CGEIT · Question #568
Which of the following would be the BEST way for an enterprise to address new legal and regulatory requirements applicable to IT?
The correct answer is A. Treat as a risk to be assessed before developing a response. The most effective initial step for an enterprise to address new legal and regulatory requirements applicable to IT is to treat them as a risk that must be thoroughly assessed before developing a comprehensive response.
Question
Which of the following would be the BEST way for an enterprise to address new legal and regulatory requirements applicable to IT?
Options
- ATreat as a risk to be assessed before developing a response.
- BBenchmark how other IT organizations are treating the new requirements.
- CAdopt a zero-tolerance approach for noncompliance with regulatory matters.
- DUse a cost-benefit analysis to determine if compliance is warranted.
How the community answered
(26 responses)- A69% (18)
- B12% (3)
- C4% (1)
- D15% (4)
Why each option
The most effective initial step for an enterprise to address new legal and regulatory requirements applicable to IT is to treat them as a risk that must be thoroughly assessed before developing a comprehensive response.
New legal and regulatory requirements applicable to IT fundamentally introduce compliance risks, and the best approach is to treat these as risks to be formally assessed. This involves understanding potential impacts of non-compliance, evaluating likelihood, and developing a structured response plan to mitigate these identified risks, ensuring legal and ethical obligations are met.
While benchmarking can provide insights, it's not the first or best step as it might not account for the enterprise's unique context, risk appetite, or specific obligations.
Adopting a zero-tolerance approach is an outcome or policy, not the initial analytical step required to understand and plan for new regulations.
Using a cost-benefit analysis to determine if compliance is warranted is inappropriate, as compliance with legal and regulatory requirements is generally mandatory, not optional based on cost.
Concept tested: Regulatory compliance as risk management
Source: https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-areas/governance-risk-compliance
Topics
Community Discussion
No community discussion yet for this question.