An audit finds that a policy is established but employees in several departments do not know how their work relates to it. Which response best reflects the course's accountability approach?

### Why this is right The course emphasizes communication throughout the organization and collaborative decision-making across departments. The audit finding points to a gap between established expectations and employee understanding, so communication and participation address the problem. ### The concept A policy can exist without being effectively understood or implemented. Accountability requires clear roles and communication, while collaboration recognizes that cybersecurity is not solely a technical department's responsibility. Audits can reveal these gaps and inform improvement. ### The other options - **B. Assume the information technology department alone can resolve every organizational issue**: This conflicts with the course's organization-wide approach. - **C. Remove the policy because employees were not informed**: The finding suggests a communication problem, not necessarily that the policy is unsuitable. - **D. Stop auditing because a policy exists**: An established policy still needs review for compliance and improvement. ### Remember When people do not understand expectations, improve communication and role clarity.