Upcoming IT-related regulations carry costly penalties for an enterprise.

When faced with new regulations, the first step is to assess the risk they pose to the enterprise, including the likelihood and impact of noncompliance, even if enforcement is historically weak. The CGEIT Review Manual 8th Edition underscores that risk evaluation is the initial step in addressing emerging risks to prioritize actions and allocate resources effectively.

Extract from CGEIT Review Manual 8th Edition (Domain 3: Risk Optimization):"Evaluating the impact of emerging risks, such as new regulations, is the first step in the risk management process. This involves assessing the potential consequences of noncompliance, including financial, operational, and reputational impacts, as well as the likelihood of enforcement." (Approximate reference: Domain 3, Section on Risk Assessment)

Evaluating the impact of the emerging risk (option C) allows the enterprise to understand the potential penalties, operational disruptions, and reputational damage, as well as the likelihood of enforcement given the agency’s history. This assessment informs whether mitigation plans, architecture updates, or other actions are necessary.

Why not the other options?

A. Develop mitigation plans for noncompliance: Mitigation plans are developed after assessing the risk’s impact and likelihood, as the assessment determines the scope and urgency of mitigation.

B. Update the enterprise architecture (EA): Updating the EA may be a subsequent action if the risk assessment identifies specific architectural gaps, but it is not the first step.

D. Perform benchmarking activities: Benchmarking is not directly relevant to assessing regulatory risk and is a secondary activity at best.