Policy before procedure

Exam

CISA & CISM

What it means

Governance flows top-down: strategy, then policy, then standards, then procedures. If the question is about a missing foundation, the answer is usually the higher-level document.

The trap answer looks like

Write a detailed procedure or configure a tool when no policy or direction exists.

The winning answer looks like

Establish the higher-level direction first: strategy, then policy, then standards and procedures.

Worked example

Different teams handle the same security task in different ways, and no policy covers it.

✅ Establish the policy that sets the requirement

Procedures implement policy. Without policy there is nothing to implement consistently.