An organization has been made aware of a newly discovered critical vulnerability in a regulatory reporting system. Which of the following is the risk practitioner's BEST course of action?

A newly discovered critical vulnerability in a regulatory reporting system poses significant potential for both security breaches and compliance failures. Performing an impact assessment is the immediate best step because it quantifies the potential business, financial, and regulatory consequences, which is crucial for determining the urgency and scope of the response and informing senior management.

Performing a penetration test is a form of proactive vulnerability assessment, but an impact assessment is needed first to understand the potential harm of the known critical vulnerability.

Requesting an external audit is a longer-term governance activity and not the immediate action required to address a newly discovered critical vulnerability.

While escalation to senior management will eventually be necessary, the risk practitioner should first conduct an impact assessment to provide management with actionable information about the severity and potential consequences, rather than just escalating an unquantified problem.