A material finding related to the integrity of personal data was discovered during a privacy audit. Which of the following should the IT privacy practitioner do FIRST?

Question

Options

• ADiscuss the matter with the board.
• BDetermine the impact to data subjects.
• CDraft a corrective plan for management.
• DUpdate the associated data privacy policy.

• A
  81% (13)
• B
  6% (1)
• C
  13% (2)

Explanation

A 'material finding' is one significant enough to affect the organization's overall risk posture or compliance standing. The first step is escalation to the board or senior leadership, because material issues require executive awareness, oversight, and direction before corrective action is taken. Leadership must understand the finding in order to authorize resources, make risk acceptance decisions, and fulfill their governance responsibilities. Determining data subject impact (B) and drafting a corrective plan (C) are important follow-on steps that should occur after leadership has been informed. Updating policy (D) is a later remediation activity. Acting without informing the board first would bypass the governance chain.

No community discussion yet for this question.