CGEIT · Question #335
An enterprise has learned of a new regulation that may impact delivery of one of its core technology services Which of the following should the done FIRST?
The correct answer is C. Assess the risk associated with the new regulation. When a new regulation potentially impacts a core service, the initial step is to understand its implications by assessing the associated risks.
Question
An enterprise has learned of a new regulation that may impact delivery of one of its core technology services Which of the following should the done FIRST?
Options
- AUpdate the risk management framework
- BDetermine whether the board wants to comply with the regulation
- CAssess the risk associated with the new regulation
- DRequest an action plan from the risk team
How the community answered
(26 responses)- A4% (1)
- B12% (3)
- C81% (21)
- D4% (1)
Why each option
When a new regulation potentially impacts a core service, the initial step is to understand its implications by assessing the associated risks.
Updating the risk management framework is premature before understanding the specific risks introduced by the new regulation.
Determining compliance willingness is a strategic decision that should follow an assessment of the regulation's impact and associated risks.
Assessing the risk associated with the new regulation is the foundational first step to understand the potential impact, likelihood, and severity before any further action or decision can be made regarding compliance or mitigation.
Requesting an action plan from the risk team is premature until the specific risks have been assessed and understood.
Concept tested: Risk assessment initiation
Topics
Community Discussion
No community discussion yet for this question.