A multinational company needs to implement a new centralized security system. The risk practitioner has identified a conflict between the organization's data-handling policy and local privacy…

Requesting a policy exception from senior management only addresses the internal conflict; it does not resolve the noncompliance with external local privacy regulations.

Complying only with the organizational policy would mean knowingly violating local privacy regulations, leading to potential legal repercussions and reputational damage.

Reporting noncompliance to the local regulatory agency without attempting to find a solution or seek guidance directly could lead to unnecessary penalties or legal issues for the organization.

In cases where an organizational policy conflicts with local law or regulation, the law generally takes precedence. Requesting an exception from the local regulatory agency is the most appropriate action as it seeks to resolve the legal conflict directly with the authoritative body, potentially allowing the organization to operate within legal boundaries while still implementing its system or understanding the legal constraints.