Which of the following is the BEST approach to ensure global regulatory compliance when implementing a new business process?

Ensuring global regulatory compliance for a new business process requires specialized expertise in the laws and regulations of multiple jurisdictions. The legal department is the primary organizational function responsible for interpreting these complex requirements and advising on their application. Involving the legal department appropriately from the initial stages of process design is the most direct and effective approach to proactively identify applicable regulations, assess compliance risks, and embed necessary controls into the process. This mitigates the risk of non-compliance, potential fines, and reputational damage.

A. A balanced scorecard is a performance management tool used to monitor metrics post-implementation; it does not ensure compliance during the design phase.
C. Reviewing business architecture is a necessary step, but it does not inherently guarantee regulatory compliance without the specific input and guidance from legal experts.
D. A change management board typically focuses on the operational impact and approval of changes, assuming that specialized due diligence, such as legal review, has already been conducted.

1. ISACA, CGEIT Review Manual, 8th Edition, 2020. Domain 4: Risk Optimization, Section 4.4, "Risk Management," emphasizes that compliance risk is a key category of IT-related business risk. It states, "Compliance risk is the risk of legal sanctions, material financial loss or loss of reputation the enterprise may suffer as a result of its failure to comply with the requirements of applicable laws, regulations, codes of conduct and standards of good practice." Managing this risk requires direct input from legal and compliance functions.

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives, 2018. The management objective MEA03, "Monitor, Evaluate and Assess Compliance with External Requirements," includes key activities such as "MEA03.01 Identify external compliance requirements" and "MEA03.02 Optimize response to external requirements." These activities inherently require the expertise of a legal department to be performed effectively, especially in a global context.

3. De Haes, S., & Van Grembergen, W. (2015). Enterprise Governance of Information Technology: Achieving Alignment and Value, Featuring COBIT 5. Springer International Publishing. Chapter 3 discusses the COBIT 5 goals cascade, where stakeholder needs, including compliance with external laws and regulations, drive governance objectives. This establishes the principle that compliance is a primary driver that must be addressed by expert functions like legal counsel. (DOI: 10.1007/978-3-319-14547-1)