A risk practitioner has reviewed new international regulations and realizes the new regulations will affect the organization. Which of the following should be the risk practitioner's NEXT course of…

Conducting a peer response assessment might be useful later, but it's not the immediate next step in formalizing the risk internally.

Once new regulations are identified as impacting the organization, the risk register needs to be updated immediately to incorporate these new compliance risks. This ensures that the organization formally acknowledges, documents, and begins to assess the potential impact and likelihood of non-compliance, which is a foundational step before determining specific mitigation actions or broader program reevaluation.

Reevaluating the entire risk management program might be necessary eventually, but first, the specific risks introduced by the new regulations need to be documented.

Ensuring applications are compliant is a specific mitigation action that comes after the risks have been identified, documented, and assessed in the risk register.