Câu 282: Isaca Certified in Risk and Information Systems Control

Which of the following should be a risk practitioner's NEXT step upon learning the organization is not in compliance with a specific legal regulation?

1. A. Assess the likelihood and magnitude of the associated risk. — đáp án hiện tại
2. B. Identify mitigation activities and compensating controls.
3. C. Notify senior compliance executives of the associated risk.
4. D. Determine the penalties for lack of compliance.