What additional policy should a compliance officer institute alongside compliance measures?

• A. Data retention policy
• B. Incident response policy
• C. Change management policy
• D. Access control policy

Answer: (C)

A compliance officer should institute a change management policy alongside compliance measures to ensure that any modifications to systems, processes, or data handling practices adhere to established regulations and standards. A change management policy provides a structured approach for managing changes in a way that minimizes risks and establishes accountability. This ensures that all modifications are documented, reviewed, and approved before implementation, which is crucial in maintaining compliance with laws, regulations, and internal policies.

By having this policy in place, organizations can better track what changes are made, who approved those changes, and how those changes impact compliance. This proactive approach not only helps in managing risks associated with changes but also supports audits and compliance assessments, ensuring that an organization remains aligned with its compliance obligations.

The importance of the other options, while significant in different contexts, does not directly align with the immediate need to support compliance measures as effectively as a change management policy does. Data retention relates specifically to how long data is kept, incident response is focused on handling breaches and responses to security incidents, and access control is about managing who can access data, all of which are important but serve different critical functions in the broader context of compliance.