Which of the following is the BEST approach to ensure global regulatory compliance when implementing a new business process?

Ensuring global regulatory compliance for a new business process requires specialized expertise in the laws and regulations of multiple jurisdictions. The legal department is the primary organizational function responsible for interpreting these complex requirements and advising on their application. Involving the legal department appropriately from the initial stages of process design is the most direct and effective approach to proactively identify applicable regulations, assess compliance risks, and embed necessary controls into the process. This mitigates the risk of non-compliance, potential fines, and reputational damage.

A. A balanced scorecard is a performance management tool used to monitor metrics post-implementation; it does not ensure compliance during the design phase.

C. Reviewing business architecture is a necessary step, but it does not inherently guarantee regulatory compliance without the specific input and guidance from legal experts.

D. A change management board typically focuses on the operational impact and approval of changes, assuming that specialized due diligence, such as legal review, has already been conducted.

1. ISACA

CGEIT Review Manual

8th Edition

2020. Domain 4: Risk Optimization

Section 4.4

"Risk Management

" emphasizes that compliance risk is a key category of IT-related business risk. It states

"Compliance risk is the risk of legal sanctions

material financial loss or loss of reputation the enterprise may suffer as a result of its failure to comply with the requirements of applicable laws

regulations

codes of conduct and standards of good practice." Managing this risk requires direct input from legal and compliance functions.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives

2018. The management objective MEA03

"Monitor

Evaluate and Assess Compliance with External Requirements

" includes key activities such as "MEA03.01 Identify external compliance requirements" and "MEA03.02 Optimize response to external requirements." These activities inherently require the expertise of a legal department to be performed effectively

especially in a global context.

3. De Haes

S.

& Van Grembergen

W. (2015). Enterprise Governance of Information Technology: Achieving Alignment and Value

Featuring COBIT 5. Springer International Publishing. Chapter 3 discusses the COBIT 5 goals cascade

where stakeholder needs

including compliance with external laws and regulations

drive governance objectives. This establishes the principle that compliance is a primary driver that must be addressed by expert functions like legal counsel. (DOI: 10.1007/978-3-319-14547-1)