Which of the following is NOT included in a preliminary compliance program?

The choice of protective systems as something not included in a preliminary compliance program is accurate because, at the initial stages of establishing a compliance program, the focus is primarily on creating a foundation of policies, procedures, and mechanisms for enforcement rather than the intricate protective measures themselves.

Preliminary compliance programs typically emphasize logically written policies and procedures that provide clear guidance and establish a framework for compliance. This ensures that staff understand expectations and the legal standards they must meet. Additionally, consistent enforcement of punishment for non-compliance is crucial at this stage to establish accountability and deter non-compliant behavior.

While protective systems may indeed be an important component of a more mature compliance program—designed to keep sensitive data secure and protect against risks—they are not typically present in the early implementation phase. Hence, the other components, such as adherence to policy and enforcement measures, are foundational elements that should be established first to promote an effective compliance culture within an organization.