A risk practitioner learns that a risk owner has been accepting gifts from a supplier of IT products. Some of these IT products are used to implement controls and to mitigate risk to acceptable…

Initiating disciplinary action is typically the role of HR or management, not the risk practitioner, and it should only occur after a proper investigation.

While reassessing risk and reviewing controls is necessary, it is a subsequent step after reporting the ethical breach and addressing the conflict of interest.

Reviewing ethics policies is important, but the immediate action upon discovering a potential violation is to report it, as the violation is already apparent.

A risk practitioner's immediate responsibility when encountering unethical behavior or a conflict of interest that could compromise controls is to escalate the issue through the proper channels, typically by reporting it to their supervisor. This ensures organizational awareness and allows for an appropriate investigation and response, rather than the practitioner taking direct action.