CRISC · Question #225
Which of the following is a risk practitioner's BEST course of action after identifying risk scenarios related to noncompliance with new industry regulations?
The correct answer is A. Escalate to senior management. After identifying risk scenarios related to noncompliance with new industry regulations, the risk practitioner's best course of action is to escalate the issue to senior management. This ensures organizational leadership is aware of the significant implications and can…
Question
Which of the following is a risk practitioner's BEST course of action after identifying risk scenarios related to noncompliance with new industry regulations?
Options
- AEscalate to senior management.
- BTransfer the risk.
- CImplement monitoring controls.
- DRecalculate the risk.
How the community answered
(20 responses)- A80% (16)
- B5% (1)
- C5% (1)
- D10% (2)
Why each option
After identifying risk scenarios related to noncompliance with new industry regulations, the risk practitioner's best course of action is to escalate the issue to senior management. This ensures organizational leadership is aware of the significant implications and can authorize a strategic response.
New industry regulations often carry significant legal, financial, and reputational consequences for an organization if not adhered to. Escalating these risk scenarios to senior management ensures that leadership is promptly informed of the potential high impact, allowing them to make critical decisions regarding strategy, resource allocation, and required remediation to ensure compliance.
Transferring the risk (e.g., through insurance) is a risk response strategy that requires senior management approval and is not the immediate first action after identification, especially for regulatory noncompliance.
Implementing monitoring controls is a control activity, which is typically part of a larger risk response plan approved by management, not the immediate action after identifying significant noncompliance risks.
Recalculating the risk might be part of refining the assessment, but it delays the critical step of informing decision-makers about newly identified, high-impact regulatory risks.
Concept tested: Risk escalation and reporting
Source: https://www.isaca.org/resources/isaca-journal/issues/2014/volume-5/board-reporting-on-risk-a-critical-component-of-erma-enterprise-risk-management-assurance
Topics
Community Discussion
No community discussion yet for this question.