An internal audit of a large financial institution found that financial data is being managed in a way that will negatively impact the enterprise's ability to support regulatory reporting. Which of th

Establishing a data governance framework is the first strategic action because it provides the foundational structure for defining policies, roles, responsibilities, standards, and processes for managing data throughout its lifecycle. This framework ensures that financial data is managed consistently, accurately, and securely, which is critical for meeting regulatory reporting requirements and addressing the systemic issues identified by the audit.

Assigning data responsibilities via a RACI chart is an important component of a data governance framework, but it presumes that the overarching framework and underlying policies for data management are already in place.

Reviewing Key Risk Indicators (KRIs) is a monitoring activity that helps assess risk, but it doesn't establish the foundational controls and management structure needed to fix a systemic problem with data management at a strategic level.

Updating data management policies is an operational step within a governance structure; without an established data governance framework, policy updates may not be effectively implemented, enforced, or aligned with broader strategic objectives.