nerdexam
Isaca

CRISC · Question #225

Which of the following is a risk practitioner's BEST course of action after identifying risk scenarios related to noncompliance with new industry regulations?

The correct answer is A. Escalate to senior management. After identifying risk scenarios related to noncompliance with new industry regulations, the risk practitioner's best course of action is to escalate the issue to senior management. This ensures organizational leadership is aware of the significant implications and can…

Submitted by yaw92· Apr 18, 2026Governance

Question

Which of the following is a risk practitioner's BEST course of action after identifying risk scenarios related to noncompliance with new industry regulations?

Options

  • AEscalate to senior management.
  • BTransfer the risk.
  • CImplement monitoring controls.
  • DRecalculate the risk.

How the community answered

(20 responses)
  • A
    80% (16)
  • B
    5% (1)
  • C
    5% (1)
  • D
    10% (2)

Why each option

After identifying risk scenarios related to noncompliance with new industry regulations, the risk practitioner's best course of action is to escalate the issue to senior management. This ensures organizational leadership is aware of the significant implications and can authorize a strategic response.

AEscalate to senior management.Correct

New industry regulations often carry significant legal, financial, and reputational consequences for an organization if not adhered to. Escalating these risk scenarios to senior management ensures that leadership is promptly informed of the potential high impact, allowing them to make critical decisions regarding strategy, resource allocation, and required remediation to ensure compliance.

BTransfer the risk.

Transferring the risk (e.g., through insurance) is a risk response strategy that requires senior management approval and is not the immediate first action after identification, especially for regulatory noncompliance.

CImplement monitoring controls.

Implementing monitoring controls is a control activity, which is typically part of a larger risk response plan approved by management, not the immediate action after identifying significant noncompliance risks.

DRecalculate the risk.

Recalculating the risk might be part of refining the assessment, but it delays the critical step of informing decision-makers about newly identified, high-impact regulatory risks.

Concept tested: Risk escalation and reporting

Source: https://www.isaca.org/resources/isaca-journal/issues/2014/volume-5/board-reporting-on-risk-a-critical-component-of-erma-enterprise-risk-management-assurance

Topics

#Risk Escalation#Regulatory Compliance#Risk Reporting#Senior Management Oversight

Community Discussion

No community discussion yet for this question.

Full CRISC Practice