Rolling out governance across many business units, a customer proposes leaving every questionnaire at its default text to save configuration time. What is the risk in this approach?
Select an answer to reveal the explanation.
Short Explanation
If you leave every questionnaire at its default text, you're asking generic questions instead of the evidence each unit actually needs. That can let real compliance gaps slip through, and that costs more than the setup time you saved.
Full Explanation
The correct answer is the option stating that default questionnaire text may not capture the specific evidence each business unit's actual obligations require, so real compliance gaps can go undetected. A questionnaire is only useful if it asks for the evidence a given obligation actually requires; default text written for a generic case will systematically miss unit-specific requirements.
The option claiming there is no risk is incorrect because questionnaire content is what determines whether the necessary evidence is captured at all; it is not a cosmetic layer.
The option saying the only risk is unclear or generic wording is incorrect because it understates the consequence: unmapped questionnaires cause missed evidence, not just awkward phrasing.
The option limiting the risk to regulated industries is incorrect because non-regulated business units can still carry internal or contractual obligations that default text was never written to capture.
For the exam, treat unmapped defaults as a compliance risk at scale, not a minor convenience trade-off.