A project sponsor tells the project manager that new regulatory environment changes are coming in...

Because the regulatory change is anticipated (“coming in the next month”) and has not yet impacted the project, it should be treated as a risk (a potential future event) rather than an issue (a current problem). The correct next step is to add the risk to the risk register so it can be assessed for probability/impact, assigned an owner, and have response actions planned (avoid/mitigate/transfer/accept and contingency plans). This aligns with CompTIA Project+ risk management expectations: using the risk register to capture and manage upcoming threats that could affect scope, schedule, cost, or compliance obligations.

The other options don’t fit “next.” An issue log is for something that is already occurring and needs resolution now. A CCB is used when a specific change request is ready to be evaluated/approved, but at this point the PM needs to first understand the regulatory impact and options (which begins with risk capture and analysis). A work-around is a temporary fix for an active problem, which does not apply to an upcoming regulatory change. The PM should document the risk, analyze impact, and then—if needed—raise change requests once requirements and compliance impacts are clear.