Which practice helps ensure consistent security training and audits across an organization?

• A. Random ad-hoc training without records.
• B. Documentation and policy alignment.
• C. Disallow policies to keep flexible.
• D. Outsourcing all training with no internal policy.

Answer: (B)

Having clear documentation and policy alignment ensures every part of the organization follows the same security expectations. When training requirements, policies, and evidence of completion are documented, you create a repeatable, auditable process that can be consistently applied across departments and over time. This makes it easier to schedule regular trainings, assign responsibilities, and provide concrete records during audits, showing that due care and regulatory obligations are being met.

Other approaches fall short because they lack a centralized, verifiable framework. Random ad-hoc training with no records leads to uneven knowledge and no proof of what was learned or when. Disallowing policies removes the standard references people should follow, causing confusion and inconsistency. Outsourcing all training with no internal policy removes governance and alignment with the organization’s specific risk posture, making it hard to ensure content meets internal requirements and to track progress.