A highly regulated enterprise is developing a new risk management plan to specifically address legal and regulatory risk scenarios What should be done FIRST by IT governance to support this effort?

Requesting a regulatory risk reporting methodology is a subsequent step after objectives are set and risks are being managed, as reporting requires clear objectives to measure against.

Requiring critical success factors (CSFs) for IT risks is part of setting performance goals for risk management, which comes after understanding the core compliance objectives.

For IT governance to effectively address legal and regulatory risk scenarios, it must first define clear, measurable IT-specific compliance objectives derived directly from the applicable laws and regulations. These objectives serve as the foundational targets and benchmarks against which IT risk management activities and controls will be aligned, ensuring that efforts are focused on meeting regulatory requirements.

Communicating IT key risk indicators (KRIs) and triggers is an operational activity for monitoring identified risks, but the establishment of compliance objectives precedes the identification and monitoring of risks.