What do published company policies provide for a business that enables internal investigations?

• A. Data retention policy
• B. Line of authority
• C. Incident response plan
• D. Chain of custody

Answer: (B)

Knowing who has the authority to conduct internal investigations is what published company policies establish. This is the line of authority: it clearly defines who can authorize an investigation, who leads it, who participates, and how findings are reported up the organizational chain. Having this clarity ensures accountability, prevents conflicts of interest, and streamlines decision-making and escalation if evidence or actions require higher-level approval.

Other policy areas touch on related but different things. A data retention policy explains how long records are kept and when they’re discarded, not who conducts investigations. An incident response plan outlines the steps to take during a security incident, not who is empowered to investigate internally. Chain of custody concerns how evidence is tracked and preserved, ensuring integrity of artifacts, rather than who has the authority to start or run an investigation.