Wendy's Interview Question

how would you go about implementing a GRC policy