. Correct.
Correct. A unified compliance framework is the strongest first step because it normalizes overlapping requirements across multiple obligations into a common control set, reducing duplication and enabling analysis at the control, process, and business-service level. For executive reporting, leadership generally needs risk-informed summaries, not raw control catalogs. Including residual risk, trend information, remediation status, and approved exceptions ties compliance performance to business impact and supports prioritization and funding decisions. This approach reflects established good practice in governance, risk, and compliance programs: map obligations to controls, assess control effectiveness, analyze the resulting exposure, and present concise management reporting.
- B. Incorrect.
Incorrect. Separate regulation-specific reports may be useful for compliance teams, assessors, or auditors, but they are not the most effective format for executive leadership. This approach increases duplication, obscures common root causes, and pushes interpretation work onto the board, which is not appropriate. Senior leadership should receive synthesized reporting that shows risk posture, material gaps, trend direction, and resource implications rather than requirement-by-requirement detail.
- C. Incorrect.
Incorrect. Open findings and overdue actions are useful operational metrics, but reporting only those values creates a narrow view of compliance health. It does not show whether findings are concentrated in high-risk areas, whether compensating controls exist, whether legal or contractual exposure is increasing, or whether the program is improving. A common misconception is that objective counts alone are sufficient; in practice, compliance reporting must be contextualized with risk, severity, and business impact.
- D. Incorrect.
Incorrect. Highlighting only passed controls can create a misleading picture and undermines the purpose of management reporting. Executive stakeholders need visibility into significant failures, accepted risks, systemic issues, and remediation barriers. Moving failed controls to an appendix may be acceptable for low-level technical details, but material deficiencies should be prominent in the main report. This option reflects a maturity-showcasing bias rather than transparent governance.