Exam CISA topic 1 question 929 discussion

noncompliance with regulatory reporting, especially when a deadline is involved, can have significant consequences. In this case, ensuring that regulatory reporting is completed (Option B) is crucial because it addresses the immediate compliance requirement and prevents potential legal or regulatory penalties. While documenting risk acceptance (Option D) is important for internal risk management and accountability, completing regulatory reporting is essential to meet external compliance obligations and avoid enforcement actions. Therefore, if the organization is facing a regulatory deadline, ensuring regulatory reporting is completed would be the best course of action to avoid noncompliance penalties

Documenting risk acceptance (D) is essential for ensuring that the organization's management is accountable for the decision and is aware of its implications. It also serves as an important record for future reference, both for internal governance and for external audits or regulatory reviews.

D. Ensure risk acceptance is documented In this situation, the organization has made a conscious decision not to implement a new regulation by the required deadline because they believe the cost of rapid implementation is higher than the penalty for noncompliance. This represents a risk acceptance decision, where the organization is choosing to accept the risk of noncompliance. To properly address this from an audit perspective, the auditor should ensure that this risk acceptance decision is well-documented. Documenting the risk acceptance decision is important for transparency and accountability within the organization. It ensures that the decision-makers are aware of the risks they are taking and that the reasons for not complying with the regulation are clear. While conducting a gap analysis, updating the risk register, and ensuring regulatory reporting are important tasks, in this specific scenario, documenting the risk acceptance is the most critical action to address the organization's noncompliance decision.