Which of the following is MOST important for ensuring anonymous reporting of non-compliant activity?

The correct answer is B because anonymous reporting requires a reporting channel through which employees can raise concerns or report non-compliant activity without being personally identified. ISACA’s Code of Professional Ethics includes reporting obligations and states that anyone who witnesses a member violation can report it through the ethics complaint process.

The uploaded CRISC notes emphasize that a risk-aware culture escalates issues when suspicious activity is noticed and that failure to internally report a successful attack is a major concern.

A is too technical and unrelated to employee reporting. C may support compliance oversight, but it does not ensure anonymous reporting. D may encourage reporting, but incentives do not provide anonymity.

===========