Policies should be written by ________.

• A. IT security
• B. corporate teams involving people from multiple departments
• C. a senior executive
• D. an outside consultant, to maintain independence

Answer: (B)

Writing policies requires input from across the organization so they are practical, enforceable, and aligned with real business needs. When corporate teams from multiple departments collaborate, you get legal and regulatory insight, HR considerations, IT feasibility, risk management perspective, and operations experience. This shared ownership helps ensure the policies reflect what actually happens in the workplace, gains broad buy-in, and clarifies who is responsible for oversight and enforcement. It also reduces the risk of policies that are technically strong but operationally impractical or legally out of step. While an IT security focus or a senior executive push can be valuable, they often miss important angles or day-to-day realities. An outside consultant can bring expertise, but without internal collaboration, ownership and ongoing accountability may be weak.